What a site does with data, beyond the banner text.

No. It is a technical measurement of the public surface of the site, with evidence and the limits of each finding. Many obligations under the law — the legal basis for processing, contracts with processors, the processing register, the impact assessment, informing employees — cannot be observed from the outside and do not appear in the report. The score is not a legal opinion and does not calculate any fine.

The scanner finds the banner, clicks the reject button and listens to network requests for another three seconds. A tracker is flagged only if it was already loading before consent and continues after rejection, without a rejection signal in the request. It is the only check in the engine that needs a live, interactive browser, not a static picture of the page — and that is why the scan takes seconds, not milliseconds.

No. The engine is deterministic: the same inputs give the same score, and every weight and every threshold is in a single constants file, not scattered through the code. There is an assistant that explains the report, and that is a language model — but it does not recalculate anything, and if it cites an article that we do not confirm in the text of the law, its answer is not shown.

No. It means the tested public surface behaves well in the tested scenarios. An organisation can have an impeccable website and a non-existent processing register. The reverse works better: a poor score almost certainly shows a real issue, because the checks that cut deepest — trackers before consent, refusal that does not stop anything — describe something that is happening right now to every visitor.

It is a single visit, like that of an ordinary visitor, with a maximum budget of 45 seconds. The user agent identifies itself and links to the page that explains the scan and how to refuse it, and the site’s robots.txt is respected by default. No forms are submitted, no accounts are created and no authentication is attempted.

A banner hidden inside a closed shadow root is invisible by design — we state that and have a test that keeps us to it. We do not see what happens after authentication, what the server does with the data from a submitted form, where it goes next or what the contracts provide. The report says what it could observe and what it could not, and when the page did not render correctly it keeps the verdict instead of inventing one.

There is a register with the 90 articles of Law 195/2024, with the MD5 fingerprint of the source document. An article that is not in the register is not printed. And if a text attributes a reference to another act — for example Regulation (EU) 2016/679 — it is recognised as such, not declared invented. The two errors are not symmetrical: a true citation that is rejected disappears without anything seeming broken.

195/2024, from 23 August 2026. The code does not assume this, it calculates it from the scan date: before that date, 133/2011 was active and 195/2024 was reported as preparation; after, the reverse. An old report thus remains readable in its own regime, without claiming that it said something else.