Regulatory Evidence: Overview
The accessibility scan asks whether your site can be used. The compliance check asks a different question: whether the things the law requires you to publish are actually there, and whether your cookie banner does what it claims. It is currently in Beta.
What it actually does
A run has two halves, and keeping them apart is the whole design.
A collector opens your site in a real browser and writes down facts. Which cookies existed before anyone clicked anything. Which third-party requests fired. Whether a banner appeared, and whether it offered a reject button on the first layer or hid one behind a settings screen. What happened after the reject button was clicked. What text sits on your legal pages.
A check engine then reads those facts and produces findings. It never touches a browser. That separation is not tidiness — it means the legal logic is ordinary testable code, which is the only way rules about statutes get verified rather than assumed.
The consequence worth understanding: a finding is always traceable to something observed. It is never a guess about your business.
What it will not tell you
It does not say you are compliant. No status in the product says that, and the vocabulary is chosen to make the claim impossible to read into:
| Status | Means |
|---|---|
| Action needed | We looked for a specific named condition and found it |
| Needs review | We saw something that may be a problem but could not confirm it |
| No issue detected | We looked for that condition and did not find it |
| Not evaluated | The check does not apply to your declared markets, or we could not run it |
"No issue detected" is deliberately not "Compliant". A passing automated check means one named condition was absent — not that your site is lawful. The same discipline governs the VPAT feature, which always ships marked DRAFT.
It does not guess your jurisdiction. You declare which markets a site serves; nothing is inferred. Whether GDPR binds you turns on who you target, and whether CCPA binds you turns on revenue and data-volume thresholds — facts we do not have and will not invent. A site with no declared market gets no findings at all, rather than a guessed one.
That matters more than it sounds, because one rule inverts across jurisdictions. In the EU, non-essential cookies are unlawful before consent — opt-in. In California, they are lawful until the visitor objects — opt-out. Running the EU check against a US-only site would produce a confident false accusation. So checks are scoped to markets, and a check with no binding in your markets reports "Not evaluated" instead of a verdict.
Markets
| Market | Covers |
|---|---|
| Germany | German transpositions — TDDDG, DDG, MStV, and the BFSG accessibility statement |
| Other EU / EEA | The EU-wide directives behind those national rules |
| United States — California | CCPA / CPRA, including Global Privacy Control |
California is named as California, not "United States", on purpose. CCPA is state law, and roughly twenty other states differ on exactly what is tested — Colorado requires honouring universal opt-out signals, Utah does not. Calling it "US" would assert a nationwide requirement that does not exist.
The checks
Twenty-four checks across three groups. Which ones run depends on your declared markets.
Consent and tracking — cookies set before consent, embedded content loaded before consent, fonts loaded from third parties, whether rejecting is as easy as accepting, whether rejecting actually stops the tracking, and whether consent can be withdrawn later.
Published information — legal notice reachable and complete, privacy policy linked and complete, whether the privacy policy names the trackers we actually observed, an editorially responsible person where the site declares itself journalistic, withdrawal notice contents, accessibility statement published, encrypted connection, a banner covering the legal notice, and links to the now-closed EU dispute platform.
California — privacy disclosures, request methods, policy update date, notice at collection, the sale/share privacy choice, the sensitive-information choice, and whether a Global Privacy Control signal is honoured.
Every finding that is not a pass carries a citation to the provision it relates to. That is enforced in the database: a verdict without a citation cannot be stored.
Two ways to run it
The free check on the marketing site reviews one representative page, without an account. Use it to see what the check is.
The full check, inside the dashboard, requires a verified site and reviews up to five pages plus your linked legal pages, keeps the evidence, re-checks weekly, and emails you when something that used to pass starts failing.
Running a compliance check covers both in detail — declaring markets, reading a finding, and what to do when the checker cannot reach your site.
Beta, and what that means
The module carries a Beta chip in the interface, and the reason is honest: these are statements about law, generated automatically. Rollout is controlled per-plan from the admin dashboard rather than shipped to everyone at once.
The disclaimer attached to every result says the same thing this page does — automated checks for specific named conditions, general information rather than legal advice, and passing them does not mean your site is compliant. For your own situation, consult a lawyer.