What a site actually does with data, beyond the text on the banner.

No. It is a technical measurement of the site's public surface, with evidence and with the limits of each finding stated. Many of the law's obligations — the basis for processing, contracts with processors, the record of processing activities, the impact assessment, informing employees — cannot be observed from outside and do not appear in the report. The score is not a legal opinion and it does not calculate any fine.

The scanner finds the banner, presses the reject button, and listens to network requests for three more seconds. A tracker is flagged only if it was already firing before consent and carries on after the refusal, with no denial signal in the request. It is the only check in the engine that needs a live, interactive browser rather than a static snapshot of the page — and it is the reason a scan takes seconds rather than milliseconds.

No. The engine is deterministic: the same inputs give the same score, and every weight and every threshold sits in a single constants file, not scattered through the code. There is an assistant that explains the report to you, and that one is a language model — but it recomputes nothing, and if it cites an article we cannot confirm in the text of the law, its answer is not shown.

No. It means the public surface that was tested behaves well in the scenarios that were tested. An organisation can have a flawless site and no record of processing activities at all. It works better the other way round: a poor score almost certainly points to a real problem, because the checks that cut deepest — trackers before consent, a refusal that stops nothing — describe something happening right now to every visitor.

It is a single visit, like an ordinary visitor's, with a maximum budget of 45 seconds. The user agent identifies itself and points to the page explaining the scan and how to opt out, and the site's robots.txt is honoured by default. No forms are submitted, no accounts are created, and no sign-in is attempted.

A banner hidden inside a closed shadow root stays invisible by construction — we declare it, and we have a test that holds us to our word. Nor do we see what happens after sign-in, what the server does with the data from a submitted form, where that data goes next, or what the contracts provide for. The report states what it was able to observe and what it was not, and when the page did not render properly it withholds the verdict rather than inventing one.

There is a registry of the 90 articles of Law no. 195/2024, carrying the MD5 fingerprint of the source document. An article that is not in the registry is not printed. And if a text attributes a reference to another instrument — Regulation (EU) 2016/679, say — it is recognised as such, not declared invented. The two errors are not symmetrical: a true citation wrongly rejected simply disappears, with nothing left looking broken.

195/2024, since 23 August 2026. The code does not assume this, it computes it from the date of the scan: before that date, 133/2011 was the one in force and 195/2024 was reported as something to prepare for; afterwards, the other way round. An older report therefore stays readable under its own regime, without pretending it once said something else.