Loading report

CertScore.ai report

Loading report

The report is ready; we’re loading its retained findings and evidence.

ergoveritas.com tracking, cookie, consent, and accessibility scan | CertScore.ai

Scanned from California

Sep 28, 2026, 3:36:36 PM UTC(7 sec scan)

Coverage

CMS / generator: Not identified
Declared version: Not available

Coverage

Scan scope: Single page
Pages scanned: 1
Scan region: California

Timing

Observation window: 7 sec

Started: Sep 28, 2026, 3:36:36 PM UTC
Completed: Sep 28, 2026, 3:36:44 PM UTC

ergoveritas.com

https://ergoveritas.com/test2.html

Executive overview

—

Assessment incomplete

1 page scanned

California score unavailable: this visit did not retain enough evidence to assess risk. Missing capture is not a passing result.

Assessment highlights

California assessment is incomplete. No priority issue was established from the retained evidence; unresolved checks may still contain issues. See California privacy review in Detailed evidence for the remaining checks.

Pre-consent resource counts & classifications

Each resource is counted once. Services group requests, cookies/storage and frames.

Requests8

Non-essential: 6
Classification review: 0
Unknown purpose: 2
Contextual: 0
Essential: 0

Cookies & storage10

Non-essential: 3
Classification review: 3
Unknown purpose: 0
Contextual: 3
Essential: 1

Embedded frames0

Non-essential: 0
Classification review: 0
Unknown purpose: 0
Contextual: 0
Essential: 0

Services8

Facebook
FullStory
Google Analytics
Hotjar
Microsoft Clarity
Mixpanel
OneTrust CMP
Segment

FormsNot captured

Hidden links0

Requests86 non-essential0 review

Cookies & storage103 non-essential3 review

Embedded frames00 non-essential0 review

Regulatory Risk Review · CCPA/CPRA & accessibility

Top issues on this page

Assessment incomplete

Pre-consent page event timeline

Scan start

Public page observation began

0.67s

3P request

3P request first observed

0.67s

Analytics

Analytics first observed

0.67s

Non-essential request

Canonical pre-consent tracking concern observed

0.68s

Ad vendor

Ad vendor first observed

0.68s

Embedded content

Embedded content first observed

0.68s

Session replay

Session replay first observed

1.19s

Cookie observed

_ga_TEST2 · snapshot observation

1.19s

Pre-consent storage review

Classification review · first retained observation

6.02s

Observation end

Retained scan window closed

Pre-consent supporting evidence

Services & Resources

Resource breakdowns

18 distinct resources = 8 requests + 10 cookies & storage. Services group these resources.

Type mix

Requests8
Cookies & storage10

Evidence mix

Non-essential9
Classification review3
Unknown purpose2
Contextual3
Essential1

Purpose mix

Unknown purpose5
Analytics4
Session replay3

Site relationship

First party12
Third party6

Services and their member resources
						Domain	Site relationship
1	FullStory	Session replay	Policy disclosure · Mentioned FullStory Review scope: retained site policy from the homepage scan; this is a disclosure lookup, not a finding about compliance. Advertising, sale and sharing The test sends an advertising request to Meta and measurement or replay requests to Google Analytics, Microsoft Clarity, Hotjar, FullStory and Mixpanel before a choice. These are intentional signals for review of targeted advertising and possible sale or sharing. The test does not itself reach a legal conclusion about any individual request. Global Privacy Control When Global Matched at product level. https://ergoveritas.com/test2-privacy-policy.html Reviewed 2026-09-28T15:36:43.231Z · Complete retained text Evidence SHA-256: c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9	Location details FullStory Server locations describe the endpoint associated with the captured browser response. They may be CDN edges and do not establish subsequent processing or storage locations. No server IP is available in this inventory entry. Historical evidence may not include a destination summary. For newly assessed requests, a service-worker, failed or incomplete response may not expose an address; check retained connection evidence for the reason. 1 of 1 request events assessed; 1 without a retained server IP. Provider headquarters: US Transfer mechanism: Mechanism not assessed Headquarters reference only; this vendor's transfer arrangements have not been assessed. Registry reference date: 2026-09-07. This is registry context, not verification of this site's transfer arrangements. Corporate headquarters FullStory, Inc. Company announcement identifies Atlanta, USA headquarters and separate regional teams. Sources checked 2026-09-07 Fullstory company growth announcement Headquarters and network operator are distinct; neither establishes this site's contracting entity or subsequent data processing locations.	0.7s	rs.fullstory.com	Third party	Captured on 1 page https://ergoveritas.com/test2.html
3	Google Analytics	Analytics	Policy disclosure · Mentioned Google Analytics Review scope: retained site policy from the homepage scan; this is a disclosure lookup, not a finding about compliance. authentication data is collected by the page. Advertising, sale and sharing The test sends an advertising request to Meta and measurement or replay requests to Google Analytics, Microsoft Clarity, Hotjar, FullStory and Mixpanel before a choice. These are intentional signals for review of targeted advertising and possible sale or sharing. The test does not itself reach a legal conclusion about any individual reque Matched at product level. https://ergoveritas.com/test2-privacy-policy.html Reviewed 2026-09-28T15:36:43.231Z · Complete retained text Evidence SHA-256: c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9	Location details Google Analytics Server locations describe the endpoint associated with the captured browser response. They may be CDN edges and do not establish subsequent processing or storage locations. No server IP is available in this inventory entry. Historical evidence may not include a destination summary. For newly assessed requests, a service-worker, failed or incomplete response may not expose an address; check retained connection evidence for the reason. 1 of 1 request events assessed; 1 without a retained server IP. Provider headquarters: US Transfer mechanism: Mechanism not assessed US-controlled vendor; mechanism requires current vendor/legal verification. Registry reference date: 2026-07-23. This is registry context, not verification of this site's transfer arrangements. Corporate headquarters Google LLC Google identifies Mountain View, California as its headquarters. This does not identify a customer's regional Google contracting entity or Alphabet's headquarters. Sources checked 2026-09-07 Google company history Headquarters and network operator are distinct; neither establishes this site's contracting entity or subsequent data processing locations.	0.67s	ergoveritas.com Service domains ergoveritas.com www.google-analytics.com	Mixed	Captured on 1 page https://ergoveritas.com/test2.html
1	Hotjar	Session replay	Policy disclosure · Mentioned Hotjar Review scope: retained site policy from the homepage scan; this is a disclosure lookup, not a finding about compliance. he page. Advertising, sale and sharing The test sends an advertising request to Meta and measurement or replay requests to Google Analytics, Microsoft Clarity, Hotjar, FullStory and Mixpanel before a choice. These are intentional signals for review of targeted advertising and possible sale or sharing. The test does not itself reach a legal conclusion about any individual request. Global Privacy Control Matched at product level. https://ergoveritas.com/test2-privacy-policy.html Reviewed 2026-09-28T15:36:43.231Z · Complete retained text Evidence SHA-256: c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9	Location details Hotjar Server locations describe the endpoint associated with the captured browser response. They may be CDN edges and do not establish subsequent processing or storage locations. No server IP is available in this inventory entry. Historical evidence may not include a destination summary. For newly assessed requests, a service-worker, failed or incomplete response may not expose an address; check retained connection evidence for the reason. 1 of 1 request events assessed; 1 without a retained server IP. Provider headquarters: Unknown Transfer mechanism: Mechanism not assessed Corporate headquarters Hotjar Ltd Hotjar says its Malta entity merged into Contentsquare on July 1, 2025 and billing moved to regional Contentsquare entities. The legacy detected identity does not establish current provider headquarters. Sources checked 2026-09-07 Hotjar entity merger and billing changes Headquarters and network operator are distinct; neither establishes this site's contracting entity or subsequent data processing locations.	0.68s	static.hotjar.com	Third party	Captured on 1 page https://ergoveritas.com/test2.html
2	Facebook	Advertising	Policy disclosure · Mentioned Facebook Review scope: retained site policy from the homepage scan; this is a disclosure lookup, not a finding about compliance. . No account, purchase, form submission or authentication data is collected by the page. Advertising, sale and sharing The test sends an advertising request to Meta and measurement or replay requests to Google Analytics, Microsoft Clarity, Hotjar, FullStory and Mixpanel before a choice. These are intentional signals for review of targeted advertising and possible sale or sharing. The test does not its Matched at vendor level. https://ergoveritas.com/test2-privacy-policy.html Reviewed 2026-09-28T15:36:43.231Z · Complete retained text Evidence SHA-256: c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9	Location details Facebook Server locations describe the endpoint associated with the captured browser response. They may be CDN edges and do not establish subsequent processing or storage locations. No server IP is available in this inventory entry. Historical evidence may not include a destination summary. For newly assessed requests, a service-worker, failed or incomplete response may not expose an address; check retained connection evidence for the reason. 1 of 1 request events assessed; 1 without a retained server IP. Provider headquarters: US Transfer mechanism: Mechanism not assessed Headquarters reference only; this vendor's transfer arrangements have not been assessed. Registry reference date: 2026-09-07. This is registry context, not verification of this site's transfer arrangements. Corporate headquarters Meta Platforms, Inc. Corporate headquarters listed in Menlo Park, California. This record is for Meta Platforms, Inc., not Meta Platforms Ireland Limited. Sources checked 2026-09-07 Meta 2025 Form 10-K Headquarters and network operator are distinct; neither establishes this site's contracting entity or subsequent data processing locations.	0.68s	connect.facebook.net Service domains connect.facebook.net ergoveritas.com	Mixed	Captured on 1 page https://ergoveritas.com/test2.html
2	Microsoft Clarity	Session replay	Policy disclosure · Mentioned Microsoft Clarity Review scope: retained site policy from the homepage scan; this is a disclosure lookup, not a finding about compliance. a is collected by the page. Advertising, sale and sharing The test sends an advertising request to Meta and measurement or replay requests to Google Analytics, Microsoft Clarity, Hotjar, FullStory and Mixpanel before a choice. These are intentional signals for review of targeted advertising and possible sale or sharing. The test does not itself reach a legal conclusion about any individual request. Global Privacy Matched at product level. https://ergoveritas.com/test2-privacy-policy.html Reviewed 2026-09-28T15:36:43.231Z · Complete retained text Evidence SHA-256: c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9	Location details Microsoft Clarity Server locations describe the endpoint associated with the captured browser response. They may be CDN edges and do not establish subsequent processing or storage locations. No server IP is available in this inventory entry. Historical evidence may not include a destination summary. For newly assessed requests, a service-worker, failed or incomplete response may not expose an address; check retained connection evidence for the reason. 1 of 1 request events assessed; 1 without a retained server IP. Provider headquarters: US Transfer mechanism: Mechanism not assessed Headquarters reference only; this vendor's transfer arrangements have not been assessed. Registry reference date: 2026-09-07. This is registry context, not verification of this site's transfer arrangements. Corporate headquarters Microsoft Corporation Microsoft identifies Redmond, Washington as its global headquarters; this does not identify a regional contracting entity. Sources checked 2026-09-07 Microsoft office locations Headquarters and network operator are distinct; neither establishes this site's contracting entity or subsequent data processing locations.	0.68s	ergoveritas.com Service domains ergoveritas.com www.clarity.ms	Mixed	Captured on 1 page https://ergoveritas.com/test2.html
2	Mixpanel	Analytics	Policy disclosure · Mentioned Mixpanel Review scope: retained site policy from the homepage scan; this is a disclosure lookup, not a finding about compliance. sale and sharing The test sends an advertising request to Meta and measurement or replay requests to Google Analytics, Microsoft Clarity, Hotjar, FullStory and Mixpanel before a choice. These are intentional signals for review of targeted advertising and possible sale or sharing. The test does not itself reach a legal conclusion about any individual request. Global Privacy Control When Global Privacy Cont Matched at product level. https://ergoveritas.com/test2-privacy-policy.html Reviewed 2026-09-28T15:36:43.231Z · Complete retained text Evidence SHA-256: c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9	Location details Mixpanel Server locations describe the endpoint associated with the captured browser response. They may be CDN edges and do not establish subsequent processing or storage locations. No server IP is available in this inventory entry. Historical evidence may not include a destination summary. For newly assessed requests, a service-worker, failed or incomplete response may not expose an address; check retained connection evidence for the reason. 1 of 1 request events assessed; 1 without a retained server IP. Provider headquarters: US Transfer mechanism: Mechanism not assessed Headquarters reference only; this vendor's transfer arrangements have not been assessed. Registry reference date: 2026-09-07. This is registry context, not verification of this site's transfer arrangements. Corporate headquarters Mixpanel, Inc. Mixpanel identifies San Francisco headquarters separately from its EU team. Sources checked 2026-09-07 Mixpanel developer privacy guidance Headquarters and network operator are distinct; neither establishes this site's contracting entity or subsequent data processing locations.	0.7s	api-js.mixpanel.com Service domains api-js.mixpanel.com ergoveritas.com	Mixed	Captured on 1 page https://ergoveritas.com/test2.html
1	Segment	Analytics	Policy disclosure · Not found Segment Review scope: retained site policy from the homepage scan; this is a disclosure lookup, not a finding about compliance. https://ergoveritas.com/test2-privacy-policy.html Reviewed 2026-09-28T15:36:43.231Z · Complete retained text Evidence SHA-256: c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9	Location details Segment Server locations describe the endpoint associated with the captured browser response. They may be CDN edges and do not establish subsequent processing or storage locations. No server IP is available in this inventory entry. Historical evidence may not include a destination summary. For newly assessed requests, a service-worker, failed or incomplete response may not expose an address; check retained connection evidence for the reason. Complete destination coverage is not available for this historical evidence. Provider headquarters: Unknown Transfer mechanism: Mechanism not assessed Corporate headquarters Segment.io, Inc. Twilio says Segment.io, Inc. was to dissolve into Twilio at the end of 2022. Do not substitute Twilio headquarters for this legacy detected entity. Sources checked 2026-09-07 Twilio Segment dissolution FAQs Headquarters and network operator are distinct; neither establishes this site's contracting entity or subsequent data processing locations.	1.19s	ergoveritas.com	First party	Captured on 1 page https://ergoveritas.com/test2.html
1	OneTrust CMP	Consent management	Policy disclosure · Not found OneTrust CMP Review scope: retained site policy from the homepage scan; this is a disclosure lookup, not a finding about compliance. https://ergoveritas.com/test2-privacy-policy.html Reviewed 2026-09-28T15:36:43.231Z · Complete retained text Evidence SHA-256: c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9	Location details OneTrust CMP Server locations describe the endpoint associated with the captured browser response. They may be CDN edges and do not establish subsequent processing or storage locations. No server IP is available in this inventory entry. Historical evidence may not include a destination summary. For newly assessed requests, a service-worker, failed or incomplete response may not expose an address; check retained connection evidence for the reason. Complete destination coverage is not available for this historical evidence. Provider headquarters: US Transfer mechanism: Mechanism not assessed US-controlled vendor; mechanism requires current vendor/legal verification. Registry reference date: 2026-07-23. This is registry context, not verification of this site's transfer arrangements. Corporate headquarters OneTrust, LLC OneTrust lists its US headquarters in Atlanta separately from its global hubs. Sources checked 2026-09-07 OneTrust global offices Headquarters and network operator are distinct; neither establishes this site's contracting entity or subsequent data processing locations.	1.19s	ergoveritas.com	First party	Captured on 1 page https://ergoveritas.com/test2.html

Unattributed resources (5)

8 distinct services, including child services and unattributed resources

Forms & fields

0 forms

No form rows are available in the retained evidence.

Detailed evidence

Evidence RatingsStarting page

30 rows

3concern3Needs review11positive12contextual1limited

CertScore.ai can make mistakes. Verify all findings.

Signal Snapshot

Consent platformOneTrust

OneTrustView CMP details ↓

Consent controls2 of 3 observed

Consent choices

Observed

Reject

Observed

Options

Not observed

Initial visit · first layer

After Accept

Succeeded

After-Accept observation recorded

The Accept control was clicked. During 3.01s of after-click observation, 0 requests were retained and 0 main-document storage writes were observed. A post-click storage snapshot was retained. Request totals include all retained after-click requests; tracking classifications are shown in the findings.

3s maximum · TCF + CMP registry resolver

After Reject

Succeeded with confirmation

Activity observed after Reject

A reject action and post-reject comparison window were retained, and eligible non-essential tracking activity persisted after reject.

8s maximum · TCF + CMP registry resolver

Google · request · www.google-analytics.com · 74ms after Reject
Google · storage write · ergoveritas.com · _gid · 72ms after Reject

Policy surfaces1 found

https://ergoveritas.com/test2-privacy-policy.html

Transport security4 of 5 observed

HTTPS delivery for scanned pages
Valid SSL/TLS certificate
HTTP redirects to HTTPS
Mixed content
Observed form transport

Global Privacy Control (GPC)GPC signal observed · 0.25-second matched comparison

Activity with GPC: 5 tracking requests observed with GPC
GPC signal: Observed on the page request and in the browser
0.25-second matched comparison: Over the same 0.25-second interval after page commit, advertising/marketing requests: 1 without GPC and 0 with GPC; analytics/replay requests: 5 without GPC and 5 with GPC.

Baseline → GPC

First 250 ms after each document commit

Observed requests	Baseline	GPC
Advertising / marketing	1	0
Analytics / session replay	5	5

Comparison details

GPC delivery was verified on the page request and browser setting. 5 classified advertising, marketing, analytics or replay requests were observed with GPC, including 5 collection requests. Paired activity comparison: responsive.

CMP details

13 checks · 1 to review · 9 limited

Review

OneTrust

Consent management audit · 13 criteria

Reject optionObservedReject or an equivalent refusal option was available on the banner.

View consent choices ↓

JSON evidence

{
  "scope": "starting_page",
  "scanId": "d96df06d-3e94-4896-8346-1a026d68e5af",
  "assessmentSourceHash": "fnv1a-27ba784a",
  "criterion": {
    "id": "reject",
    "label": "Option to reject cookies available",
    "status": "Observed",
    "detail": "First-layer Reject or equivalent refusal control.",
    "sourceIds": [
      "consentControlAssessment.controls.reject"
    ]
  }
}

Privacy-policy linkObservedA privacy-policy link or page was found.

View privacy-policy discovery evidence ↓

Tracking after consent choicesReviewNon-essential tracking requests were detected after a confirmed Reject choice.

View Reject action evidence ↓

JSON evidence

post-reject tracking reduction evidence

Full evidence JSON

{
  "assessmentStatus": "gap_observed",
  "checklistItemId": "post_reject_tracking_reduction",
  "coverageArea": "Post-choice tracking reduction",
  "evidenceState": "observed",
  "explanation": "A reject action and post-reject comparison window were retained, and eligible non-essential tracking activity persisted after reject.",
  "note": "A reject action and post-reject comparison window were retained, and eligible non-essential tracking activity persisted after reject.",
  "status": "Gap observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.post_reject_tracking_reduction.gap_observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.post_reject_tracking_reduction"
  },
  "statusBasis": "A reject action and post-reject comparison window were retained, and eligible non-essential tracking activity persisted after reject.",
  "retainedEvidence": {
    "execution": {
      "status": "succeeded_with_confirmation",
      "policyVersion": "choice_path_execution.v1",
      "clickCompleted": true,
      "consentConfirmed": true,
      "observationCompleted": true
    },
    "scoreEffect": "canonical_post_refusal_policy",
    "evidenceRefs": [
      "Evidence: post-reject tracking reduction evidence"
    ],
    "resolverMethod": "tcf_api_cmp_registry_recipe",
    "observationWindowMs": 8000,
    "missingEvidenceNeeded": [],
    "reportControlObserved": true,
    "selectedEvidenceReason": "Selected retained same-surface reject-path or post-reject comparison evidence.",
    "weakerArtifactsIgnored": [],
    "selectedEvidenceStrength": "strong",
    "postRejectWindowAvailable": true,
    "reductionEvaluationStatus": "not_reduced",
    "rejectInteractionConfirmed": true,
    "selectedEvidenceArtifactId": "postRejectTrackingReductionEvidence",
    "preConsentStorageNotCleared": false,
    "postRejectNonEssentialRequests": [
      {
        "url": "https://www.google-analytics.com/g/collect",
        "vendor": "Google",
        "category": "analytics",
        "hostname": "www.google-analytics.com",
        "requestId": "post_refusal_request_9",
        "activityType": "network_request",
        "consentState": "post_reject",
        "nonEssential": true,
        "msAfterReject": 74,
        "nonEssentialReason": "canonical_post_refusal_classification"
      },
      {
        "vendor": "Google",
        "category": "analytics",
        "hostname": "ergoveritas.com",
        "cookieName": "_gid",
        "activityType": "storage_write",
        "consentState": "post_reject",
        "nonEssential": true,
        "msAfterReject": 72,
        "nonEssentialReason": "canonical_post_refusal_classification"
      }
    ],
    "refusalSignalContradictsAction": false,
    "postRejectRequestRecordsObserved": true,
    "preConsentStorageNotClearedCount": 0,
    "postRejectNonEssentialRequestCount": 2,
    "postRejectNonEssentialActivityRetained": true,
    "storagePresenceDoesNotEstablishActiveUse": false,
    "concretePostRejectNonEssentialDetailsRetained": true
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Correction steps

1Review the evidence details for the specific signal behind Post-choice tracking reduction.
2Update the affected consent, policy, tag-manager, vendor, or user-choice implementation.
3Retest in a fresh browser context so prior cookies or preferences do not hide the change.
4Rerun the scan and confirm the result reflects the change or clearly explains why the page could not be fully evaluated.
5Keep a short internal record of what changed so the next scan can be compared with the same page and settings.

Not assessed · 9 checks

Accept / Reject prominenceNot assessedScreenshot safety review timed out; the button comparison was not assessed.

JSON evidence

{
  "scope": "starting_page",
  "scanId": "d96df06d-3e94-4896-8346-1a026d68e5af",
  "assessmentSourceHash": "fnv1a-27ba784a",
  "criterion": {
    "id": "prominence",
    "label": "Accept / Reject prominence comparison",
    "status": "Not assessed",
    "detail": "Screenshot safety review timed out; the button comparison was not assessed.",
    "sourceIds": [
      "consentControlAssessment.visualEvidence"
    ]
  }
}

Category choicesNot assessedNot enough verified evidence was captured.

JSON evidence

{
  "scope": "starting_page",
  "scanId": "d96df06d-3e94-4896-8346-1a026d68e5af",
  "assessmentSourceHash": "fnv1a-27ba784a",
  "criterion": {
    "id": "categories",
    "label": "Selection by categories available",
    "status": "Not assessed",
    "detail": "Sufficient verified evidence for this criterion was not retained in this scan.",
    "sourceIds": []
  }
}

Tracking & embeds

4 checks · 3 to review

Review

Pre-consent non-essential trackingPotential gapTracking-classified requests were observed before consent: Google Analytics, Meta Pixel, Microsoft Clarity. The first retained qualifying request was Google Analytics at 0.673s after scan start.

JSON evidence

First pre-consent classified tracking request observation: 0.673s after scan start

Full evidence JSON

{
  "assessmentStatus": "gap_observed",
  "checklistItemId": "pre_consent_third_party_tracking",
  "coverageArea": "Pre-consent non-essential tracking",
  "evidenceState": "observed",
  "explanation": "Advertising/retargeting or behavioral-tracking requests fired before a recorded consent choice, including Meta Pixel, Microsoft Clarity, Hotjar, and FullStory. This is a consent timing/enforcement gap when supported by the retained request evidence.",
  "note": "Advertising/retargeting or behavioral-tracking requests fired before a recorded consent choice, including Meta Pixel, Microsoft Clarity, Hotjar, and FullStory. This is a consent timing/enforcement gap when supported by the retained request evidence.",
  "status": "Gap observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "unified_finding",
    "concernPolicyKey": "gdpr_eprivacy_coverage.pre_consent_third_party_tracking.gap_observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.pre_consent_third_party_tracking"
  },
  "statusBasis": "Classified non-essential tracking request timing evidence was retained before a recorded consent action.",
  "retainedEvidence": {
    "status": "Gap observed",
    "evidenceRefs": [
      "First pre-consent classified tracking request observation: 0.673s after scan start",
      "Third-party tracking observed before recorded consent",
      "Signal: Pre-consent tracking detected",
      "Review issue: Pre-consent tracking incidents detected",
      "Evidence flag: explicit_policy_snippet_retained",
      "Evidence flag: contradiction_runtime_artifact_retained"
    ],
    "findingEntities": [
      {
        "id": "preconsent_tracking",
        "entities": {
          "observedTrackingVendors": [
            "Google Analytics",
            "Meta Pixel",
            "Microsoft Clarity",
            "Hotjar",
            "FullStory"
          ],
          "preconsent_cookie_names": [
            "_ga_TEST2",
            "_gat_TEST2",
            "_fbc"
          ],
          "preconsent_cookie_categories": [
            "analytics",
            "advertising"
          ],
          "preconsent_cookie_set_methods": [
            "browser_snapshot"
          ],
          "preconsent_cookie_excluded_functional_names": [
            "OptanonConsent"
          ]
        },
        "sourceRefs": [
          "Signal: Pre-consent tracking detected",
          "Review issue: Pre-consent tracking incidents detected"
        ],
        "evidenceFlags": [
          "privacy.preconsent_tracking_detected",
          "privacy.tracking_before_consent_detected"
        ]
      }
    ],
    "evidenceHighlights": [
      "First pre-consent classified tracking request observation: 0.673s after scan start"
    ],
    "missingEvidenceNeeded": [],
    "trackingRequestTiming": {
      "version": "classified-request-timing.v1",
      "requests": [
        {
          "requestUrl": "https://www.google-analytics.com/analytics.js?redacted=1",
          "vendorName": "Google Analytics",
          "firstSeenMs": 673,
          "evidenceRefs": [
            "net_2068"
          ],
          "runtimePhase": "pre_consent",
          "vendorCategory": "analytics"
        },
        {
          "requestUrl": "https://connect.facebook.net/en_US/fbevents.js?redacted=1",
          "vendorName": "Meta Pixel",
          "firstSeenMs": 680,
          "evidenceRefs": [
            "net_2070"
          ],
          "runtimePhase": "pre_consent",
          "vendorCategory": "advertising"
        },
        {
          "requestUrl": "https://www.clarity.ms/collect?redacted=1",
          "vendorName": "Microsoft Clarity",
          "firstSeenMs": 681,
          "evidenceRefs": [
            "net_2072"
          ],
          "runtimePhase": "pre_consent",
          "vendorCategory": "session_replay"
        },
        {
          "requestUrl": "https://static.hotjar.com/c/hotjar-100002.js?redacted=1",
          "vendorName": "Hotjar",
          "firstSeenMs": 682,
          "evidenceRefs": [
            "net_2074"
          ],
          "runtimePhase": "pre_consent",
          "vendorCategory": "session_replay"
        },
        {
          "requestUrl": "https://rs.fullstory.com/s/fs.js?redacted=1",
          "vendorName": "FullStory",
          "firstSeenMs": 702,
          "evidenceRefs": [
            "net_2076"
          ],
          "runtimePhase": "pre_consent",
          "vendorCategory": "session_replay"
        },
        {
          "requestUrl": "https://api-js.mixpanel.com/track/?redacted=1",
          "vendorName": "Mixpanel",
          "firstSeenMs": 703,
          "evidenceRefs": [
            "net_2078"
          ],
          "runtimePhase": "pre_consent",
          "vendorCategory": "analytics"
        }
      ]
    },
    "selectedEvidenceReason": "Selected retained pre-consent request/vendor timing evidence; storage evidence is evaluated separately.",
    "weakerArtifactsIgnored": [],
    "preconsentTimingEvidence": {
      "thirdPartyTracking": {
        "trackingRequestTiming": {
          "version": "classified-request-timing.v1",
          "requests": [
            {
              "requestUrl": "https://www.google-analytics.com/analytics.js?redacted=1",
              "vendorName": "Google Analytics",
              "firstSeenMs": 673,
              "evidenceRefs": [
                "net_2068"
              ],
              "runtimePhase": "pre_consent",
              "vendorCategory": "analytics"
            },
            {
              "requestUrl": "https://connect.facebook.net/en_US/fbevents.js?redacted=1",
              "vendorName": "Meta Pixel",
              "firstSeenMs": 680,
              "evidenceRefs": [
                "net_2070"
              ],
              "runtimePhase": "pre_consent",
              "vendorCategory": "advertising"
            },
            {
              "requestUrl": "https://www.clarity.ms/collect?redacted=1",
              "vendorName": "Microsoft Clarity",
              "firstSeenMs": 681,
              "evidenceRefs": [
                "net_2072"
              ],
              "runtimePhase": "pre_consent",
              "vendorCategory": "session_replay"
            },
            {
              "requestUrl": "https://static.hotjar.com/c/hotjar-100002.js?redacted=1",
              "vendorName": "Hotjar",
              "firstSeenMs": 682,
              "evidenceRefs": [
                "net_2074"
              ],
              "runtimePhase": "pre_consent",
              "vendorCategory": "session_replay"
            },
            {
              "requestUrl": "https://rs.fullstory.com/s/fs.js?redacted=1",
              "vendorName": "FullStory",
              "firstSeenMs": 702,
              "evidenceRefs": [
                "net_2076"
              ],
              "runtimePhase": "pre_consent",
              "vendorCategory": "session_replay"
            },
            {
              "requestUrl": "https://api-js.mixpanel.com/track/?redacted=1",
              "vendorName": "Mixpanel",
              "firstSeenMs": 703,
              "evidenceRefs": [
                "net_2078"
              ],
              "runtimePhase": "pre_consent",
              "vendorCategory": "analytics"
            }
          ]
        },
        "preconsentThirdPartyTrackingObservedMs": [
          673,
          680,
          681,
          682,
          702,
          703
        ],
        "firstPreconsentThirdPartyTrackingObservedMs": 673,
        "firstPreconsentThirdPartyTrackingObservationBasis": "classified_request_timing.v1",
        "preconsentThirdPartyTrackingTimedObservationCount": 6
      }
    },
    "selectedEvidenceStrength": "strong",
    "selectedEvidenceArtifactId": "preConsentTrackingRequestEvidence",
    "preconsentThirdPartyTrackingObservedMs": [
      673,
      680,
      681,
      682,
      702,
      703
    ],
    "firstPreconsentThirdPartyTrackingObservedMs": 673,
    "firstPreconsentThirdPartyTrackingObservationBasis": "classified_request_timing.v1",
    "preconsentThirdPartyTrackingTimedObservationCount": 6
  },
  "projectedFindings": [
    {
      "id": "preconsent_tracking",
      "label": "Third-party tracking observed before recorded consent",
      "severity": "high"
    }
  ],
  "missingOrIncompleteSourceSignals": []
}

Correction steps

1Review the listed tracking requests, initiating integrations, and purposes against the retained pre-consent timing.
2Gate consent-dependent tracking at the tag or integration and verify that essential traffic remains separately classified.
3Retest the same page in fresh sessions before consent, after Reject, and after Accept; compare the listed endpoints and retain the results.

Third-party iframes before consentNot observedNo third-party iframes were detected before a consent choice.

JSON evidence

retained pre-consent iframe inventory

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "third_party_iframe_pre_consent",
  "coverageArea": "3rd party iframes before consent",
  "evidenceState": "not_observed",
  "explanation": "Whether retained scanner evidence showed known 3rd party iframe embeds before a recorded consent action.",
  "note": "Whether retained scanner evidence showed known 3rd party iframe embeds before a recorded consent action.",
  "status": "Not observed",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.third_party_iframe_pre_consent.not_observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.third_party_iframe_pre_consent"
  },
  "statusBasis": "Retained iframe inventory did not show known 3rd party iframe embeds before a recorded consent action.",
  "retainedEvidence": {
    "evidenceRefs": [
      "Evidence: retained pre-consent iframe inventory"
    ],
    "missingEvidenceNeeded": [],
    "preConsentIframeCount": 0,
    "iframeObservationCount": 0,
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "runtimeCaptureCompleted": true,
    "selectedEvidenceStrength": "missing",
    "selectedEvidenceArtifactId": "coverage_policy"
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Social/media services before consentPotential gapA social/media embed, plugin, widget, or pixel loaded before any recorded consent action: Meta/Facebook; first seen 0.680s after scan start.

JSON evidence

Social/media provider observations: 2

Provider: Meta/Facebook

Domain: connect.facebook.net

Full evidence JSON

{
  "assessmentStatus": "gap_observed",
  "checklistItemId": "social_media_embed_pre_consent",
  "coverageArea": "Social/media embeds or plugins loaded before consent",
  "evidenceState": "observed",
  "explanation": "Whether retained network/runtime evidence showed a social, video, media embed, social pixel, or plugin provider loading before a recorded consent action.",
  "note": "Whether retained network/runtime evidence showed a social, video, media embed, social pixel, or plugin provider loading before a recorded consent action.",
  "status": "Gap observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.social_media_embed_pre_consent.gap_observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.social_media_embed_pre_consent"
  },
  "statusBasis": "A social/media embed, plugin, widget, or pixel provider loaded before any recorded consent choice in retained network/runtime evidence. Providers/domains observed: Meta/Facebook; first seen 0.680s after scan start.",
  "retainedEvidence": {
    "providers": [
      "Meta/Facebook"
    ],
    "evidenceRefs": [
      "Social/media provider observations: 2",
      "Provider: Meta/Facebook",
      "Domain: connect.facebook.net",
      "Evidence: retained pre-consent social/media network or iframe observation"
    ],
    "providerCategories": [
      "social_pixel"
    ],
    "placeholderDetected": false,
    "missingEvidenceNeeded": [],
    "placeholderIneffective": false,
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "socialMediaEmbedDomains": [
      "connect.facebook.net"
    ],
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "coverage_policy",
    "socialMediaEmbedObservedMs": [
      680
    ],
    "socialMediaEmbedObservations": [
      {
        "domain": "connect.facebook.net",
        "source": "preconsent_request_classification",
        "provider": "Meta/Facebook",
        "requestUrl": "https://connect.facebook.net/en_US/fbevents.js?certscore=test2",
        "firstSeenMs": 680,
        "referrerSent": false,
        "initiatorType": "fetch",
        "storageTouched": false,
        "staticAssetOnly": false,
        "strongInitiator": true,
        "providerCategory": "social_pixel",
        "placeholderDetected": false,
        "userActionBeforeLoad": false,
        "placeholderIneffective": false,
        "setCookieMetadataCount": 0,
        "pageUrlSharedViaReferrer": false
      },
      {
        "domain": "connect.facebook.net",
        "source": "preconsent_request_classification",
        "provider": "Meta/Facebook",
        "requestUrl": "https://connect.facebook.net/en_US/fbevents.js?certscore=[redacted]",
        "firstSeenMs": 680,
        "referrerSent": false,
        "initiatorType": "fetch",
        "storageTouched": false,
        "staticAssetOnly": false,
        "strongInitiator": true,
        "providerCategory": "social_pixel",
        "placeholderDetected": false,
        "userActionBeforeLoad": false,
        "placeholderIneffective": false,
        "setCookieMetadataCount": 0,
        "pageUrlSharedViaReferrer": false
      }
    ],
    "firstSocialMediaEmbedObservedMs": 680
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Correction steps

1Review the evidence details for the specific signal behind Social/media embeds or plugins loaded before consent.
2Update the affected consent, policy, tag-manager, vendor, or user-choice implementation.
3Retest in a fresh browser context so prior cookies or preferences do not hide the change.
4Rerun the scan and confirm the result reflects the change or clearly explains why the page could not be fully evaluated.
5Keep a short internal record of what changed so the next scan can be compared with the same page and settings.

Third-party embeds before consentPartial concern3rd party embedded content loaded before any recorded consent action, including social embed evidence (connect.facebook.net). Review retained domains by purpose; first seen 0.680s after scan start.

JSON evidence

Embedded 3rd party content observed: connect.facebook.net; first observed 0.680s after scan start.

EmbeddedContentObservationCount: 1

Full evidence JSON

{
  "assessmentStatus": "review_signal",
  "checklistItemId": "embedded_content_pre_consent",
  "coverageArea": "Embedded third-party services before consent",
  "evidenceState": "observed",
  "explanation": "Whether retained scanner evidence showed iframe, embed, widget, or visibly integrated third-party services before a recorded consent action. This row does not represent all background analytics or network requests.",
  "note": "Whether retained scanner evidence showed iframe, embed, widget, or visibly integrated third-party services before a recorded consent action. This row does not represent all background analytics or network requests.",
  "status": "Review signal",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.embedded_content_pre_consent.review_signal",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.embedded_content_pre_consent"
  },
  "statusBasis": "Review signal: concrete 3rd party embedded content was retained before consent in iframe/runtime evidence. This is potentially concerning runtime behavior, not a positive compliance result.",
  "retainedEvidence": {
    "evidenceRefs": [
      "Embedded 3rd party content observations: 1",
      "Embedded host: connect.facebook.net",
      "Evidence: retained pre-consent embedded-content observations"
    ],
    "embeddedContentHosts": [
      "connect.facebook.net"
    ],
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "selectedEvidenceStrength": "missing",
    "embeddedContentObservedMs": [
      680
    ],
    "observedRuntimeSignalOnly": true,
    "selectedEvidenceArtifactId": "coverage_policy",
    "embeddedContentPurposeBuckets": {
      "mapEmbed": [],
      "mediaEmbed": [],
      "videoAdSdk": [],
      "socialEmbed": [
        "connect.facebook.net"
      ],
      "formOrChatWidget": [],
      "fontStaticResource": [],
      "otherEmbeddedContent": []
    },
    "firstEmbeddedContentObservedMs": 680,
    "embeddedContentObservationCount": 1
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Correction steps

1Review the evidence details for the specific signal behind Embedded third-party services before consent.
2Update the affected consent, policy, tag-manager, vendor, or user-choice implementation.
3Retest in a fresh browser context so prior cookies or preferences do not hide the change.
4Rerun the scan and confirm the result reflects the change or clearly explains why the page could not be fully evaluated.
5Keep a short internal record of what changed so the next scan can be compared with the same page and settings.

Policies & disclosures

12 checks · 9 limited

Limited

JSON evidence

Policy source

Captured page title: Privacy Policy — ErgoVeritas test 2 — https://ergoveritas.com/test2-privacy-policy.html

Document heading: Privacy Policy for the ErgoVeritas test 2 canary

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Page Text Link; directly linked from scanned page: Yes; retrieved during scan: 2026-09-28T15:36:42.312Z.

Section: Not retained.

Open policy source

Excerpt: Privacy Policy for the ErgoVeritas test 2 canary ErgoVeritas is the owner of test2.html. This policy applies only to that owned scanner-validation page. It describes deliberately varied signals so CertScore can test evidence capture; it does not describe other ErgoVeritas products. Information collected and why On a fresh visit without GPC or a saved manual choice, the test page sets six first-party cookie identifiers and analytics/session storage. It requests analytics, advertising, session replay and product-meas

Policy URL: https://ergoveritas.com/test2-privacy-policy.html

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "privacy_notice_availability",
  "coverageArea": "Privacy notice link/surface discovered",
  "evidenceState": "observed",
  "explanation": "Whether a reachable privacy notice or privacy policy link/surface was retained. This row does not by itself confirm that substantive notice content was available.",
  "note": "Whether a reachable privacy notice or privacy policy link/surface was retained. This row does not by itself confirm that substantive notice content was available.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.privacy_notice_availability.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.privacy_notice_availability"
  },
  "statusBasis": "Privacy notice evidence was retained in public policy-surface evidence.",
  "retainedEvidence": {
    "remediation": {
      "kind": "none",
      "steps": [],
      "message": "No remediation is established by this check alone. Retain its evidence and reassess after relevant changes."
    },
    "evidenceRefs": [
      "Excerpt: Privacy Policy for the ErgoVeritas test 2 canary ErgoVeritas is the owner of test2.html. This policy applies only to that owned scanner-validation page. It describes deliberately varied signals so CertScore can test evidence capture; it does not describe other ErgoVeritas products. Information collected and why On a fresh visit without GPC or a saved manual choice, the test page sets six first-party cookie identifiers and analytics/session storage. It requests analytics, advertising, session replay and product-meas",
      "Evidence: privacy policy surface retained",
      "Policy URL: https://ergoveritas.com/test2-privacy-policy.html"
    ],
    "signalObserved": true,
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "policyEvidenceAssessment": {
      "result": "disclosure_observed",
      "scoreEffect": "canonical_policy",
      "topicRelevance": "direct",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://ergoveritas.com/test2-privacy-policy.html",
      "policyTitle": "Privacy Policy — ErgoVeritas test 2",
      "artifactRefs": [
        "policy_excerpt_30725dd5_2e9dd398",
        "policy_surface_text_30725dd5_2e9dd398"
      ],
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "page_text_link",
      "documentHeading": "Privacy Policy for the ErgoVeritas test 2 canary",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-09-28T15:36:42.312Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "ErgoVeritas test 2",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "coverage_policy",
    "policySurfaceSummary": {
      "scanStartedAt": "2026-09-28T15:36:37.213Z",
      "observedTopics": [
        "cookies",
        "analytics",
        "advertising",
        "targeted_advertising",
        "sale_or_share",
        "do_not_sell_or_share",
        "global_privacy_control",
        "notice_at_collection",
        "session_replay_or_behavioral_analytics",
        "consent_withdrawal",
        "cookie_settings",
        "data_retention",
        "processing_purposes"
      ],
      "cookiePolicyUrls": [
        "https://ergoveritas.com/test2-cookie-settings.html"
      ],
      "cookieDisclosures": [],
      "mentionedControls": [
        "global_privacy_control",
        "consent_withdrawal",
        "cookie_settings"
      ],
      "privacyPolicySize": {
        "url": "https://ergoveritas.com/test2-privacy-policy.html",
        "completeness": "complete",
        "documentFormat": "text",
        "compressedBytes": 3355,
        "measurementScope": "selected_usable_privacy_policy",
        "decompressedBytes": 3355
      },
      "privacyPolicyUrls": [
        "https://ergoveritas.com/test2-privacy-policy.html"
      ],
      "cookie_disclosures": [],
      "policySectionCount": 6,
      "policySurfaceCount": 5,
      "cookiePolicyPresent": false,
      "scannedPageLanguage": "en",
      "privacyPolicyPresent": true,
      "policyPrimaryLanguage": "en",
      "policyLastUpdatedTexts": [],
      "policyTextCoverageMode": "section_targeted",
      "retainedPolicySections": [
        {
          "charEnd": 3218,
          "heading": "Privacy Policy for the ErgoVeritas test 2 canary",
          "quality": "strong",
          "charStart": 362,
          "sourceUrl": "https://ergoveritas.com/test2-privacy-policy.html",
          "textExcerpt": "ErgoVeritas is the owner of test2.html . This policy applies only to that owned scanner-validation page. It describes deliberately varied signals so CertScore can test evidence capture; it does not describe other ErgoVeritas products. Information collected and why On a fresh visit without GPC or a saved manual choice, the test page sets six first-party cookie identifiers and analytics/session storage. It requests analytics, advertising, session replay and product-measurement endpoints. With GPC, it sets five of those cookies and omits the advertising request. The purposes in this test are audience measurement, advertising signal classification, replay detection and product-event measurement. No account, purchase, form submission or authentication data is collected by the page. Advertising, sale and sharing The test sends an advertising request to Meta and measurement or replay requests to Google Analytics, Microsoft Clarity, Hotjar, FullStory and Mixpanel before a choice. These are intentional signals for review of targeted advertising and possible sale or sharing. The test does not itself reach a legal conclusion about any individual request."
        },
        {
          "charEnd": 1272,
          "heading": "Information collected and why",
          "quality": "strong",
          "charStart": 695,
          "sourceUrl": "https://ergoveritas.com/test2-privacy-policy.html",
          "textExcerpt": "On a fresh visit without GPC or a saved manual choice, the test page sets six first-party cookie identifiers and analytics/session storage. It requests analytics, advertising, session replay and product-measurement endpoints. With GPC, it sets five of those cookies and omits the advertising request. The purposes in this test are audience measurement, advertising signal classification, replay detection and product-event measurement. No account, purchase, form submission or authentication data is collected by the page."
        },
        {
          "charEnd": 1670,
          "heading": "Advertising, sale and sharing",
          "quality": "strong",
          "charStart": 1272,
          "sourceUrl": "https://ergoveritas.com/test2-privacy-policy.html",
          "textExcerpt": "The test sends an advertising request to Meta and measurement or replay requests to Google Analytics, Microsoft Clarity, Hotjar, FullStory and Mixpanel before a choice. These are intentional signals for review of targeted advertising and possible sale or sharing. The test does not itself reach a legal conclusion about any individual request."
        },
        {
          "charEnd": 2134,
          "heading": "Global Privacy Control",
          "quality": "strong",
          "charStart": 1670,
          "sourceUrl": "https://ergoveritas.com/test2-privacy-policy.html",
          "textExcerpt": "When Global Privacy Control (GPC) is enabled in the browser, this canary omits the Meta advertising request and its _fbc test cookie. Five other optional requests and their test cookies remain. A complete paired scan can observe this partial reduction; an incomplete comparison cannot establish the site's response. A saved manual Do Not Sell/Share choice turns off all future optional test activity in this browser."
        },
        {
          "charEnd": 2674,
          "heading": "Opt-out and cookie choices",
          "quality": "strong",
          "charStart": 2134,
          "sourceUrl": "https://ergoveritas.com/test2-privacy-policy.html",
          "textExcerpt": "Visitors can use Do Not Sell or Share My Personal Information , Your Privacy Choices , or Cookie Settings . Saving any of these test choices suppresses optional requests on later visits in that browser and removes the first-party test cookies. The scanner observes links and notice passages; it does not verify these manual actions in an ordinary passive scan."
        },
        {
          "charEnd": 3218,
          "heading": "Retention and privacy rights",
          "quality": "strong",
          "charStart": 2674,
          "sourceUrl": "https://ergoveritas.com/test2-privacy-policy.html",
          "textExcerpt": "First-party test cookies expire after 15 minutes and saved manual-choice markers after 24 hours. This page makes no statement about providers' separate retention. The canary does not process real requests to access, delete, correct, or obtain a copy of personal information; the test controls should not be treated as such a process. Notice at Collection · Cookie Policy"
        }
      ],
      "cookieDisclosurePresent": true,
      "policyCookieDisclosures": [],
      "privacyPolicyDiscovered": true,
      "processingErrorObserved": false,
      "observedPolicyTopicHints": [
        "cookies",
        "analytics",
        "advertising",
        "targeted_advertising",
        "sale_or_share",
        "do_not_sell_or_share",
        "global_privacy_control",
        "notice_at_collection",
        "session_replay_or_behavioral_analytics",
        "consent_withdrawal",
        "cookie_settings",
        "data_retention",
        "processing_purposes"
      ],
      "policyDocumentProvenance": [
        {
          "sourceUrl": "https://ergoveritas.com/test2-privacy-policy.html",
          "policyTitle": "Privacy Policy — ErgoVeritas test 2",
          "artifactRefs": [
            "policy_excerpt_30725dd5_2e9dd398",
            "policy_surface_text_30725dd5_2e9dd398"
          ],
          "effectiveDate": null,
          "observationId": "policy_surface_30725dd5",
          "discoveryMethod": "page_text_link",
          "documentHeading": "Privacy Policy for the ErgoVeritas test 2 canary",
          "lastUpdatedText": null,
          "detectedLanguage": "en",
          "retrievalTimestamp": "2026-09-28T15:36:42.312Z",
          "targetRelationship": "target_controller",
          "translationApplied": false,
          "documentOwnerEntity": "ErgoVeritas test 2",
          "ownershipConfidence": 0.98,
          "translationTargetLanguage": null,
          "directlyLinkedFromScannedPage": true
        }
      ],
      "policy_cookie_disclosures": [],
      "article13DisclosureSignals": [],
      "policyTextExtractionHealth": {
        "policyUrls": [
          "https://ergoveritas.com/test2-privacy-policy.html"
        ],
        "nanoInvoked": false,
        "contractVersion": "certscore.policy-text-extraction-health.v2",
        "policyTextQuality": {
          "usable": true,
          "codeSignalCount": 0,
          "codeSymbolRatio": 0.0016406890894175555,
          "policyTermCount": 8,
          "alphabeticWordRatio": 0.8455284552845529,
          "accessChallengeSignalCount": 0,
          "naturalLanguageSentenceCount": 21
        },
        "policyUrlRetained": true,
        "extractedTextLength": 2438,
        "policySurfaceObserved": true,
        "detectedPolicyLanguage": "en",
        "minimumTextLengthRequired": 500,
        "policyTextExtractionStatus": "ok",
        "verifiedPolicyDocumentCount": 1,
        "detectedPolicyLanguageSource": "policy_surface",
        "supportedGdprTransparencyLocales": [
          "en",
          "de",
          "fr",
          "es",
          "it",
          "nl",
          "pl",
          "pt",
          "ru",
          "ja",
          "zh",
          "ar",
          "sv",
          "ro",
          "cs",
          "el",
          "hu",
          "da",
          "fi",
          "sk",
          "bg",
          "hr",
          "nb",
          "sl",
          "lt",
          "lv",
          "et",
          "uk",
          "tr",
          "fa",
          "vi",
          "id",
          "ko",
          "th",
          "he",
          "sr",
          "ca",
          "hi",
          "az",
          "gl"
        ],
        "gdprTransparencyLanguageSupported": true,
        "policyTextEvidenceProjectionStatus": "verified_complete",
        "policyTextEvidenceProjectionContractVersion": "certscore.policy-text-evidence-projection.v1"
      },
      "privacyPolicyEvidencePaths": [],
      "discoveredPrivacyPolicyUrls": [
        "https://ergoveritas.com/test2-privacy-policy.html"
      ],
      "article13CoverageAssessments": [
        {
          "topic": "automated_decision_making_or_profiling",
          "status": "insufficient_retained_evidence",
          "sourceUrls": [
            "https://ergoveritas.com/test2-privacy-policy.html"
          ],
          "reasonCodes": [
            "policy_absence_coverage_preconditions_not_met",
            "typed_topic_coverage_diagnostic_missing_or_limited",
            "policy_document_content_coverage_incomplete"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_30725dd5"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "controller_contact",
          "status": "insufficient_retained_evidence",
          "sourceUrls": [
            "https://ergoveritas.com/test2-privacy-policy.html"
          ],
          "reasonCodes": [
            "policy_absence_coverage_preconditions_not_met",
            "typed_topic_coverage_diagnostic_missing_or_limited",
            "policy_document_content_coverage_incomplete"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_30725dd5"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "data_retention",
          "status": "insufficient_retained_evidence",
          "sourceUrls": [
            "https://ergoveritas.com/test2-privacy-policy.html"
          ],
          "reasonCodes": [
            "policy_absence_coverage_preconditions_not_met",
            "typed_topic_coverage_diagnostic_missing_or_limited",
            "policy_document_content_coverage_incomplete"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_30725dd5"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "data_subject_rights",
          "status": "insufficient_retained_evidence",
          "sourceUrls": [
            "https://ergoveritas.com/test2-privacy-policy.html"
          ],
          "reasonCodes": [
            "policy_absence_coverage_preconditions_not_met",
            "typed_topic_coverage_diagnostic_missing_or_limited",
            "policy_document_content_coverage_incomplete"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_30725dd5"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "dpo_contact",
          "status": "insufficient_retained_evidence",
          "sourceUrls": [
            "https://ergoveritas.com/test2-privacy-policy.html"
          ],
          "reasonCodes": [
            "policy_absence_coverage_preconditions_not_met",
            "typed_topic_coverage_diagnostic_missing_or_limited",
            "policy_document_content_coverage_incomplete"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_30725dd5"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "international_transfers",
          "status": "insufficient_retained_evidence",
          "sourceUrls": [
            "https://ergoveritas.com/test2-privacy-policy.html"
          ],
          "reasonCodes": [
            "policy_absence_coverage_preconditions_not_met",
            "typed_topic_coverage_diagnostic_missing_or_limited",
            "policy_document_content_coverage_incomplete"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_30725dd5"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "legal_basis",
          "status": "insufficient_retained_evidence",
          "sourceUrls": [
            "https://ergoveritas.com/test2-privacy-policy.html"
          ],
          "reasonCodes": [
            "policy_absence_coverage_preconditions_not_met",
            "typed_topic_coverage_diagnostic_missing_or_limited",
            "policy_document_content_coverage_incomplete"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_30725dd5"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "processing_purposes",
          "status": "insufficient_retained_evidence",
          "sourceUrls": [
            "https://ergoveritas.com/test2-privacy-policy.html"
          ],
          "reasonCodes": [
            "policy_absence_coverage_preconditions_not_met",
            "typed_topic_coverage_diagnostic_missing_or_limited",
            "policy_document_content_coverage_incomplete"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_30725dd5"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "recipients_or_vendor_categories",
          "status": "insufficient_retained_evidence",
          "sourceUrls": [
            "https://ergoveritas.com/test2-privacy-policy.html"
          ],
          "reasonCodes": [
            "policy_absence_coverage_preconditions_not_met",
            "typed_topic_coverage_diagnostic_missing_or_limited",
            "policy_document_content_coverage_incomplete"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_30725dd5"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "supervisory_authority",
          "status": "insufficient_retained_evidence",
          "sourceUrls": [
            "https://ergoveritas.com/test2-privacy-policy.html"
          ],
          "reasonCodes": [
            "policy_absence_coverage_preconditions_not_met",
            "typed_topic_coverage_diagnostic_missing_or_limited",
            "policy_document_content_coverage_incomplete"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_30725dd5"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        }
      ],
      "dedicatedCookiePolicyPresent": false,
      "policyTextEvidenceProjection": {
        "scanId": "d96df06d-3e94-4896-8346-1a026d68e5af",
        "documents": [
          {
            "finalUrl": "https://ergoveritas.com/test2-privacy-policy.html",
            "artifactId": "policy_surface_text_30725dd5_2e9dd398",
            "artifactUri": "s3://certscore-v2-dag-local-artifacts-us-west-1-199536052647/v2-dag-lambda/local/d96df06d-3e94-4896-8346-1a026d68e5af/auxiliary/policy_surface_text_30725dd5_2e9dd398.txt",
            "contentType": "text/html",
            "documentRole": "policy_document",
            "requestedUrl": "/test2-privacy-policy.html",
            "observationId": "policy_surface_30725dd5",
            "redirectChain": [
              "https://ergoveritas.com/test2-privacy-policy.html"
            ],
            "artifactSha256": "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9",
            "documentFormat": "text",
            "limitationKeys": [
              "policy_section_text_bounded"
            ],
            "contentCoverage": {
              "status": "truncated",
              "limitationKeys": [
                "policy_section_text_bounded"
              ],
              "sourceTextChars": 2438,
              "retainedSectionCount": 6,
              "extractedSectionCount": 6,
              "retainedTableRowCount": 0
            },
            "artifactFileName": "policy_surface_text_30725dd5_2e9dd398.txt",
            "extractionStatus": "complete",
            "artifactSizeBytes": 2439,
            "retainedTextChars": 2438,
            "documentFetchState": "fetched",
            "retainedTextSha256": "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9",
            "targetRelationship": "target_controller",
            "documentOwnerEntity": "ErgoVeritas test 2",
            "ownershipConfidence": 0.98,
            "documentTextCoverage": {
              "status": "complete",
              "limitationKeys": [],
              "sourceTextChars": 2438,
              "retainedTextChars": 2438
            },
            "documentEvaluationState": "usable",
            "documentRoleReasonCodes": [
              "direct_privacy_document_without_index_evidence"
            ],
            "governingPolicySelection": {
              "rank": 1,
              "score": 77,
              "state": "primary",
              "reasonCodes": [
                "highest_ranked_eligible_governing_policy",
                "target_controller_document",
                "policy_content_coverage_truncated",
                "complete_policy_text_retention",
                "direct_privacy_document_without_index_evidence"
              ],
              "contractVersion": "governing_policy_selection.v1"
            },
            "artifactVerificationStatus": "verified",
            "gdprTransparencyTopicCoverageDiagnostics": [
              {
                "topic": "controller_contact",
                "reasonCodes": [
                  "row_specific_disclosure_not_confirmed",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "unknown",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated"
              },
              {
                "topic": "processing_purposes",
                "reasonCodes": [
                  "row_specific_disclosure_not_confirmed",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "unknown",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated"
              },
              {
                "topic": "legal_basis",
                "reasonCodes": [
                  "row_specific_disclosure_not_confirmed",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "unknown",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated"
              },
              {
                "topic": "recipients_or_vendor_categories",
                "reasonCodes": [
                  "row_specific_disclosure_not_confirmed",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "unknown",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated"
              },
              {
                "topic": "data_retention",
                "reasonCodes": [
                  "row_specific_disclosure_not_confirmed",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "unknown",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated"
              },
              {
                "topic": "data_subject_rights",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "0f9f2087c3e96b1d452e1c8e17aeaec9140f280cc8be15e3d36c621807aecd79",
                "evidenceSectionSha256": "3f3131f80fa3679a3b664c2b8284cf320b5a85dd0599660382987532ae1d1d18",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "html_heading_hierarchy"
              },
              {
                "topic": "international_transfers",
                "reasonCodes": [
                  "row_specific_disclosure_not_confirmed",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "unknown",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated"
              },
              {
                "topic": "dpo_contact",
                "reasonCodes": [
                  "row_specific_disclosure_not_confirmed",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "unknown",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated"
              },
              {
                "topic": "supervisory_authority",
                "reasonCodes": [
                  "row_specific_disclosure_not_confirmed",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "unknown",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated"
              },
              {
                "topic": "automated_decision_making_or_profiling",
                "reasonCodes": [
                  "row_specific_disclosure_not_confirmed",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "unknown",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated"
              }
            ]
          }
        ],
        "generatedAt": "2026-09-28T15:36:43.231Z",
        "sourceBundle": {
          "uri": "s3://certscore-v2-dag-local-artifacts-us-west-1-199536052647/v2-dag-lambda/local/d96df06d-3e94-4896-8346-1a026d68e5af/CanonicalEvidenceBundle.json",
          "sha256": "66a2163f8c183a0c3dd5299f5598b8ca0aca719437b6bfc742c8b4abdc666fa1",
          "sizeBytes": 366848,
          "schemaVersion": "certscore.v2.alpha.1",
          "verificationStatus": "verified"
        },
        "limitationKeys": [
          "policy_section_text_bounded"
        ],
        "contractVersion": "certscore.policy-text-evidence-projection.v1",
        "projectionStatus": "verified_complete"
      },
      "privacyPolicyEvaluationState": "fetched_usable",
      "legalFrameworkValidityMatches": [],
      "missingExpectedPolicySections": [
        "Your privacy controls",
        "Exporting and deleting your information",
        "Retaining your information",
        "Compliance and cooperation with regulators",
        "European requirements",
        "Data transfers"
      ],
      "policy_text_extraction_health": {
        "policyUrls": [
          "https://ergoveritas.com/test2-privacy-policy.html"
        ],
        "nanoInvoked": false,
        "contractVersion": "certscore.policy-text-extraction-health.v2",
        "policyTextQuality": {
          "usable": true,
          "codeSignalCount": 0,
          "codeSymbolRatio": 0.0016406890894175555,
          "policyTermCount": 8,
          "alphabeticWordRatio": 0.8455284552845529,
          "accessChallengeSignalCount": 0,
          "naturalLanguageSentenceCount": 21
        },
        "policyUrlRetained": true,
        "extractedTextLength": 2438,
        "policySurfaceObserved": true,
        "detectedPolicyLanguage": "en",
        "minimumTextLengthRequired": 500,
        "policyTextExtractionStatus": "ok",
        "verifiedPolicyDocumentCount": 1,
        "detectedPolicyLanguageSource": "policy_surface",
        "supportedGdprTransparencyLocales": [
          "en",
          "de",
          "fr",
          "es",
          "it",
          "nl",
          "pl",
          "pt",
          "ru",
          "ja",
          "zh",
          "ar",
          "sv",
          "ro",
          "cs",
          "el",
          "hu",
          "da",
          "fi",
          "sk",
          "bg",
          "hr",
          "nb",
          "sl",
          "lt",
          "lv",
          "et",
          "uk",
          "tr",
          "fa",
          "vi",
          "id",
          "ko",
          "th",
          "he",
          "sr",
          "ca",
          "hi",
          "az",
          "gl"
        ],
        "gdprTransparencyLanguageSupported": true,
        "policyTextEvidenceProjectionStatus": "verified_complete",
        "policyTextEvidenceProjectionContractVersion": "certscore.policy-text-evidence-projection.v1"
      },
      "retainedPolicySectionHeadings": [
        "Privacy Policy for the ErgoVeritas test 2 canary",
        "Information collected and why",
        "Advertising, sale and sharing",
        "Global Privacy Control",
        "Opt-out and cookie choices",
        "Retention and privacy rights"
      ],
      "selectedPrivacyPolicyDocument": {
        "documentUrl": "https://ergoveritas.com/test2-privacy-policy.html",
        "observationId": "policy_surface_30725dd5",
        "traversalDepth": 0,
        "parentSurfaceUrl": null,
        "parentObservationId": null,
        "selectionReasonCodes": []
      },
      "article13_coverage_assessments": [
        {
          "topic": "automated_decision_making_or_profiling",
          "status": "insufficient_retained_evidence",
          "sourceUrls": [
            "https://ergoveritas.com/test2-privacy-policy.html"
          ],
          "reasonCodes": [
            "policy_absence_coverage_preconditions_not_met",
            "typed_topic_coverage_diagnostic_missing_or_limited",
            "policy_document_content_coverage_incomplete"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_30725dd5"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "controller_contact",
          "status": "insufficient_retained_evidence",
          "sourceUrls": [
            "https://ergoveritas.com/test2-privacy-policy.html"
          ],
          "reasonCodes": [
            "policy_absence_coverage_preconditions_not_met",
            "typed_topic_coverage_diagnostic_missing_or_limited",
            "policy_document_content_coverage_incomplete"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_30725dd5"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "data_retention",
          "status": "insufficient_retained_evidence",
          "sourceUrls": [
            "https://ergoveritas.com/test2-privacy-policy.html"
          ],
          "reasonCodes": [
            "policy_absence_coverage_preconditions_not_met",
            "typed_topic_coverage_diagnostic_missing_or_limited",
            "policy_document_content_coverage_incomplete"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_30725dd5"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "data_subject_rights",
          "status": "insufficient_retained_evidence",
          "sourceUrls": [
            "https://ergoveritas.com/test2-privacy-policy.html"
          ],
          "reasonCodes": [
            "policy_absence_coverage_preconditions_not_met",
            "typed_topic_coverage_diagnostic_missing_or_limited",
            "policy_document_content_coverage_incomplete"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_30725dd5"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "dpo_contact",
          "status": "insufficient_retained_evidence",
          "sourceUrls": [
            "https://ergoveritas.com/test2-privacy-policy.html"
          ],
          "reasonCodes": [
            "policy_absence_coverage_preconditions_not_met",
            "typed_topic_coverage_diagnostic_missing_or_limited",
            "policy_document_content_coverage_incomplete"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_30725dd5"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "international_transfers",
          "status": "insufficient_retained_evidence",
          "sourceUrls": [
            "https://ergoveritas.com/test2-privacy-policy.html"
          ],
          "reasonCodes": [
            "policy_absence_coverage_preconditions_not_met",
            "typed_topic_coverage_diagnostic_missing_or_limited",
            "policy_document_content_coverage_incomplete"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_30725dd5"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "legal_basis",
          "status": "insufficient_retained_evidence",
          "sourceUrls": [
            "https://ergoveritas.com/test2-privacy-policy.html"
          ],
          "reasonCodes": [
            "policy_absence_coverage_preconditions_not_met",
            "typed_topic_coverage_diagnostic_missing_or_limited",
            "policy_document_content_coverage_incomplete"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_30725dd5"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "processing_purposes",
          "status": "insufficient_retained_evidence",
          "sourceUrls": [
            "https://ergoveritas.com/test2-privacy-policy.html"
          ],
          "reasonCodes": [
            "policy_absence_coverage_preconditions_not_met",
            "typed_topic_coverage_diagnostic_missing_or_limited",
            "policy_document_content_coverage_incomplete"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_30725dd5"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "recipients_or_vendor_categories",
          "status": "insufficient_retained_evidence",
          "sourceUrls": [
            "https://ergoveritas.com/test2-privacy-policy.html"
          ],
          "reasonCodes": [
            "policy_absence_coverage_preconditions_not_met",
            "typed_topic_coverage_diagnostic_missing_or_limited",
            "policy_document_content_coverage_incomplete"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_30725dd5"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "supervisory_authority",
          "status": "insufficient_retained_evidence",
          "sourceUrls": [
            "https://ergoveritas.com/test2-privacy-policy.html"
          ],
          "reasonCodes": [
            "policy_absence_coverage_preconditions_not_met",
            "typed_topic_coverage_diagnostic_missing_or_limited",
            "policy_document_content_coverage_incomplete"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_30725dd5"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        }
      ],
      "discoveredPrivacyPolicyDetails": [
        {
          "url": "https://ergoveritas.com/test2-privacy-policy.html",
          "status": "fetched",
          "documentFetchState": "fetched",
          "fetchFailureReason": null,
          "linkObservationState": "observed",
          "documentEvaluationState": "usable"
        }
      ],
      "article13DisclosureTypesPartial": [],
      "discoveredPrivacyPolicyStatuses": [
        "fetched"
      ],
      "gdprTransparencyEvidenceProfile": "gdpr_transparency_multilingual_article13_v1",
      "policy_text_evidence_projection": {
        "scanId": "d96df06d-3e94-4896-8346-1a026d68e5af",
        "documents": [
          {
            "finalUrl": "https://ergoveritas.com/test2-privacy-policy.html",
            "artifactId": "policy_surface_text_30725dd5_2e9dd398",
            "artifactUri": "s3://certscore-v2-dag-local-artifacts-us-west-1-199536052647/v2-dag-lambda/local/d96df06d-3e94-4896-8346-1a026d68e5af/auxiliary/policy_surface_text_30725dd5_2e9dd398.txt",
            "contentType": "text/html",
            "documentRole": "policy_document",
            "requestedUrl": "/test2-privacy-policy.html",
            "observationId": "policy_surface_30725dd5",
            "redirectChain": [
              "https://ergoveritas.com/test2-privacy-policy.html"
            ],
            "artifactSha256": "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9",
            "documentFormat": "text",
            "limitationKeys": [
              "policy_section_text_bounded"
            ],
            "contentCoverage": {
              "status": "truncated",
              "limitationKeys": [
                "policy_section_text_bounded"
              ],
              "sourceTextChars": 2438,
              "retainedSectionCount": 6,
              "extractedSectionCount": 6,
              "retainedTableRowCount": 0
            },
            "artifactFileName": "policy_surface_text_30725dd5_2e9dd398.txt",
            "extractionStatus": "complete",
            "artifactSizeBytes": 2439,
            "retainedTextChars": 2438,
            "documentFetchState": "fetched",
            "retainedTextSha256": "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9",
            "targetRelationship": "target_controller",
            "documentOwnerEntity": "ErgoVeritas test 2",
            "ownershipConfidence": 0.98,
            "documentTextCoverage": {
              "status": "complete",
              "limitationKeys": [],
              "sourceTextChars": 2438,
              "retainedTextChars": 2438
            },
            "documentEvaluationState": "usable",
            "documentRoleReasonCodes": [
              "direct_privacy_document_without_index_evidence"
            ],
            "governingPolicySelection": {
              "rank": 1,
              "score": 77,
              "state": "primary",
              "reasonCodes": [
                "highest_ranked_eligible_governing_policy",
                "target_controller_document",
                "policy_content_coverage_truncated",
                "complete_policy_text_retention",
                "direct_privacy_document_without_index_evidence"
              ],
              "contractVersion": "governing_policy_selection.v1"
            },
            "artifactVerificationStatus": "verified",
            "gdprTransparencyTopicCoverageDiagnostics": [
              {
                "topic": "controller_contact",
                "reasonCodes": [
                  "row_specific_disclosure_not_confirmed",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "unknown",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated"
              },
              {
                "topic": "processing_purposes",
                "reasonCodes": [
                  "row_specific_disclosure_not_confirmed",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "unknown",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated"
              },
              {
                "topic": "legal_basis",
                "reasonCodes": [
                  "row_specific_disclosure_not_confirmed",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "unknown",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated"
              },
              {
                "topic": "recipients_or_vendor_categories",
                "reasonCodes": [
                  "row_specific_disclosure_not_confirmed",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "unknown",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated"
              },
              {
                "topic": "data_retention",
                "reasonCodes": [
                  "row_specific_disclosure_not_confirmed",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "unknown",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated"
              },
              {
                "topic": "data_subject_rights",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "0f9f2087c3e96b1d452e1c8e17aeaec9140f280cc8be15e3d36c621807aecd79",
                "evidenceSectionSha256": "3f3131f80fa3679a3b664c2b8284cf320b5a85dd0599660382987532ae1d1d18",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "html_heading_hierarchy"
              },
              {
                "topic": "international_transfers",
                "reasonCodes": [
                  "row_specific_disclosure_not_confirmed",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "unknown",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated"
              },
              {
                "topic": "dpo_contact",
                "reasonCodes": [
                  "row_specific_disclosure_not_confirmed",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "unknown",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated"
              },
              {
                "topic": "supervisory_authority",
                "reasonCodes": [
                  "row_specific_disclosure_not_confirmed",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "unknown",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated"
              },
              {
                "topic": "automated_decision_making_or_profiling",
                "reasonCodes": [
                  "row_specific_disclosure_not_confirmed",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "unknown",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated"
              }
            ]
          }
        ],
        "generatedAt": "2026-09-28T15:36:43.231Z",
        "sourceBundle": {
          "uri": "s3://certscore-v2-dag-local-artifacts-us-west-1-199536052647/v2-dag-lambda/local/d96df06d-3e94-4896-8346-1a026d68e5af/CanonicalEvidenceBundle.json",
          "sha256": "66a2163f8c183a0c3dd5299f5598b8ca0aca719437b6bfc742c8b4abdc666fa1",
          "sizeBytes": 366848,
          "schemaVersion": "certscore.v2.alpha.1",
          "verificationStatus": "verified"
        },
        "limitationKeys": [
          "policy_section_text_bounded"
        ],
        "contractVersion": "certscore.policy-text-evidence-projection.v1",
        "projectionStatus": "verified_complete"
      },
      "privacyPolicyTextCharacterCount": 2438,
      "retainedCookiePolicyTextExcerpt": "",
      "validatedDisclosureTypesPartial": [],
      "article13DisclosureTypesObserved": [],
      "retainedArticle13SectionEvidence": [
        {
          "surfaceUrl": "https://ergoveritas.com/test2-privacy-policy.html",
          "coverageArea": "data_retention",
          "evidenceSource": "deterministic",
          "signalObserved": "not_confirmed",
          "extractionLimitation": "section_retained_without_row_specific_disclosure",
          "selectedEvidenceStrength": "limited",
          "selectedPolicySectionUrl": "https://ergoveritas.com/test2-privacy-policy.html",
          "selectedPolicySectionExcerpt": "Retention and privacy rights. First-party test cookies expire after 15 minutes and saved manual-choice markers after 24 hours. This page makes no statement about providers' separate retention. The canary does not process real requests to access, delete, correct, or obtain a copy of personal information; the test controls should not be treated as such a process. Notice at Collection · Cookie Policy",
          "selectedPolicySectionHeading": "Retention and privacy rights"
        },
        {
          "surfaceUrl": "https://ergoveritas.com/test2-privacy-policy.html",
          "coverageArea": "data_subject_rights",
          "evidenceSource": "deterministic",
          "signalObserved": "observed",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://ergoveritas.com/test2-privacy-policy.html",
          "selectedPolicySectionExcerpt": "Retention and privacy rights. cookies expire after 15 minutes and saved manual-choice markers after 24 hours. This page makes no statement about providers' separate retention. The canary does not process real requests to access, delete, correct, or obtain a copy of personal information; the test controls should not be treated as such a process. Notice at Collection · Cookie Policy",
          "selectedPolicySectionHeading": "Retention and privacy rights"
        },
        {
          "surfaceUrl": "https://ergoveritas.com/test2-privacy-policy.html",
          "coverageArea": "processing_purposes",
          "evidenceSource": "deterministic",
          "signalObserved": "not_confirmed",
          "extractionLimitation": "selected_policy_section_truncated_by_retention_limit",
          "selectedEvidenceStrength": "limited",
          "selectedPolicySectionUrl": "https://ergoveritas.com/test2-privacy-policy.html",
          "selectedPolicySectionExcerpt": "Privacy Policy for the ErgoVeritas test 2 canary. No account, purchase, form submission or authentication data is collected by the page. Advertising, sale and sharing The test sends an advertising request to Meta and measurement or replay requests to Google Analytics, Microsoft Clarity, Hotjar, FullStory and Mixpanel before a choice. These are intentional signals for review of targeted advertising and possible sale or sharing. The test does not itself reach a legal conclusion about any individual request.",
          "selectedPolicySectionHeading": "Privacy Policy for the ErgoVeritas test 2 canary"
        },
        {
          "surfaceUrl": "https://ergoveritas.com/test2-privacy-policy.html",
          "coverageArea": "recipients_or_vendor_categories",
          "evidenceSource": "deterministic",
          "signalObserved": "not_confirmed",
          "extractionLimitation": "section_retained_without_row_specific_disclosure",
          "selectedEvidenceStrength": "limited",
          "selectedPolicySectionUrl": "https://ergoveritas.com/test2-privacy-policy.html",
          "selectedPolicySectionExcerpt": "Advertising, sale and sharing. The test sends an advertising request to Meta and measurement or replay requests to Google Analytics, Microsoft Clarity, Hotjar, FullStory and Mixpanel before a choice. These are intentional signals for review of targeted advertising and possible sale or sharing. The test does not itself reach a legal conclusion about any individual request.",
          "selectedPolicySectionHeading": "Advertising, sale and sharing"
        }
      ],
      "retainedPrivacyPolicyTextExcerpt": "Privacy Policy for the ErgoVeritas test 2 canary ErgoVeritas is the owner of test2.html . This policy applies only to that owned scanner-validation page. It describes deliberately varied signals so CertScore can test evidence capture; it does not describe other ErgoVeritas products. Information collected and why On a fresh visit without GPC or a saved manual choice, the test page sets six first-party cookie identifiers and analytics/session storage. It requests analytics, advertising, session replay and product-measurement endpoints. With GPC, it sets five of those cookies and omits the advertising request. The purposes in this test are audience measurement, advertising signal classification, replay detection and product-event measurement. No account, purchase, form submission or authentication data is collected by the page. Advertising, sale and sharing The test sends an advertising request to Meta and measurement or replay requests to Google Analytics, Microsoft Clarity, Hotjar, FullStory and Mixpanel before a choice. These are intentional signals for review of targeted advertising and possible sale or sharing. The test does not itself reach a legal conclusion about any individual request. Global Privacy Control When Global Privacy Control (GPC) is enabled in the browser, this canary omits the Meta advertising request and its _fbc test cookie. Five other optional requests and their test cookies remain. A complete paired scan can observe this partial reduction; an incomplete comparison cannot establish the site's response. A saved manual Do Not Sell/Share choice turns off all future optional test activity in this browser. Opt-out and cookie choices Visitors can use Do Not Sell or Share My Personal Information , Your Privacy Choices , or Cookie Settings . Saving any of these test choices suppresses optional requests on later visits in that browser and removes the first-party test cookies. The scanner observes links and notice passages; it does not verify these manual actions in an ordinary passive scan. Retention and privacy rights First-party test cookies expire after 15 minutes and saved manual-choice markers after 24 hours. This page makes no statement about providers' separate retention. The canary does not process real requests to access, delete, correct, or obtain a copy of personal information; the test controls should not be treated as such a process. Notice at Collection · Cookie Policy",
      "validatedDisclosureTypesObserved": [],
      "privacyNoticeAvailabilityObserved": true,
      "evaluatedPrivacyPolicySurfaceCount": 1,
      "discardedArticle13DisclosureSignals": [
        {
          "source": "deterministic",
          "confidence": 0.76,
          "surfaceUrl": "https://ergoveritas.com/test2-privacy-policy.html",
          "evidenceText": "The scanner observes links and notice passages; it does not verify these manual actions in an ordinary passive scan. Retention and privacy rights First-party test cookies expire after 15 minutes and saved manual-choice markers after 24 hours. This page makes no statement about providers' separate retention.",
          "rejectReason": "insufficient_row_specific_terms",
          "disclosureType": "data_retention"
        }
      ],
      "staleLegalFrameworkReferenceObserved": false,
      "policyEvidenceProvenanceContractVersion": "certscore.policy-evidence-provenance.v1",
      "gdprTransparencyProductionEvidenceEnabled": true,
      "gdprTransparencyProductionEvidenceDiagnostics": {
        "sourceCandidateCount": 0,
        "candidateDispositions": [],
        "acceptedCandidateCount": 0,
        "rejectedCandidateCount": 0,
        "discardedCandidateCount": 0,
        "diagnosticCandidateCount": 0,
        "productionCreditSignalCount": 0
      }
    }
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Legal basisNot confirmedThis disclosure could not be confirmed from the saved policy evidence.

JSON evidence

Policy source

Captured page title: Privacy Policy — ErgoVeritas test 2 — https://ergoveritas.com/test2-privacy-policy.html

Document heading: Privacy Policy for the ErgoVeritas test 2 canary

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Page Text Link; directly linked from scanned page: Yes; retrieved during scan: 2026-09-28T15:36:42.312Z.

Section: Not retained.

Open policy source

No production-approved topic match was established. This neutral result does not establish that the disclosure is absent.

Full evidence JSON

{
  "assessmentStatus": "coverage_limitation",
  "checklistItemId": "legal_basis_disclosure_observed",
  "coverageArea": "Legal basis disclosure",
  "evidenceState": "not_testable",
  "explanation": "Whether retained privacy-policy evidence included a canonical legal-basis disclosure signal.",
  "note": "Whether retained privacy-policy evidence included a canonical legal-basis disclosure signal.",
  "status": "Not confirmed",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.legal_basis_disclosure_observed.not_confirmed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.legal_basis_disclosure_observed"
  },
  "statusBasis": "No production-approved topic match was established. This neutral result does not establish that the disclosure is absent.",
  "retainedEvidence": {
    "remediation": {
      "kind": "steps",
      "steps": [
        "Review the governing policy section for the legal basis stated for each processing purpose; retain the exact excerpt and source URL.",
        "If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.",
        "Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording."
      ]
    },
    "signalObserved": "not_confirmed_canonical_projection_unavailable",
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "canonicalProjectionState": "normalized_concern_unavailable",
    "policyEvidenceAssessment": {
      "result": "extraction_incomplete",
      "scoreEffect": "none",
      "topicRelevance": "unknown",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://ergoveritas.com/test2-privacy-policy.html",
      "policyTitle": "Privacy Policy — ErgoVeritas test 2",
      "artifactRefs": [
        "policy_excerpt_30725dd5_2e9dd398",
        "policy_surface_text_30725dd5_2e9dd398"
      ],
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "page_text_link",
      "documentHeading": "Privacy Policy for the ErgoVeritas test 2 canary",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-09-28T15:36:42.312Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "ErgoVeritas test 2",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "missing",
    "policyTextExtractionHealth": {
      "policyUrls": [
        "https://ergoveritas.com/test2-privacy-policy.html"
      ],
      "nanoInvoked": false,
      "contractVersion": "certscore.policy-text-extraction-health.v2",
      "policyTextQuality": {
        "usable": true,
        "codeSignalCount": 0,
        "codeSymbolRatio": 0.0016406890894175555,
        "policyTermCount": 8,
        "alphabeticWordRatio": 0.8455284552845529,
        "accessChallengeSignalCount": 0,
        "naturalLanguageSentenceCount": 21
      },
      "policyUrlRetained": true,
      "extractedTextLength": 2438,
      "policySurfaceObserved": true,
      "detectedPolicyLanguage": "en",
      "minimumTextLengthRequired": 500,
      "policyTextExtractionStatus": "ok",
      "verifiedPolicyDocumentCount": 1,
      "detectedPolicyLanguageSource": "policy_surface",
      "supportedGdprTransparencyLocales": [
        "en",
        "de",
        "fr",
        "es",
        "it",
        "nl",
        "pl",
        "pt",
        "ru",
        "ja",
        "zh",
        "ar",
        "sv",
        "ro",
        "cs",
        "el",
        "hu",
        "da",
        "fi",
        "sk",
        "bg",
        "hr",
        "nb",
        "sl",
        "lt",
        "lv",
        "et",
        "uk",
        "tr",
        "fa",
        "vi",
        "id",
        "ko",
        "th",
        "he",
        "sr",
        "ca",
        "hi",
        "az",
        "gl"
      ],
      "gdprTransparencyLanguageSupported": true,
      "policyTextEvidenceProjectionStatus": "verified_complete",
      "policyTextEvidenceProjectionContractVersion": "certscore.policy-text-evidence-projection.v1"
    },
    "selectedEvidenceArtifactId": "coverage_policy",
    "article13CoverageAssessment": {
      "topic": "legal_basis",
      "status": "insufficient_retained_evidence",
      "sourceUrls": [
        "https://ergoveritas.com/test2-privacy-policy.html"
      ],
      "reasonCodes": [
        "policy_absence_coverage_preconditions_not_met",
        "typed_topic_coverage_diagnostic_missing_or_limited",
        "policy_document_content_coverage_incomplete"
      ],
      "coverageStatus": "insufficient",
      "policyDocumentIds": [
        "policy_surface_30725dd5"
      ],
      "policyDocumentRoles": [
        "policy_document"
      ],
      "policyDocumentSha256": [
        "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9"
      ],
      "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
      "unresolvedMaterialPolicyChildUrls": []
    },
    "gdprTransparencyReportStatusContract": "observed_not_confirmed_no_match_found.v1"
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Correction steps

1Review the governing policy section for the legal basis stated for each processing purpose; retain the exact excerpt and source URL.
2If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.
3Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording.

Data retentionNot confirmedThis disclosure could not be confirmed from the saved policy evidence.

JSON evidence

Policy source

Captured page title: Privacy Policy — ErgoVeritas test 2 — https://ergoveritas.com/test2-privacy-policy.html

Document heading: Privacy Policy for the ErgoVeritas test 2 canary

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Page Text Link; directly linked from scanned page: Yes; retrieved during scan: 2026-09-28T15:36:42.312Z.

Section: Not retained.

Open policy source

No production-approved topic match was established. This neutral result does not establish that the disclosure is absent.

Full evidence JSON

{
  "assessmentStatus": "coverage_limitation",
  "checklistItemId": "retention_disclosure_observed",
  "coverageArea": "Retention disclosure",
  "evidenceState": "not_testable",
  "explanation": "Whether retained privacy-policy evidence included a data-retention disclosure signal.",
  "note": "Whether retained privacy-policy evidence included a data-retention disclosure signal.",
  "status": "Not confirmed",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.retention_disclosure_observed.not_confirmed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.retention_disclosure_observed"
  },
  "statusBasis": "No production-approved topic match was established. This neutral result does not establish that the disclosure is absent.",
  "retainedEvidence": {
    "remediation": {
      "kind": "steps",
      "steps": [
        "Review the governing policy section for the retention period or substantive criteria for each relevant data category; retain the exact excerpt and source URL.",
        "If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.",
        "Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording."
      ]
    },
    "signalObserved": "not_confirmed_canonical_projection_unavailable",
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "canonicalProjectionState": "normalized_concern_unavailable",
    "policyEvidenceAssessment": {
      "result": "extraction_incomplete",
      "scoreEffect": "none",
      "topicRelevance": "unknown",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://ergoveritas.com/test2-privacy-policy.html",
      "policyTitle": "Privacy Policy — ErgoVeritas test 2",
      "artifactRefs": [
        "policy_excerpt_30725dd5_2e9dd398",
        "policy_surface_text_30725dd5_2e9dd398"
      ],
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "page_text_link",
      "documentHeading": "Privacy Policy for the ErgoVeritas test 2 canary",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-09-28T15:36:42.312Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "ErgoVeritas test 2",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "missing",
    "policyTextExtractionHealth": {
      "policyUrls": [
        "https://ergoveritas.com/test2-privacy-policy.html"
      ],
      "nanoInvoked": false,
      "contractVersion": "certscore.policy-text-extraction-health.v2",
      "policyTextQuality": {
        "usable": true,
        "codeSignalCount": 0,
        "codeSymbolRatio": 0.0016406890894175555,
        "policyTermCount": 8,
        "alphabeticWordRatio": 0.8455284552845529,
        "accessChallengeSignalCount": 0,
        "naturalLanguageSentenceCount": 21
      },
      "policyUrlRetained": true,
      "extractedTextLength": 2438,
      "policySurfaceObserved": true,
      "detectedPolicyLanguage": "en",
      "minimumTextLengthRequired": 500,
      "policyTextExtractionStatus": "ok",
      "verifiedPolicyDocumentCount": 1,
      "detectedPolicyLanguageSource": "policy_surface",
      "supportedGdprTransparencyLocales": [
        "en",
        "de",
        "fr",
        "es",
        "it",
        "nl",
        "pl",
        "pt",
        "ru",
        "ja",
        "zh",
        "ar",
        "sv",
        "ro",
        "cs",
        "el",
        "hu",
        "da",
        "fi",
        "sk",
        "bg",
        "hr",
        "nb",
        "sl",
        "lt",
        "lv",
        "et",
        "uk",
        "tr",
        "fa",
        "vi",
        "id",
        "ko",
        "th",
        "he",
        "sr",
        "ca",
        "hi",
        "az",
        "gl"
      ],
      "gdprTransparencyLanguageSupported": true,
      "policyTextEvidenceProjectionStatus": "verified_complete",
      "policyTextEvidenceProjectionContractVersion": "certscore.policy-text-evidence-projection.v1"
    },
    "selectedEvidenceArtifactId": "coverage_policy",
    "article13CoverageAssessment": {
      "topic": "data_retention",
      "status": "insufficient_retained_evidence",
      "sourceUrls": [
        "https://ergoveritas.com/test2-privacy-policy.html"
      ],
      "reasonCodes": [
        "policy_absence_coverage_preconditions_not_met",
        "typed_topic_coverage_diagnostic_missing_or_limited",
        "policy_document_content_coverage_incomplete"
      ],
      "coverageStatus": "insufficient",
      "policyDocumentIds": [
        "policy_surface_30725dd5"
      ],
      "policyDocumentRoles": [
        "policy_document"
      ],
      "policyDocumentSha256": [
        "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9"
      ],
      "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
      "unresolvedMaterialPolicyChildUrls": []
    },
    "gdprTransparencyReportStatusContract": "observed_not_confirmed_no_match_found.v1"
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Correction steps

1Review the governing policy section for the retention period or substantive criteria for each relevant data category; retain the exact excerpt and source URL.
2If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.
3Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording.

Controller and contact detailsNot confirmedThis disclosure could not be confirmed from the saved policy evidence.

JSON evidence

Policy source

Captured page title: Privacy Policy — ErgoVeritas test 2 — https://ergoveritas.com/test2-privacy-policy.html

Document heading: Privacy Policy for the ErgoVeritas test 2 canary

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Page Text Link; directly linked from scanned page: Yes; retrieved during scan: 2026-09-28T15:36:42.312Z.

Section: Not retained.

Open policy source

No production-approved topic match was established. This neutral result does not establish that the disclosure is absent.

Full evidence JSON

{
  "assessmentStatus": "coverage_limitation",
  "checklistItemId": "controller_contact_disclosure",
  "coverageArea": "Controller/contact disclosure",
  "evidenceState": "not_testable",
  "explanation": "Whether retained privacy-policy evidence included a controller, privacy contact, or equivalent contact point.",
  "note": "Whether retained privacy-policy evidence included a controller, privacy contact, or equivalent contact point.",
  "status": "Not confirmed",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.controller_contact_disclosure.not_confirmed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.controller_contact_disclosure"
  },
  "statusBasis": "No production-approved topic match was established. This neutral result does not establish that the disclosure is absent.",
  "retainedEvidence": {
    "remediation": {
      "kind": "steps",
      "steps": [
        "Review the governing policy section for the controller identity and contact details; retain the exact excerpt and source URL.",
        "If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.",
        "Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording."
      ]
    },
    "signalObserved": "not_confirmed_canonical_projection_unavailable",
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "canonicalProjectionState": "normalized_concern_unavailable",
    "policyEvidenceAssessment": {
      "result": "extraction_incomplete",
      "scoreEffect": "none",
      "topicRelevance": "unknown",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://ergoveritas.com/test2-privacy-policy.html",
      "policyTitle": "Privacy Policy — ErgoVeritas test 2",
      "artifactRefs": [
        "policy_excerpt_30725dd5_2e9dd398",
        "policy_surface_text_30725dd5_2e9dd398"
      ],
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "page_text_link",
      "documentHeading": "Privacy Policy for the ErgoVeritas test 2 canary",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-09-28T15:36:42.312Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "ErgoVeritas test 2",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "missing",
    "policyTextExtractionHealth": {
      "policyUrls": [
        "https://ergoveritas.com/test2-privacy-policy.html"
      ],
      "nanoInvoked": false,
      "contractVersion": "certscore.policy-text-extraction-health.v2",
      "policyTextQuality": {
        "usable": true,
        "codeSignalCount": 0,
        "codeSymbolRatio": 0.0016406890894175555,
        "policyTermCount": 8,
        "alphabeticWordRatio": 0.8455284552845529,
        "accessChallengeSignalCount": 0,
        "naturalLanguageSentenceCount": 21
      },
      "policyUrlRetained": true,
      "extractedTextLength": 2438,
      "policySurfaceObserved": true,
      "detectedPolicyLanguage": "en",
      "minimumTextLengthRequired": 500,
      "policyTextExtractionStatus": "ok",
      "verifiedPolicyDocumentCount": 1,
      "detectedPolicyLanguageSource": "policy_surface",
      "supportedGdprTransparencyLocales": [
        "en",
        "de",
        "fr",
        "es",
        "it",
        "nl",
        "pl",
        "pt",
        "ru",
        "ja",
        "zh",
        "ar",
        "sv",
        "ro",
        "cs",
        "el",
        "hu",
        "da",
        "fi",
        "sk",
        "bg",
        "hr",
        "nb",
        "sl",
        "lt",
        "lv",
        "et",
        "uk",
        "tr",
        "fa",
        "vi",
        "id",
        "ko",
        "th",
        "he",
        "sr",
        "ca",
        "hi",
        "az",
        "gl"
      ],
      "gdprTransparencyLanguageSupported": true,
      "policyTextEvidenceProjectionStatus": "verified_complete",
      "policyTextEvidenceProjectionContractVersion": "certscore.policy-text-evidence-projection.v1"
    },
    "selectedEvidenceArtifactId": "coverage_policy",
    "article13CoverageAssessment": {
      "topic": "controller_contact",
      "status": "insufficient_retained_evidence",
      "sourceUrls": [
        "https://ergoveritas.com/test2-privacy-policy.html"
      ],
      "reasonCodes": [
        "policy_absence_coverage_preconditions_not_met",
        "typed_topic_coverage_diagnostic_missing_or_limited",
        "policy_document_content_coverage_incomplete"
      ],
      "coverageStatus": "insufficient",
      "policyDocumentIds": [
        "policy_surface_30725dd5"
      ],
      "policyDocumentRoles": [
        "policy_document"
      ],
      "policyDocumentSha256": [
        "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9"
      ],
      "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
      "unresolvedMaterialPolicyChildUrls": []
    },
    "gdprTransparencyReportStatusContract": "observed_not_confirmed_no_match_found.v1"
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Correction steps

1Review the governing policy section for the controller identity and contact details; retain the exact excerpt and source URL.
2If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.
3Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording.

Data use purposesNot confirmedThis disclosure could not be confirmed from the saved policy evidence.

JSON evidence

Policy source

Captured page title: Privacy Policy — ErgoVeritas test 2 — https://ergoveritas.com/test2-privacy-policy.html

Document heading: Privacy Policy for the ErgoVeritas test 2 canary

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Page Text Link; directly linked from scanned page: Yes; retrieved during scan: 2026-09-28T15:36:42.312Z.

Section: Not retained.

Open policy source

No production-approved topic match was established. This neutral result does not establish that the disclosure is absent.

Full evidence JSON

{
  "assessmentStatus": "coverage_limitation",
  "checklistItemId": "processing_purposes_disclosure",
  "coverageArea": "Processing purposes disclosure",
  "evidenceState": "not_testable",
  "explanation": "Whether retained privacy-policy evidence described the purposes for processing personal data.",
  "note": "Whether retained privacy-policy evidence described the purposes for processing personal data.",
  "status": "Not confirmed",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.processing_purposes_disclosure.not_confirmed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.processing_purposes_disclosure"
  },
  "statusBasis": "No production-approved topic match was established. This neutral result does not establish that the disclosure is absent.",
  "retainedEvidence": {
    "remediation": {
      "kind": "steps",
      "steps": [
        "Review the governing policy section for the purposes for each described processing activity; retain the exact excerpt and source URL.",
        "If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.",
        "Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording."
      ]
    },
    "signalObserved": "not_confirmed_canonical_projection_unavailable",
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "canonicalProjectionState": "normalized_concern_unavailable",
    "policyEvidenceAssessment": {
      "result": "extraction_incomplete",
      "scoreEffect": "none",
      "topicRelevance": "unknown",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://ergoveritas.com/test2-privacy-policy.html",
      "policyTitle": "Privacy Policy — ErgoVeritas test 2",
      "artifactRefs": [
        "policy_excerpt_30725dd5_2e9dd398",
        "policy_surface_text_30725dd5_2e9dd398"
      ],
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "page_text_link",
      "documentHeading": "Privacy Policy for the ErgoVeritas test 2 canary",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-09-28T15:36:42.312Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "ErgoVeritas test 2",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "missing",
    "policyTextExtractionHealth": {
      "policyUrls": [
        "https://ergoveritas.com/test2-privacy-policy.html"
      ],
      "nanoInvoked": false,
      "contractVersion": "certscore.policy-text-extraction-health.v2",
      "policyTextQuality": {
        "usable": true,
        "codeSignalCount": 0,
        "codeSymbolRatio": 0.0016406890894175555,
        "policyTermCount": 8,
        "alphabeticWordRatio": 0.8455284552845529,
        "accessChallengeSignalCount": 0,
        "naturalLanguageSentenceCount": 21
      },
      "policyUrlRetained": true,
      "extractedTextLength": 2438,
      "policySurfaceObserved": true,
      "detectedPolicyLanguage": "en",
      "minimumTextLengthRequired": 500,
      "policyTextExtractionStatus": "ok",
      "verifiedPolicyDocumentCount": 1,
      "detectedPolicyLanguageSource": "policy_surface",
      "supportedGdprTransparencyLocales": [
        "en",
        "de",
        "fr",
        "es",
        "it",
        "nl",
        "pl",
        "pt",
        "ru",
        "ja",
        "zh",
        "ar",
        "sv",
        "ro",
        "cs",
        "el",
        "hu",
        "da",
        "fi",
        "sk",
        "bg",
        "hr",
        "nb",
        "sl",
        "lt",
        "lv",
        "et",
        "uk",
        "tr",
        "fa",
        "vi",
        "id",
        "ko",
        "th",
        "he",
        "sr",
        "ca",
        "hi",
        "az",
        "gl"
      ],
      "gdprTransparencyLanguageSupported": true,
      "policyTextEvidenceProjectionStatus": "verified_complete",
      "policyTextEvidenceProjectionContractVersion": "certscore.policy-text-evidence-projection.v1"
    },
    "selectedEvidenceArtifactId": "coverage_policy",
    "article13CoverageAssessment": {
      "topic": "processing_purposes",
      "status": "insufficient_retained_evidence",
      "sourceUrls": [
        "https://ergoveritas.com/test2-privacy-policy.html"
      ],
      "reasonCodes": [
        "policy_absence_coverage_preconditions_not_met",
        "typed_topic_coverage_diagnostic_missing_or_limited",
        "policy_document_content_coverage_incomplete"
      ],
      "coverageStatus": "insufficient",
      "policyDocumentIds": [
        "policy_surface_30725dd5"
      ],
      "policyDocumentRoles": [
        "policy_document"
      ],
      "policyDocumentSha256": [
        "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9"
      ],
      "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
      "unresolvedMaterialPolicyChildUrls": []
    },
    "gdprTransparencyReportStatusContract": "observed_not_confirmed_no_match_found.v1"
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Correction steps

1Review the governing policy section for the purposes for each described processing activity; retain the exact excerpt and source URL.
2If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.
3Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording.

Recipients and vendor categoriesNot confirmedThis disclosure could not be confirmed from the saved policy evidence.

JSON evidence

Policy source

Captured page title: Privacy Policy — ErgoVeritas test 2 — https://ergoveritas.com/test2-privacy-policy.html

Document heading: Privacy Policy for the ErgoVeritas test 2 canary

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Page Text Link; directly linked from scanned page: Yes; retrieved during scan: 2026-09-28T15:36:42.312Z.

Section: Not retained.

Open policy source

No production-approved topic match was established. This neutral result does not establish that the disclosure is absent.

Full evidence JSON

{
  "assessmentStatus": "coverage_limitation",
  "checklistItemId": "recipients_vendor_categories_disclosure",
  "coverageArea": "Recipients/vendor categories disclosed",
  "evidenceState": "not_testable",
  "explanation": "Whether retained privacy-policy evidence described recipient, vendor, or 3rd party categories.",
  "note": "Whether retained privacy-policy evidence described recipient, vendor, or 3rd party categories.",
  "status": "Not confirmed",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.recipients_vendor_categories_disclosure.not_confirmed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.recipients_vendor_categories_disclosure"
  },
  "statusBasis": "No production-approved topic match was established. This neutral result does not establish that the disclosure is absent.",
  "retainedEvidence": {
    "remediation": {
      "kind": "steps",
      "steps": [
        "Review the governing policy section for the recipients or recipient categories that receive personal data; retain the exact excerpt and source URL.",
        "If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.",
        "Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording."
      ]
    },
    "signalObserved": "not_confirmed_canonical_projection_unavailable",
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "canonicalProjectionState": "normalized_concern_unavailable",
    "policyEvidenceAssessment": {
      "result": "extraction_incomplete",
      "scoreEffect": "none",
      "topicRelevance": "unknown",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://ergoveritas.com/test2-privacy-policy.html",
      "policyTitle": "Privacy Policy — ErgoVeritas test 2",
      "artifactRefs": [
        "policy_excerpt_30725dd5_2e9dd398",
        "policy_surface_text_30725dd5_2e9dd398"
      ],
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "page_text_link",
      "documentHeading": "Privacy Policy for the ErgoVeritas test 2 canary",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-09-28T15:36:42.312Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "ErgoVeritas test 2",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "missing",
    "policyTextExtractionHealth": {
      "policyUrls": [
        "https://ergoveritas.com/test2-privacy-policy.html"
      ],
      "nanoInvoked": false,
      "contractVersion": "certscore.policy-text-extraction-health.v2",
      "policyTextQuality": {
        "usable": true,
        "codeSignalCount": 0,
        "codeSymbolRatio": 0.0016406890894175555,
        "policyTermCount": 8,
        "alphabeticWordRatio": 0.8455284552845529,
        "accessChallengeSignalCount": 0,
        "naturalLanguageSentenceCount": 21
      },
      "policyUrlRetained": true,
      "extractedTextLength": 2438,
      "policySurfaceObserved": true,
      "detectedPolicyLanguage": "en",
      "minimumTextLengthRequired": 500,
      "policyTextExtractionStatus": "ok",
      "verifiedPolicyDocumentCount": 1,
      "detectedPolicyLanguageSource": "policy_surface",
      "supportedGdprTransparencyLocales": [
        "en",
        "de",
        "fr",
        "es",
        "it",
        "nl",
        "pl",
        "pt",
        "ru",
        "ja",
        "zh",
        "ar",
        "sv",
        "ro",
        "cs",
        "el",
        "hu",
        "da",
        "fi",
        "sk",
        "bg",
        "hr",
        "nb",
        "sl",
        "lt",
        "lv",
        "et",
        "uk",
        "tr",
        "fa",
        "vi",
        "id",
        "ko",
        "th",
        "he",
        "sr",
        "ca",
        "hi",
        "az",
        "gl"
      ],
      "gdprTransparencyLanguageSupported": true,
      "policyTextEvidenceProjectionStatus": "verified_complete",
      "policyTextEvidenceProjectionContractVersion": "certscore.policy-text-evidence-projection.v1"
    },
    "selectedEvidenceArtifactId": "coverage_policy",
    "article13CoverageAssessment": {
      "topic": "recipients_or_vendor_categories",
      "status": "insufficient_retained_evidence",
      "sourceUrls": [
        "https://ergoveritas.com/test2-privacy-policy.html"
      ],
      "reasonCodes": [
        "policy_absence_coverage_preconditions_not_met",
        "typed_topic_coverage_diagnostic_missing_or_limited",
        "policy_document_content_coverage_incomplete"
      ],
      "coverageStatus": "insufficient",
      "policyDocumentIds": [
        "policy_surface_30725dd5"
      ],
      "policyDocumentRoles": [
        "policy_document"
      ],
      "policyDocumentSha256": [
        "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9"
      ],
      "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
      "unresolvedMaterialPolicyChildUrls": []
    },
    "gdprTransparencyReportStatusContract": "observed_not_confirmed_no_match_found.v1"
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Correction steps

1Review the governing policy section for the recipients or recipient categories that receive personal data; retain the exact excerpt and source URL.
2If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.
3Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording.

Privacy rightsObservedDescribes rights people have over their personal data.

JSON evidence

Policy source

Captured page title: Privacy Policy — ErgoVeritas test 2 — https://ergoveritas.com/test2-privacy-policy.html

Document heading: Privacy Policy for the ErgoVeritas test 2 canary

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Page Text Link; directly linked from scanned page: Yes; retrieved during scan: 2026-09-28T15:36:42.312Z.

Section: Not retained.

Open policy source

Visitors can use Do Not Sell or Share My Personal Information, Your Privacy Choices, or Cookie Settings.

Matched disclosure snippet: Visitors can use Do Not Sell or Share My Personal Information, Your Privacy Choices, or Cookie Settings.

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "data_subject_rights_disclosure",
  "coverageArea": "Data subject rights disclosure",
  "evidenceState": "observed",
  "explanation": "Whether retained privacy-policy evidence described data subject rights or a rights request path.",
  "note": "Whether retained privacy-policy evidence described data subject rights or a rights request path.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.data_subject_rights_disclosure.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.data_subject_rights_disclosure"
  },
  "statusBasis": "Data subject rights disclosure evidence was retained through adapter-approved multilingual GDPR Transparency Article 13 evidence.",
  "retainedEvidence": {
    "remediation": {
      "kind": "none",
      "steps": [],
      "message": "No remediation is established by this check alone. Retain its evidence and reassess after relevant changes."
    },
    "evidenceRefs": [
      "Evidence: Data subject rights disclosure",
      "Excerpt: Visitors can use Do Not Sell or Share My Personal Information, Your Privacy Choices, or Cookie Settings.",
      "Policy URL: https://ergoveritas.com/test2-privacy-policy.html"
    ],
    "signalObserved": true,
    "article13Signal": {
      "source": "normalized_concern",
      "status": "observed",
      "confidence": 0.95,
      "surfaceUrl": "https://ergoveritas.com/test2-privacy-policy.html",
      "evidenceText": "Visitors can use Do Not Sell or Share My Personal Information, Your Privacy Choices, or Cookie Settings.",
      "matchedLocale": null,
      "disclosureType": "data_subject_rights",
      "evidenceSource": "normalized_gdpr_transparency_article13_concern",
      "productionCredit": true,
      "classifierProvenance": "mini_policy_semantic_review.v2",
      "classifierReasonCodes": [
        "rights_or_choice_signals_present",
        "policy_review_invariants_applied_v1"
      ],
      "productionCreditProfile": "gdpr_transparency_mini_review_v1",
      "selectedEvidenceStrength": "strong",
      "selectedPolicySectionUrl": "https://ergoveritas.com/test2-privacy-policy.html"
    },
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "policyEvidenceAssessment": {
      "result": "disclosure_observed",
      "scoreEffect": "canonical_policy",
      "topicRelevance": "direct",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://ergoveritas.com/test2-privacy-policy.html",
      "policyTitle": "Privacy Policy — ErgoVeritas test 2",
      "artifactRefs": [
        "policy_excerpt_30725dd5_2e9dd398",
        "policy_surface_text_30725dd5_2e9dd398"
      ],
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "page_text_link",
      "documentHeading": "Privacy Policy for the ErgoVeritas test 2 canary",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-09-28T15:36:42.312Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "ErgoVeritas test 2",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "coverage_policy",
    "gdprTransparencyArticle13Concern": {
      "state": "sufficient",
      "topic": "data_subject_rights",
      "originKey": "gdpr_transparency.article13.data_subject_rights",
      "canonicalConcernKey": "runtime_artifact:gdpr_transparency.article13.data_subject_rights",
      "regulatoryChecklistEligibility": "observed"
    }
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

International data transfersNot confirmedThis disclosure could not be confirmed from the saved policy evidence.

JSON evidence

Policy source

Captured page title: Privacy Policy — ErgoVeritas test 2 — https://ergoveritas.com/test2-privacy-policy.html

Document heading: Privacy Policy for the ErgoVeritas test 2 canary

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Page Text Link; directly linked from scanned page: Yes; retrieved during scan: 2026-09-28T15:36:42.312Z.

Section: Not retained.

Open policy source

No production-approved topic match was established. This neutral result does not establish that the disclosure is absent.

Full evidence JSON

{
  "assessmentStatus": "coverage_limitation",
  "checklistItemId": "international_transfers_disclosure",
  "coverageArea": "International transfer disclosure",
  "evidenceState": "not_testable",
  "explanation": "Whether retained privacy-policy evidence described international transfers or transfer-relevant endpoint/vendor context.",
  "note": "Whether retained privacy-policy evidence described international transfers or transfer-relevant endpoint/vendor context.",
  "status": "Not confirmed",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.international_transfers_disclosure.not_confirmed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.international_transfers_disclosure"
  },
  "statusBasis": "No production-approved topic match was established. This neutral result does not establish that the disclosure is absent.",
  "retainedEvidence": {
    "remediation": {
      "kind": "steps",
      "steps": [
        "Review the governing policy section for the intended international transfers and applicable safeguard information; retain the exact excerpt and source URL.",
        "If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.",
        "Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording."
      ]
    },
    "signalObserved": "not_confirmed_canonical_projection_unavailable",
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "canonicalProjectionState": "normalized_concern_unavailable",
    "policyEvidenceAssessment": {
      "result": "extraction_incomplete",
      "scoreEffect": "none",
      "topicRelevance": "unknown",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://ergoveritas.com/test2-privacy-policy.html",
      "policyTitle": "Privacy Policy — ErgoVeritas test 2",
      "artifactRefs": [
        "policy_excerpt_30725dd5_2e9dd398",
        "policy_surface_text_30725dd5_2e9dd398"
      ],
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "page_text_link",
      "documentHeading": "Privacy Policy for the ErgoVeritas test 2 canary",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-09-28T15:36:42.312Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "ErgoVeritas test 2",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "missing",
    "policyTextExtractionHealth": {
      "policyUrls": [
        "https://ergoveritas.com/test2-privacy-policy.html"
      ],
      "nanoInvoked": false,
      "contractVersion": "certscore.policy-text-extraction-health.v2",
      "policyTextQuality": {
        "usable": true,
        "codeSignalCount": 0,
        "codeSymbolRatio": 0.0016406890894175555,
        "policyTermCount": 8,
        "alphabeticWordRatio": 0.8455284552845529,
        "accessChallengeSignalCount": 0,
        "naturalLanguageSentenceCount": 21
      },
      "policyUrlRetained": true,
      "extractedTextLength": 2438,
      "policySurfaceObserved": true,
      "detectedPolicyLanguage": "en",
      "minimumTextLengthRequired": 500,
      "policyTextExtractionStatus": "ok",
      "verifiedPolicyDocumentCount": 1,
      "detectedPolicyLanguageSource": "policy_surface",
      "supportedGdprTransparencyLocales": [
        "en",
        "de",
        "fr",
        "es",
        "it",
        "nl",
        "pl",
        "pt",
        "ru",
        "ja",
        "zh",
        "ar",
        "sv",
        "ro",
        "cs",
        "el",
        "hu",
        "da",
        "fi",
        "sk",
        "bg",
        "hr",
        "nb",
        "sl",
        "lt",
        "lv",
        "et",
        "uk",
        "tr",
        "fa",
        "vi",
        "id",
        "ko",
        "th",
        "he",
        "sr",
        "ca",
        "hi",
        "az",
        "gl"
      ],
      "gdprTransparencyLanguageSupported": true,
      "policyTextEvidenceProjectionStatus": "verified_complete",
      "policyTextEvidenceProjectionContractVersion": "certscore.policy-text-evidence-projection.v1"
    },
    "selectedEvidenceArtifactId": "coverage_policy",
    "article13CoverageAssessment": {
      "topic": "international_transfers",
      "status": "insufficient_retained_evidence",
      "sourceUrls": [
        "https://ergoveritas.com/test2-privacy-policy.html"
      ],
      "reasonCodes": [
        "policy_absence_coverage_preconditions_not_met",
        "typed_topic_coverage_diagnostic_missing_or_limited",
        "policy_document_content_coverage_incomplete"
      ],
      "coverageStatus": "insufficient",
      "policyDocumentIds": [
        "policy_surface_30725dd5"
      ],
      "policyDocumentRoles": [
        "policy_document"
      ],
      "policyDocumentSha256": [
        "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9"
      ],
      "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
      "unresolvedMaterialPolicyChildUrls": []
    },
    "gdprTransparencyReportStatusContract": "observed_not_confirmed_no_match_found.v1"
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Correction steps

1Review the governing policy section for the intended international transfers and applicable safeguard information; retain the exact excerpt and source URL.
2If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.
3Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording.

DPO contact (if applicable)Not confirmedThis disclosure could not be confirmed from the saved policy evidence.

JSON evidence

Policy source

Captured page title: Privacy Policy — ErgoVeritas test 2 — https://ergoveritas.com/test2-privacy-policy.html

Document heading: Privacy Policy for the ErgoVeritas test 2 canary

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Page Text Link; directly linked from scanned page: Yes; retrieved during scan: 2026-09-28T15:36:42.312Z.

Section: Not retained.

Open policy source

No production-approved topic match was established. This neutral result does not establish that the disclosure is absent.

Full evidence JSON

{
  "assessmentStatus": "coverage_limitation",
  "checklistItemId": "dpo_contact_point_disclosure",
  "coverageArea": "DPO contact point (where applicable)",
  "evidenceState": "not_testable",
  "explanation": "Whether retained privacy-policy evidence identified a designated data protection officer or equivalent statutory DPO contact. A generic privacy mailbox is credited under controller/contact disclosure and does not by itself establish a DPO designation.",
  "note": "Whether retained privacy-policy evidence identified a designated data protection officer or equivalent statutory DPO contact. A generic privacy mailbox is credited under controller/contact disclosure and does not by itself establish a DPO designation.",
  "status": "Not confirmed",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.dpo_contact_point_disclosure.not_confirmed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.dpo_contact_point_disclosure"
  },
  "statusBasis": "No production-approved topic match was established. This neutral result does not establish that the disclosure is absent.",
  "retainedEvidence": {
    "remediation": {
      "kind": "steps",
      "steps": [
        "Review the governing policy section for an expressly designated Data Protection Officer and contact route, where applicable; retain the exact excerpt and source URL.",
        "Determine whether DPO designation is required separately. A generic privacy mailbox does not prove a designation.",
        "If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.",
        "Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording."
      ]
    },
    "signalObserved": "not_confirmed_canonical_projection_unavailable",
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "canonicalProjectionState": "normalized_concern_unavailable",
    "policyEvidenceAssessment": {
      "result": "extraction_incomplete",
      "scoreEffect": "none",
      "topicRelevance": "unknown",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://ergoveritas.com/test2-privacy-policy.html",
      "policyTitle": "Privacy Policy — ErgoVeritas test 2",
      "artifactRefs": [
        "policy_excerpt_30725dd5_2e9dd398",
        "policy_surface_text_30725dd5_2e9dd398"
      ],
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "page_text_link",
      "documentHeading": "Privacy Policy for the ErgoVeritas test 2 canary",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-09-28T15:36:42.312Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "ErgoVeritas test 2",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "missing",
    "policyTextExtractionHealth": {
      "policyUrls": [
        "https://ergoveritas.com/test2-privacy-policy.html"
      ],
      "nanoInvoked": false,
      "contractVersion": "certscore.policy-text-extraction-health.v2",
      "policyTextQuality": {
        "usable": true,
        "codeSignalCount": 0,
        "codeSymbolRatio": 0.0016406890894175555,
        "policyTermCount": 8,
        "alphabeticWordRatio": 0.8455284552845529,
        "accessChallengeSignalCount": 0,
        "naturalLanguageSentenceCount": 21
      },
      "policyUrlRetained": true,
      "extractedTextLength": 2438,
      "policySurfaceObserved": true,
      "detectedPolicyLanguage": "en",
      "minimumTextLengthRequired": 500,
      "policyTextExtractionStatus": "ok",
      "verifiedPolicyDocumentCount": 1,
      "detectedPolicyLanguageSource": "policy_surface",
      "supportedGdprTransparencyLocales": [
        "en",
        "de",
        "fr",
        "es",
        "it",
        "nl",
        "pl",
        "pt",
        "ru",
        "ja",
        "zh",
        "ar",
        "sv",
        "ro",
        "cs",
        "el",
        "hu",
        "da",
        "fi",
        "sk",
        "bg",
        "hr",
        "nb",
        "sl",
        "lt",
        "lv",
        "et",
        "uk",
        "tr",
        "fa",
        "vi",
        "id",
        "ko",
        "th",
        "he",
        "sr",
        "ca",
        "hi",
        "az",
        "gl"
      ],
      "gdprTransparencyLanguageSupported": true,
      "policyTextEvidenceProjectionStatus": "verified_complete",
      "policyTextEvidenceProjectionContractVersion": "certscore.policy-text-evidence-projection.v1"
    },
    "selectedEvidenceArtifactId": "coverage_policy",
    "article13CoverageAssessment": {
      "topic": "dpo_contact",
      "status": "insufficient_retained_evidence",
      "sourceUrls": [
        "https://ergoveritas.com/test2-privacy-policy.html"
      ],
      "reasonCodes": [
        "policy_absence_coverage_preconditions_not_met",
        "typed_topic_coverage_diagnostic_missing_or_limited",
        "policy_document_content_coverage_incomplete"
      ],
      "coverageStatus": "insufficient",
      "policyDocumentIds": [
        "policy_surface_30725dd5"
      ],
      "policyDocumentRoles": [
        "policy_document"
      ],
      "policyDocumentSha256": [
        "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9"
      ],
      "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
      "unresolvedMaterialPolicyChildUrls": []
    },
    "gdprTransparencyReportStatusContract": "observed_not_confirmed_no_match_found.v1"
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Correction steps

1Review the governing policy section for an expressly designated Data Protection Officer and contact route, where applicable; retain the exact excerpt and source URL.
2Determine whether DPO designation is required separately. A generic privacy mailbox does not prove a designation.
3If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.
4Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording.

Complaints to a regulatorNot confirmedThis disclosure could not be confirmed from the saved policy evidence.

JSON evidence

Policy source

Captured page title: Privacy Policy — ErgoVeritas test 2 — https://ergoveritas.com/test2-privacy-policy.html

Document heading: Privacy Policy for the ErgoVeritas test 2 canary

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Page Text Link; directly linked from scanned page: Yes; retrieved during scan: 2026-09-28T15:36:42.312Z.

Section: Not retained.

Open policy source

No production-approved topic match was established. This neutral result does not establish that the disclosure is absent.

Full evidence JSON

{
  "assessmentStatus": "coverage_limitation",
  "checklistItemId": "supervisory_authority_complaint_disclosure",
  "coverageArea": "Supervisory authority complaint",
  "evidenceState": "not_testable",
  "explanation": "Whether retained privacy-policy evidence referenced a right to complain to a supervisory authority.",
  "note": "Whether retained privacy-policy evidence referenced a right to complain to a supervisory authority.",
  "status": "Not confirmed",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.supervisory_authority_complaint_disclosure.not_confirmed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.supervisory_authority_complaint_disclosure"
  },
  "statusBasis": "No production-approved topic match was established. This neutral result does not establish that the disclosure is absent.",
  "retainedEvidence": {
    "remediation": {
      "kind": "steps",
      "steps": [
        "Review the governing policy section for the right to complain to a supervisory authority; retain the exact excerpt and source URL.",
        "If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.",
        "Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording."
      ]
    },
    "signalObserved": "not_confirmed_canonical_projection_unavailable",
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "canonicalProjectionState": "normalized_concern_unavailable",
    "policyEvidenceAssessment": {
      "result": "extraction_incomplete",
      "scoreEffect": "none",
      "topicRelevance": "unknown",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://ergoveritas.com/test2-privacy-policy.html",
      "policyTitle": "Privacy Policy — ErgoVeritas test 2",
      "artifactRefs": [
        "policy_excerpt_30725dd5_2e9dd398",
        "policy_surface_text_30725dd5_2e9dd398"
      ],
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "page_text_link",
      "documentHeading": "Privacy Policy for the ErgoVeritas test 2 canary",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-09-28T15:36:42.312Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "ErgoVeritas test 2",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "missing",
    "policyTextExtractionHealth": {
      "policyUrls": [
        "https://ergoveritas.com/test2-privacy-policy.html"
      ],
      "nanoInvoked": false,
      "contractVersion": "certscore.policy-text-extraction-health.v2",
      "policyTextQuality": {
        "usable": true,
        "codeSignalCount": 0,
        "codeSymbolRatio": 0.0016406890894175555,
        "policyTermCount": 8,
        "alphabeticWordRatio": 0.8455284552845529,
        "accessChallengeSignalCount": 0,
        "naturalLanguageSentenceCount": 21
      },
      "policyUrlRetained": true,
      "extractedTextLength": 2438,
      "policySurfaceObserved": true,
      "detectedPolicyLanguage": "en",
      "minimumTextLengthRequired": 500,
      "policyTextExtractionStatus": "ok",
      "verifiedPolicyDocumentCount": 1,
      "detectedPolicyLanguageSource": "policy_surface",
      "supportedGdprTransparencyLocales": [
        "en",
        "de",
        "fr",
        "es",
        "it",
        "nl",
        "pl",
        "pt",
        "ru",
        "ja",
        "zh",
        "ar",
        "sv",
        "ro",
        "cs",
        "el",
        "hu",
        "da",
        "fi",
        "sk",
        "bg",
        "hr",
        "nb",
        "sl",
        "lt",
        "lv",
        "et",
        "uk",
        "tr",
        "fa",
        "vi",
        "id",
        "ko",
        "th",
        "he",
        "sr",
        "ca",
        "hi",
        "az",
        "gl"
      ],
      "gdprTransparencyLanguageSupported": true,
      "policyTextEvidenceProjectionStatus": "verified_complete",
      "policyTextEvidenceProjectionContractVersion": "certscore.policy-text-evidence-projection.v1"
    },
    "selectedEvidenceArtifactId": "coverage_policy",
    "article13CoverageAssessment": {
      "topic": "supervisory_authority",
      "status": "insufficient_retained_evidence",
      "sourceUrls": [
        "https://ergoveritas.com/test2-privacy-policy.html"
      ],
      "reasonCodes": [
        "policy_absence_coverage_preconditions_not_met",
        "typed_topic_coverage_diagnostic_missing_or_limited",
        "policy_document_content_coverage_incomplete"
      ],
      "coverageStatus": "insufficient",
      "policyDocumentIds": [
        "policy_surface_30725dd5"
      ],
      "policyDocumentRoles": [
        "policy_document"
      ],
      "policyDocumentSha256": [
        "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9"
      ],
      "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
      "unresolvedMaterialPolicyChildUrls": []
    },
    "gdprTransparencyReportStatusContract": "observed_not_confirmed_no_match_found.v1"
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Correction steps

1Review the governing policy section for the right to complain to a supervisory authority; retain the exact excerpt and source URL.
2If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.
3Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording.

Profiling and automated decisionsNot confirmedThis disclosure could not be confirmed from the saved policy evidence.

JSON evidence

Policy source

Captured page title: Privacy Policy — ErgoVeritas test 2 — https://ergoveritas.com/test2-privacy-policy.html

Document heading: Privacy Policy for the ErgoVeritas test 2 canary

Source policy language: en; banner/page language: en; translation applied: No.

Policy reached through: Page Text Link; directly linked from scanned page: Yes; retrieved during scan: 2026-09-28T15:36:42.312Z.

Section: Not retained.

Open policy source

No production-approved topic match was established. This neutral result does not establish that the disclosure is absent.

Full evidence JSON

{
  "assessmentStatus": "coverage_limitation",
  "checklistItemId": "automated_decision_making_profiling_disclosure",
  "coverageArea": "Automated decision-making / profiling disclosure",
  "evidenceState": "not_testable",
  "explanation": "Whether adapter-approved Article 13 evidence retained automated decision-making or profiling disclosure context for review.",
  "note": "Whether adapter-approved Article 13 evidence retained automated decision-making or profiling disclosure context for review.",
  "status": "Not confirmed",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.automated_decision_making_profiling_disclosure.not_confirmed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.automated_decision_making_profiling_disclosure"
  },
  "statusBasis": "No production-approved topic match was established. This neutral result does not establish that the disclosure is absent.",
  "retainedEvidence": {
    "remediation": {
      "kind": "steps",
      "steps": [
        "Review the governing policy section for the applicable automated decision-making or profiling disclosures; retain the exact excerpt and source URL.",
        "If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.",
        "Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording."
      ]
    },
    "signalObserved": "not_confirmed_canonical_projection_unavailable",
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "canonicalProjectionState": "normalized_concern_unavailable",
    "policyEvidenceAssessment": {
      "result": "extraction_incomplete",
      "scoreEffect": "none",
      "topicRelevance": "unknown",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://ergoveritas.com/test2-privacy-policy.html",
      "policyTitle": "Privacy Policy — ErgoVeritas test 2",
      "artifactRefs": [
        "policy_excerpt_30725dd5_2e9dd398",
        "policy_surface_text_30725dd5_2e9dd398"
      ],
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "page_text_link",
      "documentHeading": "Privacy Policy for the ErgoVeritas test 2 canary",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-09-28T15:36:42.312Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "ErgoVeritas test 2",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "missing",
    "policyTextExtractionHealth": {
      "policyUrls": [
        "https://ergoveritas.com/test2-privacy-policy.html"
      ],
      "nanoInvoked": false,
      "contractVersion": "certscore.policy-text-extraction-health.v2",
      "policyTextQuality": {
        "usable": true,
        "codeSignalCount": 0,
        "codeSymbolRatio": 0.0016406890894175555,
        "policyTermCount": 8,
        "alphabeticWordRatio": 0.8455284552845529,
        "accessChallengeSignalCount": 0,
        "naturalLanguageSentenceCount": 21
      },
      "policyUrlRetained": true,
      "extractedTextLength": 2438,
      "policySurfaceObserved": true,
      "detectedPolicyLanguage": "en",
      "minimumTextLengthRequired": 500,
      "policyTextExtractionStatus": "ok",
      "verifiedPolicyDocumentCount": 1,
      "detectedPolicyLanguageSource": "policy_surface",
      "supportedGdprTransparencyLocales": [
        "en",
        "de",
        "fr",
        "es",
        "it",
        "nl",
        "pl",
        "pt",
        "ru",
        "ja",
        "zh",
        "ar",
        "sv",
        "ro",
        "cs",
        "el",
        "hu",
        "da",
        "fi",
        "sk",
        "bg",
        "hr",
        "nb",
        "sl",
        "lt",
        "lv",
        "et",
        "uk",
        "tr",
        "fa",
        "vi",
        "id",
        "ko",
        "th",
        "he",
        "sr",
        "ca",
        "hi",
        "az",
        "gl"
      ],
      "gdprTransparencyLanguageSupported": true,
      "policyTextEvidenceProjectionStatus": "verified_complete",
      "policyTextEvidenceProjectionContractVersion": "certscore.policy-text-evidence-projection.v1"
    },
    "selectedEvidenceArtifactId": "coverage_policy",
    "article13CoverageAssessment": {
      "topic": "automated_decision_making_or_profiling",
      "status": "insufficient_retained_evidence",
      "sourceUrls": [
        "https://ergoveritas.com/test2-privacy-policy.html"
      ],
      "reasonCodes": [
        "policy_absence_coverage_preconditions_not_met",
        "typed_topic_coverage_diagnostic_missing_or_limited",
        "policy_document_content_coverage_incomplete"
      ],
      "coverageStatus": "insufficient",
      "policyDocumentIds": [
        "policy_surface_30725dd5"
      ],
      "policyDocumentRoles": [
        "policy_document"
      ],
      "policyDocumentSha256": [
        "c82bfdc0e439ce4225330062af7681a4146822c64c0c738e6cd3b6b98ab110f9"
      ],
      "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
      "unresolvedMaterialPolicyChildUrls": []
    },
    "gdprTransparencyReportStatusContract": "observed_not_confirmed_no_match_found.v1"
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Correction steps

1Review the governing policy section for the applicable automated decision-making or profiling disclosures; retain the exact excerpt and source URL.
2If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.
3Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording.

Cookie disclosureObservedA cookie policy or disclosure notice was found.

JSON evidence

Cookie settings or policy surface present

Signal: Cookie policy fetched

disclosure.cookie_policy_present

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "cookie_notice_policy_availability",
  "coverageArea": "Cookie notice / cookie policy availability",
  "evidenceState": "observed",
  "explanation": "Whether a cookie notice, cookie policy, cookie settings surface, or equivalent cookie disclosure surface was retained.",
  "note": "Whether a cookie notice, cookie policy, cookie settings surface, or equivalent cookie disclosure surface was retained.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "unified_finding",
    "concernPolicyKey": "gdpr_eprivacy_coverage.cookie_notice_policy_availability.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.cookie_notice_policy_availability"
  },
  "statusBasis": "Canonical unified finding projected for this row.",
  "retainedEvidence": {
    "status": "Observed",
    "evidenceRefs": [
      "Cookie settings or policy surface present",
      "Signal: Cookie policy fetched",
      "Evidence flag: disclosure.cookie_policy_present",
      "Evidence strength: policy text",
      "Evidence strength: page attributed",
      "Evidence strength: key page discovery"
    ],
    "findingEntities": [
      {
        "id": "cookie_policy_present",
        "entities": {},
        "sourceRefs": [
          "Signal: Cookie policy fetched"
        ],
        "evidenceFlags": [
          "disclosure.cookie_policy_present"
        ]
      }
    ],
    "evidenceHighlights": [],
    "missingEvidenceNeeded": [
      "CertScore.unifiedFinding.presentationDecision.status: Required to treat a matched canonical finding as fully surfaced evidence for this checklist row."
    ],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "unified_finding"
  },
  "projectedFindings": [
    {
      "id": "cookie_policy_present",
      "label": "Cookie settings or policy surface present",
      "severity": "medium"
    }
  ],
  "missingOrIncompleteSourceSignals": [
    {
      "field": "CertScore.unifiedFinding.presentationDecision.status",
      "actual": [
        "audit_only"
      ],
      "source": "CertScore.ai",
      "expected": "surface",
      "whyNeeded": "Required to treat a matched canonical finding as fully surfaced evidence for this checklist row."
    }
  ]
}

Cookies & tracking

3 checks · 2 to review

Review

Pre-consent storage classification reviewPartial concernCookies or browser storage were observed before consent, but the scan could not determine whether every item was essential or non-essential.

JSON evidence

_ga_TEST2 (ergoveritas.com) non-essential, present in a check performed before consent, first seen at 1.19s.

_gat_TEST2 (ergoveritas.com) non-essential, present in a check performed before consent, first seen at 1.19s.

_fbc (ergoveritas.com) non-essential, present in a check performed before consent, first seen at 1.19s.

Full evidence JSON

{
  "assessmentStatus": "review_signal",
  "checklistItemId": "pre_consent_cookies_storage",
  "coverageArea": "Pre-consent storage classification review",
  "evidenceState": "observed",
  "explanation": "Pre-consent storage was retained. 3 records remain unclassified. Review the retained storage inventory before drawing a conclusion.",
  "note": "Pre-consent storage was retained. 3 records remain unclassified. Review the retained storage inventory before drawing a conclusion.",
  "status": "Review signal",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.pre_consent_cookies_storage.review_signal",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.pre_consent_cookies_storage"
  },
  "statusBasis": "Pre-consent storage was retained. 3 records remain unclassified. Review the retained storage inventory before drawing a conclusion.",
  "retainedEvidence": {
    "remediation": {
      "kind": "steps",
      "steps": [
        "Inspect the listed cookie and storage identities, their purposes, and the retained timing evidence. Distinguish a directly observed write from snapshot presence.",
        "For items confirmed to require consent, gate their creation and use on the relevant affirmative choice; check the responsible tag or integration.",
        "Retest the same page and location in a fresh session. Verify those items are absent before consent and after Reject, and appear only after the applicable Accept choice."
      ]
    },
    "evidenceRefs": [
      "_fbc (ergoveritas.com): non_essential, present in periodic pre-consent snapshot",
      "_ga_TEST2 (ergoveritas.com): non_essential, present in periodic pre-consent snapshot",
      "_gat_TEST2 (ergoveritas.com): non_essential, present in periodic pre-consent snapshot",
      "_clsk (ergoveritas.com): unknown, present in periodic pre-consent snapshot",
      "ajs_anonymous_id (ergoveritas.com): unknown, present in periodic pre-consent snapshot",
      "mp_test2_mixpanel (ergoveritas.com): unknown, present in periodic pre-consent snapshot"
    ],
    "cookiesSeenCount": 7,
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected retained concrete cookie/storage evidence for storage timing; request-only tracking evidence is not used as storage proof.",
    "weakerArtifactsIgnored": [],
    "selectedEvidenceStrength": "limited",
    "cookiesBeforeConsentCount": 3,
    "selectedEvidenceArtifactId": "preConsentCookieOrStorageEvidence.missing",
    "preConsentStorageAssessment": {
      "status": "partially_classified",
      "evidenceRows": [
        {
          "name": "_ga_TEST2",
          "party": "first_party",
          "domain": "ergoveritas.com",
          "category": "analytics",
          "storageType": "cookie",
          "essentiality": "non_essential",
          "timingEvidence": "periodic_preconsent_snapshot",
          "exclusionReason": null,
          "firstObservedMs": 1191,
          "initiatorDomain": null,
          "initiatorVendor": null,
          "essentialitySource": "canonical_registry",
          "exactStorageIdentity": "[\"_ga_TEST2\",\"ergoveritas.com\",\"/\",null]"
        },
        {
          "name": "_gat_TEST2",
          "party": "first_party",
          "domain": "ergoveritas.com",
          "category": "analytics",
          "storageType": "cookie",
          "essentiality": "non_essential",
          "timingEvidence": "periodic_preconsent_snapshot",
          "exclusionReason": null,
          "firstObservedMs": 1191,
          "initiatorDomain": null,
          "initiatorVendor": null,
          "essentialitySource": "canonical_registry",
          "exactStorageIdentity": "[\"_gat_TEST2\",\"ergoveritas.com\",\"/\",null]"
        },
        {
          "name": "_fbc",
          "party": "first_party",
          "domain": "ergoveritas.com",
          "category": "advertising",
          "storageType": "cookie",
          "essentiality": "non_essential",
          "timingEvidence": "periodic_preconsent_snapshot",
          "exclusionReason": null,
          "firstObservedMs": 1191,
          "initiatorDomain": null,
          "initiatorVendor": null,
          "essentialitySource": "canonical_registry",
          "exactStorageIdentity": "[\"_fbc\",\"ergoveritas.com\",\"/\",null]"
        },
        {
          "name": "_clsk",
          "party": "first_party",
          "domain": "ergoveritas.com",
          "category": "session_replay",
          "storageType": "cookie",
          "essentiality": "unknown",
          "timingEvidence": "periodic_preconsent_snapshot",
          "exclusionReason": null,
          "firstObservedMs": 1191,
          "initiatorDomain": null,
          "initiatorVendor": null,
          "essentialitySource": "unknown",
          "exactStorageIdentity": "[\"_clsk\",\"ergoveritas.com\",\"/\",null]"
        },
        {
          "name": "ajs_anonymous_id",
          "party": "first_party",
          "domain": "ergoveritas.com",
          "category": "analytics",
          "storageType": "cookie",
          "essentiality": "unknown",
          "timingEvidence": "periodic_preconsent_snapshot",
          "exclusionReason": null,
          "firstObservedMs": 1191,
          "initiatorDomain": null,
          "initiatorVendor": null,
          "essentialitySource": "unknown",
          "exactStorageIdentity": "[\"ajs_anonymous_id\",\"ergoveritas.com\",\"/\",null]"
        },
        {
          "name": "mp_test2_mixpanel",
          "party": "first_party",
          "domain": "ergoveritas.com",
          "category": "analytics",
          "storageType": "cookie",
          "essentiality": "unknown",
          "timingEvidence": "periodic_preconsent_snapshot",
          "exclusionReason": null,
          "firstObservedMs": 1191,
          "initiatorDomain": null,
          "initiatorVendor": null,
          "essentialitySource": "unknown",
          "exactStorageIdentity": "[\"mp_test2_mixpanel\",\"ergoveritas.com\",\"/\",null]"
        },
        {
          "name": "OptanonConsent",
          "party": "first_party",
          "domain": "ergoveritas.com",
          "category": "consent_management",
          "storageType": "cookie",
          "essentiality": "essential",
          "timingEvidence": "periodic_preconsent_snapshot",
          "exclusionReason": "functional_or_consent_storage",
          "firstObservedMs": 1191,
          "initiatorDomain": null,
          "initiatorVendor": null,
          "essentialitySource": "canonical_registry",
          "exactStorageIdentity": "[\"OptanonConsent\",\"ergoveritas.com\",\"/\",null]"
        }
      ],
      "provenWriteCount": 0,
      "assessmentVersion": "pre-consent-storage-assessment-v1",
      "unclassifiedCount": 3,
      "reconciliationStatus": "reconciled",
      "snapshotPresenceCount": 7,
      "aggregateObservedCount": 7,
      "classifiedEssentialCount": 1,
      "classifiedNonEssentialCount": 3,
      "attributedPreConsentRecordCount": 7,
      "excludedFunctionalOrConsentCount": 1
    },
    "excludedEssentialOrFunctionalRows": [
      {
        "name": "OptanonConsent",
        "party": "first_party",
        "domain": "ergoveritas.com",
        "category": "consent_management",
        "storageType": "cookie",
        "essentiality": "essential",
        "timingEvidence": "periodic_preconsent_snapshot",
        "exclusionReason": "functional_or_consent_storage",
        "firstObservedMs": 1191,
        "initiatorDomain": null,
        "initiatorVendor": null,
        "essentialitySource": "canonical_registry",
        "exactStorageIdentity": "[\"OptanonConsent\",\"ergoveritas.com\",\"/\",null]"
      }
    ],
    "preConsentStorageAssessmentStatus": "partially_classified",
    "eligiblePreconsentCookieStorageRows": [
      {
        "name": "_ga_TEST2",
        "party": "first_party",
        "domain": "ergoveritas.com",
        "category": "analytics",
        "storageType": "cookie",
        "essentiality": "non_essential",
        "timingEvidence": "periodic_preconsent_snapshot",
        "exclusionReason": null,
        "firstObservedMs": 1191,
        "initiatorDomain": null,
        "initiatorVendor": null,
        "essentialitySource": "canonical_registry",
        "exactStorageIdentity": "[\"_ga_TEST2\",\"ergoveritas.com\",\"/\",null]"
      },
      {
        "name": "_gat_TEST2",
        "party": "first_party",
        "domain": "ergoveritas.com",
        "category": "analytics",
        "storageType": "cookie",
        "essentiality": "non_essential",
        "timingEvidence": "periodic_preconsent_snapshot",
        "exclusionReason": null,
        "firstObservedMs": 1191,
        "initiatorDomain": null,
        "initiatorVendor": null,
        "essentialitySource": "canonical_registry",
        "exactStorageIdentity": "[\"_gat_TEST2\",\"ergoveritas.com\",\"/\",null]"
      },
      {
        "name": "_fbc",
        "party": "first_party",
        "domain": "ergoveritas.com",
        "category": "advertising",
        "storageType": "cookie",
        "essentiality": "non_essential",
        "timingEvidence": "periodic_preconsent_snapshot",
        "exclusionReason": null,
        "firstObservedMs": 1191,
        "initiatorDomain": null,
        "initiatorVendor": null,
        "essentialitySource": "canonical_registry",
        "exactStorageIdentity": "[\"_fbc\",\"ergoveritas.com\",\"/\",null]"
      }
    ],
    "rowLevelEssentialityEvidenceRetained": true,
    "firstPreconsentCookieOrStorageObservedMs": 1191,
    "preConsentStorageClassificationLimitation": true,
    "preconsentCookieOrStorageExactTimingRetained": false,
    "eligibleNonEssentialCookieStorageFindingProjected": false
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Correction steps

1Inspect the listed cookie and storage identities, their purposes, and the retained timing evidence. Distinguish a directly observed write from snapshot presence.
2For items confirmed to require consent, gate their creation and use on the relevant affirmative choice; check the responsible tag or integration.
3Retest the same page and location in a fresh session. Verify those items are absent before consent and after Reject, and appear only after the applicable Accept choice.

Session recordingPartial concernSession replay or behavioral analytics signals were observed: Microsoft Clarity, Hotjar, and FullStory; first seen 0.681s after scan start; before any recorded consent action.

JSON evidence

Microsoft Clarity, category: session_replay, observed before consent

FullStory, category: session_replay, observed before consent

Hotjar, category: session_replay, observed before consent

Full evidence JSON

{
  "assessmentStatus": "review_signal",
  "checklistItemId": "session_replay_fingerprinting_review",
  "coverageArea": "Session replay signal",
  "evidenceState": "observed",
  "explanation": "CertScore.ai observed session replay or behavioral analytics vendors not observed pre-consent in retained evidence, including Microsoft Clarity, Hotjar, and FullStory. Because these tools can capture user interaction behavior, review consent timing, disclosure, masking/exclusion settings, sensitive-page coverage, and withdrawal controls.",
  "note": "CertScore.ai observed session replay or behavioral analytics vendors not observed pre-consent in retained evidence, including Microsoft Clarity, Hotjar, and FullStory. Because these tools can capture user interaction behavior, review consent timing, disclosure, masking/exclusion settings, sensitive-page coverage, and withdrawal controls.",
  "status": "Review signal",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "unified_finding",
    "concernPolicyKey": "gdpr_eprivacy_coverage.session_replay_fingerprinting_review.review_signal",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.session_replay_fingerprinting_review"
  },
  "statusBasis": "Selected the strongest retained canonical coverage evidence available for this row.",
  "retainedEvidence": {
    "status": "Review signal",
    "evidenceRefs": [
      "Session replay observed",
      "Signal: Session replay runtime detected",
      "Signal: Session replay runtime vendors",
      "Signal: Session replay tool detected",
      "Evidence flag: contradiction_runtime_artifact_retained",
      "Evidence flag: privacy.session_replay_runtime_detected"
    ],
    "findingEntities": [
      {
        "id": "session_replay_observed",
        "entities": {
          "runtimeVendors": [
            "Microsoft Clarity",
            "Hotjar",
            "FullStory"
          ],
          "runtimeRequestUrls": [
            "https://www.clarity.ms",
            "https://www.clarity.ms/collect?tid=certscore-test2",
            "https://static.hotjar.com/c/hotjar-100002.js?sv=7",
            "https://rs.fullstory.com/s/fs.js?certscore=test2",
            "https://www.clarity.ms/collect?tid=[redacted]"
          ],
          "observedTrackingVendors": [
            "Microsoft Clarity",
            "Hotjar",
            "FullStory"
          ],
          "sessionReplayEvidenceSummary": [
            "{\"artifactCount\":6,\"collectionEndpointObserved\":true,\"consentStates\":[\"pre_consent\"],\"coverageRetained\":true,\"firstSeenMs\":681,\"libraryOnly\":false,\"preConsentObserved\":true,\"requestUrls\":[\"https://www.clarity.ms/collect?tid=certscore-test2\",\"https://static.hotjar.com/c/hotjar-100002.js?sv=7\",\"https://rs.fullstory.com/s/fs.js?certscore=test2\",\"https://www.clarity.ms/collect?tid=[redacted]\",\"https://static.hotjar.com/c/hotjar-100002.js?sv=[redacted]\",\"https://rs.fullstory.com/s/fs.js?certscore=[redacted]\"],\"vendors\":[\"Microsoft Clarity\",\"Hotjar\",\"FullStory\"]}"
          ],
          "session_replay_runtime_vendors": [
            "Microsoft Clarity",
            "Hotjar",
            "FullStory"
          ]
        },
        "sourceRefs": [
          "Signal: Session replay runtime detected",
          "Signal: Session replay runtime vendors",
          "Signal: Session replay tool detected"
        ],
        "evidenceFlags": [
          "privacy.session_replay_runtime_detected",
          "privacy.session_replay_runtime_vendors",
          "commerce.session_replay_tool_detected"
        ]
      }
    ],
    "evidenceHighlights": [
      "\"Microsoft Clarity\", \"category\": \"session_replay\", \"preConsent\": true",
      "\"FullStory\", \"category\": \"session_replay\", \"preConsent\": true",
      "\"Hotjar\", \"category\": \"session_replay\", \"preConsent\": true"
    ],
    "missingEvidenceNeeded": [],
    "sessionReplayEvidence": {
      "vendors": [
        "Microsoft Clarity",
        "Hotjar",
        "FullStory"
      ],
      "firstSeenMs": 681,
      "requestUrls": [
        "https://www.clarity.ms/collect?tid=[redacted]",
        "https://static.hotjar.com/c/hotjar-100002.js?sv=[redacted]",
        "https://rs.fullstory.com/s/fs.js?certscore=[redacted]",
        "https://www.clarity.ms/collect?tid=certscore-test2",
        "https://static.hotjar.com/c/hotjar-100002.js?sv=7"
      ],
      "consentStates": [
        "pre_consent"
      ],
      "vendorDisclosed": false,
      "postAcceptObserved": false,
      "preConsentObserved": true,
      "libraryLoadObserved": true,
      "vendorDisclosureGap": false,
      "collectionEndpointObserved": true,
      "vendorDisclosureMatchedCount": 0,
      "vendorDisclosureUnmatchedCount": 0,
      "postChoiceConsentControlsObserved": false,
      "vendorDisclosureComparisonObserved": false
    },
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "selectedEvidenceStrength": "missing",
    "selectedEvidenceArtifactId": "unified_finding"
  },
  "projectedFindings": [
    {
      "id": "session_replay_observed",
      "label": "Session replay observed",
      "severity": "high"
    }
  ],
  "missingOrIncompleteSourceSignals": []
}

Correction steps

1Inspect the retained vendor, script, and collection-request evidence to establish which replay or fingerprinting features are active.
2Review collection settings, field masking, purpose, and consent requirements. Disable unnecessary capture and gate consent-dependent collection at its source.
3Retest a fresh session before consent, after Reject, and after Accept; retain the collection-request evidence for each state and verify masking separately.

Device fingerprintingNot observedNo device-fingerprinting activity was detected during this scan.

JSON evidence

retained fingerprinting/browser API coverage summary

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "device_identification_fingerprinting_signal_observed",
  "coverageArea": "Device identification / fingerprinting signal",
  "evidenceState": "not_observed",
  "explanation": "Whether browser/device entropy, fingerprinting, or identifier-like device collection signals were observed in retained runtime evidence.",
  "note": "Whether browser/device entropy, fingerprinting, or identifier-like device collection signals were observed in retained runtime evidence.",
  "status": "Not observed",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.device_identification_fingerprinting_signal_observed.not_observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.device_identification_fingerprinting_signal_observed"
  },
  "statusBasis": "Runtime fingerprinting/device-identification checks completed for the tested context and did not retain an eligible signal.",
  "retainedEvidence": {
    "evidenceRefs": [
      "Evidence: retained fingerprinting/browser API coverage summary"
    ],
    "missingEvidenceNeeded": [],
    "fingerprintingObserved": false,
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "runtimeCaptureCompleted": true,
    "runtimeEvidenceRetained": true,
    "selectedEvidenceStrength": "missing",
    "selectedEvidenceArtifactId": "coverage_policy",
    "fingerprintingRuntimeCoverageRetained": true
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

California privacy review

0 choices · 1 notice

Disclosures captured: Sale/sharing · Collection/purposes · Retention · Privacy rights · Opt-out methods

View GPC evidence ↓

Evidence & assessment details

Choice and request inspection

Sale/sharing choice inspection: Not determined: complete inspection evidence is unavailable.
Choice destinations: Only retained retrieval results are available; end-to-end functionality is unassessed.
Request routes on the scanned page: No verified request-route result. Availability and functionality remain unassessed.
Sale/sharing opt-out effectiveness: Not assessed in this result. Cookie Reject does not establish a sale/sharing opt-out.
Notice coverage: No assessed notice coverage is available. Notice completeness and legal adequacy are unassessed.
Named notice and rights links: No confirmed destination error retained; other links and collection points may be unassessed.

Business coverage, legally defined sale/sharing and permitted alternative methods require review. Unassessed checks do not establish compliance.

Do Not Sell/Share: No retained evidence; absence was not verified.
Privacy choices: No retained evidence; absence was not verified.
Cookie settings: No retained evidence; absence was not verified.

Notice topics found

5 topics located · Linked from the scanned page

Sale/sharing · Collection/purposes · Retention · Privacy rights · Opt-out methods

View retained passages

Sale/sharing

t, purchase, form submission or authentication data is collected by the page. Advertising, sale and sharing The test sends an advertising request to Meta and measurement or replay requests to Google Analytics, Microsoft Clarity, Hotjar, FullStory and Mixpanel before a choice. These are intentional signals for review of targeted advertising and possible sale or sharing. The test does not itself reach a legal conclusion about any individual request. Global Privacy Control When

Collection/purposes

asurement endpoints. With GPC, it sets five of those cookies and omits the advertising request. The purposes in this test are audience measurement, advertising signal classification, replay detection and product-event measurement. No account, purchase, form submission or authentication data is collected by the page. Advertising, sale and sharing The test sends an advertising request to Meta and measurement or replay requests to Google Analytics, Microsoft Clarity, Hotjar, Ful

Retention

ves links and notice passages; it does not verify these manual actions in an ordinary passive scan. Retention and privacy rights First-party test cookies expire after 15 minutes and saved manual-choice markers after 24 hours. This page makes no statement about providers' separate retention. The canary does not process real requests to access, delete, correct, or obtain a copy of personal information; the test controls should not be treated as such a process. Notice at Collect

Privacy rights

notice passages; it does not verify these manual actions in an ordinary passive scan. Retention and privacy rights First-party test cookies expire after 15 minutes and saved manual-choice markers after 24 hours. This page makes no statement about providers' separate retention. The canary does not process real requests to access, delete, correct, or obtain a copy of personal information; the test controls should not be treated as such a process. Notice at Collection · Cookie P

Evidence scope

This passive scan verifies visible links, retained destinations, and located notice topics. It does not submit opt-out choices or determine whether the notice is complete.

Evidence provenance

Captured 2026-09-28T15:36:43.231Z · Source SHA-256: 66a2163f8c183a0c3dd5299f5598b8ca0aca719437b6bfc742c8b4abdc666fa1

Connection security

5 checks · 1 limited

Limited

HTTPS deliveryObservedThe scanned page used HTTPS.

JSON evidence

ref_transport_security

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "transport_security_https_delivery",
  "coverageArea": "HTTPS delivery for scanned pages",
  "evidenceState": "observed",
  "explanation": "Whether the retained scanned page was served over HTTPS.",
  "note": "Whether the retained scanned page was served over HTTPS.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.transport_security_https_delivery.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.transport_security_https_delivery"
  },
  "statusBasis": "The scanned page was served over HTTPS in the retained transport observation.",
  "retainedEvidence": {
    "finalUrl": "https://ergoveritas.com/test2.html",
    "finalScheme": "https",
    "evidenceRefs": [
      "ref_transport_security"
    ],
    "httpProbeStatus": 200,
    "sampledPageUrls": [
      "https://ergoveritas.com/test2.html"
    ],
    "httpProbeOutcome": "redirected_to_https",
    "httpProbeFinalUrl": "https://ergoveritas.com/",
    "pageHttpsObserved": true,
    "tlsProbeAttempted": true,
    "formTransportCount": 0,
    "httpProbeAttempted": true,
    "validTlsCertificate": true,
    "httpProbeFinalScheme": "https",
    "httpRedirectsToHttps": true,
    "mixedContentObserved": false,
    "missingEvidenceNeeded": [],
    "httpProbeRedirectChain": [
      "http://ergoveritas.com/",
      "https://ergoveritas.com/"
    ],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "selectedEvidenceStrength": "moderate",
    "mixedContentObservedCount": 0,
    "selectedEvidenceArtifactId": "coverage_policy",
    "tlsCertificateObservations": [
      {
        "issuer": "CN=Amazon RSA 2048 M04, O=Amazon",
        "subject": "CN=ergoveritas.com",
        "validTo": "Feb 19 23:59:59 2027 GMT",
        "inputUrl": "https://ergoveritas.com/",
        "validFrom": "Aug  6 00:00:00 2026 GMT",
        "validCertificate": true,
        "chainCertificateCount": 4
      }
    ],
    "insecureFormTransportObserved": false
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

HTTPS certificateObservedThe website's HTTPS certificate passed validation.

JSON evidence

ref_transport_security

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "transport_security_tls_certificate",
  "coverageArea": "Valid SSL/TLS certificate",
  "evidenceState": "observed",
  "explanation": "Whether a strict TLS probe verified the HTTPS origin certificate separately from the normal scanner runtime.",
  "note": "Whether a strict TLS probe verified the HTTPS origin certificate separately from the normal scanner runtime.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.transport_security_tls_certificate.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.transport_security_tls_certificate"
  },
  "statusBasis": "Retained certificate validation verified the HTTPS origin certificate. Retained certificate evidence: https://ergoveritas.com/ presented CN=ergoveritas.com certificate valid Aug 6, 2026–Feb 19, 2027.",
  "retainedEvidence": {
    "finalUrl": "https://ergoveritas.com/test2.html",
    "finalScheme": "https",
    "evidenceRefs": [
      "ref_transport_security"
    ],
    "httpProbeStatus": 200,
    "sampledPageUrls": [
      "https://ergoveritas.com/test2.html"
    ],
    "httpProbeOutcome": "redirected_to_https",
    "httpProbeFinalUrl": "https://ergoveritas.com/",
    "pageHttpsObserved": true,
    "tlsProbeAttempted": true,
    "formTransportCount": 0,
    "httpProbeAttempted": true,
    "validTlsCertificate": true,
    "httpProbeFinalScheme": "https",
    "httpRedirectsToHttps": true,
    "mixedContentObserved": false,
    "missingEvidenceNeeded": [],
    "httpProbeRedirectChain": [
      "http://ergoveritas.com/",
      "https://ergoveritas.com/"
    ],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "selectedEvidenceStrength": "moderate",
    "mixedContentObservedCount": 0,
    "selectedEvidenceArtifactId": "coverage_policy",
    "tlsCertificateObservations": [
      {
        "issuer": "CN=Amazon RSA 2048 M04, O=Amazon",
        "subject": "CN=ergoveritas.com",
        "validTo": "Feb 19 23:59:59 2027 GMT",
        "inputUrl": "https://ergoveritas.com/",
        "validFrom": "Aug  6 00:00:00 2026 GMT",
        "validCertificate": true,
        "chainCertificateCount": 4
      }
    ],
    "insecureFormTransportObserved": false
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

HTTP-to-HTTPS redirectObservedHTTP redirected to HTTPS.

JSON evidence

ref_transport_security

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "transport_security_http_redirect",
  "coverageArea": "HTTP redirects to HTTPS",
  "evidenceState": "observed",
  "explanation": "Whether an explicit HTTP-origin probe redirected to HTTPS.",
  "note": "Whether an explicit HTTP-origin probe redirected to HTTPS.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.transport_security_http_redirect.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.transport_security_http_redirect"
  },
  "statusBasis": "The explicit HTTP-origin probe redirected to HTTPS.",
  "retainedEvidence": {
    "finalUrl": "https://ergoveritas.com/test2.html",
    "finalScheme": "https",
    "evidenceRefs": [
      "ref_transport_security"
    ],
    "httpProbeStatus": 200,
    "sampledPageUrls": [
      "https://ergoveritas.com/test2.html"
    ],
    "httpProbeOutcome": "redirected_to_https",
    "httpProbeFinalUrl": "https://ergoveritas.com/",
    "pageHttpsObserved": true,
    "tlsProbeAttempted": true,
    "formTransportCount": 0,
    "httpProbeAttempted": true,
    "validTlsCertificate": true,
    "httpProbeFinalScheme": "https",
    "httpRedirectsToHttps": true,
    "mixedContentObserved": false,
    "missingEvidenceNeeded": [],
    "httpProbeRedirectChain": [
      "http://ergoveritas.com/",
      "https://ergoveritas.com/"
    ],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "selectedEvidenceStrength": "moderate",
    "mixedContentObservedCount": 0,
    "selectedEvidenceArtifactId": "coverage_policy",
    "tlsCertificateObservations": [
      {
        "issuer": "CN=Amazon RSA 2048 M04, O=Amazon",
        "subject": "CN=ergoveritas.com",
        "validTo": "Feb 19 23:59:59 2027 GMT",
        "inputUrl": "https://ergoveritas.com/",
        "validFrom": "Aug  6 00:00:00 2026 GMT",
        "validCertificate": true,
        "chainCertificateCount": 4
      }
    ],
    "insecureFormTransportObserved": false
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Mixed contentObservedNo insecure HTTP resources were found on the scanned HTTPS page.

JSON evidence

ref_transport_security

Full evidence JSON

{
  "assessmentStatus": "checked",
  "checklistItemId": "transport_security_mixed_content",
  "coverageArea": "Mixed content",
  "evidenceState": "observed",
  "explanation": "Whether HTTP subresources were observed or blocked on a retained HTTPS page.",
  "note": "Whether HTTP subresources were observed or blocked on a retained HTTPS page.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.transport_security_mixed_content.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.transport_security_mixed_content"
  },
  "statusBasis": "No mixed-content HTTP subresources were retained for the scanned HTTPS page.",
  "retainedEvidence": {
    "finalUrl": "https://ergoveritas.com/test2.html",
    "finalScheme": "https",
    "evidenceRefs": [
      "ref_transport_security"
    ],
    "httpProbeStatus": 200,
    "sampledPageUrls": [
      "https://ergoveritas.com/test2.html"
    ],
    "httpProbeOutcome": "redirected_to_https",
    "httpProbeFinalUrl": "https://ergoveritas.com/",
    "pageHttpsObserved": true,
    "tlsProbeAttempted": true,
    "formTransportCount": 0,
    "httpProbeAttempted": true,
    "validTlsCertificate": true,
    "httpProbeFinalScheme": "https",
    "httpRedirectsToHttps": true,
    "mixedContentObserved": false,
    "missingEvidenceNeeded": [],
    "httpProbeRedirectChain": [
      "http://ergoveritas.com/",
      "https://ergoveritas.com/"
    ],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "selectedEvidenceStrength": "moderate",
    "mixedContentObservedCount": 0,
    "selectedEvidenceArtifactId": "coverage_policy",
    "tlsCertificateObservations": [
      {
        "issuer": "CN=Amazon RSA 2048 M04, O=Amazon",
        "subject": "CN=ergoveritas.com",
        "validTo": "Feb 19 23:59:59 2027 GMT",
        "inputUrl": "https://ergoveritas.com/",
        "validFrom": "Aug  6 00:00:00 2026 GMT",
        "validCertificate": true,
        "chainCertificateCount": 4
      }
    ],
    "insecureFormTransportObserved": false
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

Form transport securityLimitedCould not be fully evaluated using source-signal coverage evidence; Missing or incomplete source signal: expected typed transport security observation; retained missing.

JSON evidence

ref_transport_security

Full evidence JSON

{
  "assessmentStatus": "coverage_limitation",
  "checklistItemId": "transport_security_form_transport",
  "coverageArea": "Observed form transport",
  "evidenceState": "not_testable",
  "explanation": "Whether observed forms resolved to HTTPS transport without submitting form data.",
  "note": "Whether observed forms resolved to HTTPS transport without submitting form data.",
  "status": "Not testable",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.transport_security_form_transport.not_testable",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.transport_security_form_transport"
  },
  "statusBasis": "No forms were observed on the assessed page; form transport was not assessed. Forms found on other pages are outside this check.",
  "retainedEvidence": {
    "finalUrl": "https://ergoveritas.com/test2.html",
    "finalScheme": "https",
    "evidenceRefs": [
      "ref_transport_security"
    ],
    "httpProbeStatus": 200,
    "sampledPageUrls": [
      "https://ergoveritas.com/test2.html"
    ],
    "httpProbeOutcome": "redirected_to_https",
    "httpProbeFinalUrl": "https://ergoveritas.com/",
    "pageHttpsObserved": true,
    "tlsProbeAttempted": true,
    "formTransportCount": 0,
    "httpProbeAttempted": true,
    "validTlsCertificate": true,
    "httpProbeFinalScheme": "https",
    "httpRedirectsToHttps": true,
    "mixedContentObserved": false,
    "missingEvidenceNeeded": [
      "runtimeArtifacts.transportSecuritySummary.transport_security_form_transport: Required to evaluate this transport-security checklist row from retained scanner evidence rather than URL display inference."
    ],
    "httpProbeRedirectChain": [
      "http://ergoveritas.com/",
      "https://ergoveritas.com/"
    ],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "selectedEvidenceStrength": "limited",
    "mixedContentObservedCount": 0,
    "selectedEvidenceArtifactId": "coverage_policy",
    "tlsCertificateObservations": [
      {
        "issuer": "CN=Amazon RSA 2048 M04, O=Amazon",
        "subject": "CN=ergoveritas.com",
        "validTo": "Feb 19 23:59:59 2027 GMT",
        "inputUrl": "https://ergoveritas.com/",
        "validFrom": "Aug  6 00:00:00 2026 GMT",
        "validCertificate": true,
        "chainCertificateCount": 4
      }
    ],
    "insecureFormTransportObserved": false
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": [
    {
      "field": "runtimeArtifacts.transportSecuritySummary.transport_security_form_transport",
      "actual": "missing",
      "source": "scanner",
      "expected": "typed transport security observation",
      "whyNeeded": "Required to evaluate this transport-security checklist row from retained scanner evidence rather than URL display inference."
    }
  ]
}

Correction steps

1The scan could not fully evaluate Observed form transport, so improve access to the relevant page or feature before treating this as a confirmed issue.
2Resolve any blocked or unavailable page or path noted in the evidence details.
3Confirm the relevant page, policy, or user-choice control is reachable without authentication or bot challenge.
4Rerun the scan with the same location and settings so the result can be compared consistently.
5Keep a short internal record of what changed so the next scan can be compared with the same page and settings.

Global Privacy Control

GPC signal observed · 0.25-second matched comparison

Retained GPC request sample: 5 classified tracking requests, including 5 collection requests.

GPC signal: Observed on the page request and in the browser
0.25-second matched comparison: Over the same 0.25-second interval after page commit, advertising/marketing requests: 1 without GPC and 0 with GPC; analytics/replay requests: 5 without GPC and 5 with GPC.

Comparison with GPC disabledOver the same 0.25-second interval after page commit, advertising/marketing requests: 1 without GPC and 0 with GPC; analytics/replay requests: 5 without GPC and 5 with GPC.

Baseline → GPC

First 250 ms after each document commit

Observed requests	Baseline	GPC
Advertising / marketing	1	0
Analytics / session replay	5	5

How we measured this

Page request: Sec-GPC 1; browser setting: true.

7 retained request attempts; 7 retained requests with Sec-GPC.

Over the same 0.25-second interval after page commit, advertising/marketing requests: 1 without GPC and 0 with GPC; analytics/replay requests: 5 without GPC and 5 with GPC.

JSON evidence

{
  "assessment": {
    "contractVersion": "certscore.gpc-response-assessment.v3",
    "generatedAt": "2026-09-28T15:36:43.165Z",
    "status": "responsive",
    "findingTitle": "GPC response",
    "scoreEffect": "none",
    "legalInterpretation": "not_assessed",
    "comparison": {
      "comparable": true,
      "protocol": "passive_baseline_with_sec_gpc",
      "baselineArtifact": {
        "lane": "runtime_evidence",
        "sha256": "f472fbc988d49d8a716e0a656eeaed9af188a7e55d6fc9726d48b9e475dad2d0",
        "sizeBytes": 156648,
        "uri": "s3://certscore-v2-dag-local-artifacts-us-west-1-199536052647/v2-dag-lambda/local/d96df06d-3e94-4896-8346-1a026d68e5af/lanes/runtime_evidence/CanonicalEvidenceBundle.json"
      },
      "gpcArtifact": {
        "lane": "gpc_observation",
        "sha256": "d675f93158852f88e5e53235c518a9151e6982429cea41a0261813c8c22ab276",
        "sizeBytes": 141827,
        "uri": "s3://certscore-v2-dag-local-artifacts-us-west-1-199536052647/v2-dag-lambda/local/d96df06d-3e94-4896-8346-1a026d68e5af/lanes/gpc_observation/CanonicalEvidenceBundle.json"
      },
      "enabledProof": {
        "secGpcHeaderValue": "1",
        "requestsWithSecGpc": 7,
        "requestEventIds": [
          "net_3526",
          "net_3529",
          "net_3531",
          "net_3533",
          "net_3535",
          "net_3537",
          "net_3539"
        ],
        "navigatorGlobalPrivacyControl": true
      },
      "delivery": {
        "status": "verified",
        "baseline": {
          "contractVersion": "certscore.gpc-signal-observation.v1",
          "expectedEnabled": false,
          "documentUrlSha256": "18cdedee5291cd5f35b5826bca5bc5c9103756d7de8805c6da0bd0de04ee8842",
          "contextConfigSha256": "730f200f9648288291224b325abda4b076945e5d951282ddab38e20d41d544eb",
          "capturedAtMs": 1179,
          "documentStartedAtMs": 605,
          "frameCount": 1,
          "frames": [
            {
              "documentUrlSha256": "18cdedee5291cd5f35b5826bca5bc5c9103756d7de8805c6da0bd0de04ee8842",
              "mainFrame": true,
              "navigatorValue": false
            }
          ],
          "workerCount": 0,
          "limitationKeys": []
        },
        "gpc": {
          "contractVersion": "certscore.gpc-signal-observation.v1",
          "expectedEnabled": true,
          "documentUrlSha256": "18cdedee5291cd5f35b5826bca5bc5c9103756d7de8805c6da0bd0de04ee8842",
          "contextConfigSha256": "730f200f9648288291224b325abda4b076945e5d951282ddab38e20d41d544eb",
          "prototypeCaptureBinding": {
            "captureId": "b68c1706-7ae9-4228-9def-380ad880ed8e",
            "documentIdentitySource": "cdp_loader_id",
            "documentToken": "E9FD82743FBD1F8DCC8862F1472D1B95"
          },
          "prototypeSessionSha256": "566dc2345dd777d8217a15f9acd704b927d867dfac9e86f46a3e6cd31d15eef2",
          "capturedAtMs": 1059,
          "documentStartedAtMs": 559,
          "frameCount": 1,
          "frames": [
            {
              "documentUrlSha256": "18cdedee5291cd5f35b5826bca5bc5c9103756d7de8805c6da0bd0de04ee8842",
              "mainFrame": true,
              "navigatorValue": true
            }
          ],
          "workerCount": 0,
          "limitationKeys": []
        }
      },
      "coverage": {
        "status": "complete",
        "comparedThroughMs": 500
      },
      "responseBasis": "qualified_activity_reduction",
      "deltas": {
        "cookies": {
          "baselineCount": 7,
          "gpcCount": 6,
          "countDelta": -1,
          "baselineOnly": [
            "[\"_fbc\",\"ergoveritas.com\",\"/\"]"
          ],
          "gpcOnly": [],
          "shared": [
            "[\"_clsk\",\"ergoveritas.com\",\"/\"]",
            "[\"_ga_TEST2\",\"ergoveritas.com\",\"/\"]",
            "[\"_gat_TEST2\",\"ergoveritas.com\",\"/\"]",
            "[\"ajs_anonymous_id\",\"ergoveritas.com\",\"/\"]",
            "[\"mp_test2_mixpanel\",\"ergoveritas.com\",\"/\"]",
            "[\"OptanonConsent\",\"ergoveritas.com\",\"/\"]"
          ],
          "baselineOnlyCount": 1,
          "gpcOnlyCount": 0,
          "sharedCount": 6,
          "samplesTruncated": false
        },
        "webStorage": {
          "baselineCount": 3,
          "gpcCount": 3,
          "countDelta": 0,
          "baselineOnly": [],
          "gpcOnly": [],
          "shared": [
            "https://ergoveritas.com|localStorage|certscore_test2_analytics",
            "https://ergoveritas.com|localStorage|certscore_test2_consent_state",
            "https://ergoveritas.com|sessionStorage|certscore_test2_session_replay"
          ],
          "baselineOnlyCount": 0,
          "gpcOnlyCount": 0,
          "sharedCount": 3,
          "samplesTruncated": false
        },
        "trackers": {
          "baselineCount": 9,
          "gpcCount": 7,
          "countDelta": -2,
          "baselineOnly": [
            "Meta|Meta Pixel|advertising",
            "Meta|Meta|advertising"
          ],
          "gpcOnly": [],
          "shared": [
            "FullStory|FullStory|session_replay",
            "Google|Google Analytics|analytics",
            "Google|Google|analytics",
            "Hotjar|Hotjar|session_replay",
            "Microsoft|Microsoft Clarity|session_replay",
            "Microsoft|Microsoft|session_replay",
            "Mixpanel|Mixpanel|analytics"
          ],
          "baselineOnlyCount": 2,
          "gpcOnlyCount": 0,
          "sharedCount": 7,
          "samplesTruncated": false
        },
        "advertisingOrMeasurementActivity": {
          "baselineCount": 9,
          "gpcCount": 7,
          "countDelta": -2,
          "baselineOnly": [
            "Meta|Meta Pixel|advertising",
            "Meta|Meta|advertising"
          ],
          "gpcOnly": [],
          "shared": [
            "FullStory|FullStory|session_replay",
            "Google|Google Analytics|analytics",
            "Google|Google|analytics",
            "Hotjar|Hotjar|session_replay",
            "Microsoft|Microsoft Clarity|session_replay",
            "Microsoft|Microsoft|session_replay",
            "Mixpanel|Mixpanel|analytics"
          ],
          "baselineOnlyCount": 2,
          "gpcOnlyCount": 0,
          "sharedCount": 7,
          "samplesTruncated": false
        },
        "advertisingOrMarketingActivity": {
          "baselineCount": 2,
          "gpcCount": 0,
          "countDelta": -2,
          "baselineOnly": [
            "Meta|Meta Pixel|advertising",
            "Meta|Meta|advertising"
          ],
          "gpcOnly": [],
          "shared": [],
          "baselineOnlyCount": 2,
          "gpcOnlyCount": 0,
          "sharedCount": 0,
          "samplesTruncated": false
        },
        "consentOrCmpBehavior": {
          "baselineCount": 0,
          "gpcCount": 0,
          "countDelta": 0,
          "baselineOnly": [],
          "gpcOnly": [],
          "shared": [],
          "baselineOnlyCount": 0,
          "gpcOnlyCount": 0,
          "sharedCount": 0,
          "samplesTruncated": false
        }
      },
      "evidenceRefs": [
        "net_3526",
        "net_3529",
        "net_3531",
        "net_3533",
        "net_3535",
        "net_3537",
        "net_3539",
        "s3://certscore-v2-dag-local-artifacts-us-west-1-199536052647/v2-dag-lambda/local/d96df06d-3e94-4896-8346-1a026d68e5af/lanes/gpc_observation/CanonicalEvidenceBundle.json",
        "s3://certscore-v2-dag-local-artifacts-us-west-1-199536052647/v2-dag-lambda/local/d96df06d-3e94-4896-8346-1a026d68e5af/lanes/runtime_evidence/CanonicalEvidenceBundle.json"
      ],
      "limitationKeys": []
    },
    "observation": {
      "contractVersion": "certscore.gpc-bounded-observation.v1",
      "scope": "main_document_and_retained_http_requests",
      "status": "complete",
      "sourceSha256": "d675f93158852f88e5e53235c518a9151e6982429cea41a0261813c8c22ab276",
      "sessionSha256": "566dc2345dd777d8217a15f9acd704b927d867dfac9e86f46a3e6cd31d15eef2",
      "documentUrlSha256": "18cdedee5291cd5f35b5826bca5bc5c9103756d7de8805c6da0bd0de04ee8842",
      "delivery": {
        "httpHeaderRetained": true,
        "mainNavigatorReadbackRetained": true,
        "fullContextVerified": true
      },
      "semanticProbe": "unavailable",
      "registration": {
        "basis": "current_recorded_state",
        "sale": "unknown",
        "sharing": "unknown",
        "cmpGpcSignal": "unknown",
        "causedByGpc": "not_established"
      },
      "acknowledgment": {
        "observed": false,
        "captureComplete": true
      },
      "requests": {
        "count": 7,
        "blockedBeforeTransmissionCount": 0,
        "complete": true,
        "fromMs": 518,
        "documentCommittedAtMs": 610,
        "throughMs": 1064,
        "classifiedCount": 5,
        "collectionCount": 5,
        "evidenceIds": [
          "net_3529",
          "net_3531",
          "net_3533",
          "net_3535",
          "net_3537"
        ],
        "samplesTruncated": false
      },
      "limitationKeys": [],
      "scoreEffect": "none",
      "legalInterpretation": "not_assessed"
    }
  },
  "evidenceRefs": [
    "s3://certscore-v2-dag-local-artifacts-us-west-1-199536052647/v2-dag-lambda/local/d96df06d-3e94-4896-8346-1a026d68e5af/lanes/runtime_evidence/CanonicalEvidenceBundle.json",
    "s3://certscore-v2-dag-local-artifacts-us-west-1-199536052647/v2-dag-lambda/local/d96df06d-3e94-4896-8346-1a026d68e5af/lanes/gpc_observation/CanonicalEvidenceBundle.json",
    "net_3526",
    "net_3529",
    "net_3531",
    "net_3533",
    "net_3535",
    "net_3537",
    "net_3539"
  ]
}

Loading report

Executive overview

Assessment highlights

Top issues on this page

Pre-consent page event timeline

Services & Resources

Type mix

Evidence mix

Purpose mix

Site relationship

Policy disclosure · Mentioned

Policy disclosure · Mentioned

Policy disclosure · Mentioned

Policy disclosure · Mentioned

Policy disclosure · Mentioned

Policy disclosure · Mentioned

Policy disclosure · Not found

Policy disclosure · Not found

Forms & fields

Detailed evidence

Baseline → GPC

CMP details

Consent management audit · 13 criteria

Consent choices

Tracking & embeds

Policies & disclosures

Cookies & tracking

California privacy review

Choice and request inspection

Notice topics found

Connection security

Global Privacy Control

Baseline → GPC