One page load, before any choice

1What we load

• The homepage, over HTTPS. Plain HTTP only if HTTPS fails, and we say so. Redirects are followed within the same site (the name with and without “www”).
• If the homepage shows a WooCommerce or Shopify shop, one product page as well: the first product link on the homepage.
• Each page gets a new, empty browser: no cookies, no cache, no history. A first visit.
• A desktop browser (Chromium), 1366 × 768, language English. Third-party cookies are allowed, as in a default desktop Chrome.
• Nothing is clicked, scrolled or filled in. A cookie banner stays untouched: we neither accept nor refuse on anyone’s behalf.
• The load ends 3 seconds after the page and its scripts have gone quiet, or at a limit: 30 seconds, 300 requests or 20 MB. At a limit, the result is marked “capped” and counts read “at least”.

2What we write down

• Cookies: every cookie in the browser at the end, for any domain: name, domain, path, lifetime, first or third party, whether a server header or a script set it, and its Secure, HttpOnly and SameSite attributes.
• Local and session storage: the key names, per origin.
• Requests: every host the page contacted.
• Consent tools: known tools are recognised from their scripts and markup. We also read which scripts and embeds a tool has parked in the page for later, and the category the site gave them. Those are “held back”, not loaded.

Values are never read or stored. Not of cookies, and not of storage keys. Names and attributes are enough to label an item.

3The three labels

usually needs consent

The Open Cookie Database lists the name as Analytics, Marketing or Personalization. Or the item is tied to a tracker on the EasyPrivacy list: a cookie or storage key for such a host or written by such a script, or a plain request to it. Requests count even without a cookie, because the EU rule covers reading from or writing to the device, not only cookies.

usually exempt

Listed as Necessary, Security or Functional, and not tied to a tracker. A consent tool’s own record of the visitor’s choice belongs here, and so does the basic storage of common platforms themselves, such as session, cart and display settings (from a short list of our own).

unknown

In neither source. We show what we know (name, party, lifetime) so the owner can find out what it is for.

Every label says “usually” because these are general rules. Whether a particular item needs consent depends on what it is used for, which a page load cannot see.

Outside hosts that are not on the tracker list (a font or script host, for example) are listed without a label. Assessing those is outside what this tool does.

4Which rules

The baseline is the EU/EEA rule on storing or reading information on a visitor’s device. Where the UK differs we add a note: since 5 February 2026, analytics used only to improve a site, in aggregate, no longer needs consent in the UK, but visitors must still be told and be able to opt out. No other country’s rules are applied.

5Limits worth knowing

• It is one page load, on one date. Sites can serve different things to different visitors, places and crawlers. The result is what was served to ours.
• We do not test what happens after a choice is made in a banner, and we load one or two pages, not the whole site.
• A site we could not load has no result. That is shown as “unable to check”, never as zero, and the last result that did load stays in place.
• “First party” means the site’s own name and its subdomains. Trackers are whatever the list names; a tracker that is on no list is not flagged.

This is general information, not legal advice. A findings page is not a judgement of the business behind a site.

6Data sources and credit

• Open Cookie Database by Jack Kwakman and contributors, Apache License 2.0. Snapshot 2026-11-12-778633556646.
• EasyPrivacy by the EasyList authors (easylist.to), used under the Creative Commons Attribution-ShareAlike 3.0 licence. Snapshot 202611120725.

Both are pinned snapshots, updated on purpose and never mid-check. The rule set version (2026.11.1) and both data versions are stored with every check and shown at the foot of each findings page.

7Weekly re-checks and the list

A site is loaded again every week while our badge is on it. The findings list shows the sites that currently carry the badge. Take the badge away and the re-checks stop and the entry leaves the list. Each load counts as one visit in a site’s own statistics, which is one reason we keep them to once a week.