Every check the scanner runs, and what each one is testing

Ten domains, and why those ten carry different weight

The checks are grouped into ten domains and the domains are not equal. A missing privacy notice is a different order of failure from a missing data-localisation statement, and a score that treated them the same would be useless for deciding what to fix first.

• Privacy Notice — 20%. §5 and Rule 3.
• Cookie Consent & Banner — 15%. §6, including §6(4) on withdrawal.
• Consent Mechanism — 15%. §6.
• Forms & Data Collection — 12%. §5 and §6.
• Data Principal Rights — 12%. §11 to §14.
• Third-Party Trackers — 10%. §6 and §9.
• SSL / TLS Security — 5%. §8(4) and the CERT-In directions.
• Children's Data Signals — 5%. §9.
• DPO / Grievance Contact — 4%. §8(9), §8(10) and §13.
• Cross-Border Transfer — 2%. §16.

Privacy notice — eight checks

The heaviest domain, because everything else assumes a notice exists. The checks test that a privacy link is present and reachable from the home page, that the page is publicly accessible without a login, that it identifies the Data Fiduciary by name, that it states the categories of personal data collected and the purposes of processing, that it describes the rights available to a data principal, that it carries a data protection or grievance contact, and that a regional-language version is offered.

The regional-language check is the one that fails most often on otherwise decent sites, and it is the one with a specific Indian obligation behind it rather than an inherited European habit.

Cookie banner and consent mechanism — thirteen checks across two domains

The banner domain tests presence of a banner at all, a reachable cookie policy page, whether cookies are set before any consent is recorded, whether trackers are actually blocked before consent rather than merely declared, whether granular per-category preferences exist, whether a reject option is offered with the same prominence as accept, whether any box arrives pre-ticked, and whether a withdrawal mechanism is published.

The consent-mechanism domain is about quality rather than presence: whether the consent identifies who is collecting, whether purposes are specific rather than bundled, whether marketing consent is separated from operational consent, whether a consent wall blocks the site until you agree, and whether the interface uses dark patterns — the visual asymmetry that makes accept a button and reject a grey link.

Pre-ticked boxes, bundled purposes and a consent wall are the three that most reliably invalidate consent under §6 rather than merely weakening it.

Forms, rights and the grievance contact — fifteen checks

Forms are tested where they are found: whether a consent checkbox is present at the point of collection, whether the purpose is stated at the form rather than only in the notice, whether a privacy link sits near the form, whether newsletter signup is a separate opt-in, whether the fields collected look proportionate to the stated purpose, and whether payment forms handle card data appropriately.

The rights domain tests whether the site publishes the right to access, the right to correction, the right to erasure, the right to nominate, a grievance or complaint route, and a response timeline for any of it. The DPO and grievance domain tests for a named grievance officer, a contact email that is not a generic sales address, and whether the site tells a person they may escalate to the Data Protection Board.

Trackers, TLS, children and transfers — the remaining twenty

The tracker domain is the one that needs a real network trace rather than a text search. It counts third-party hosts contacted, identifies analytics and advertising tags firing before consent, looks for session recording, fingerprinting scripts and social pixels, checks whether Google Consent Mode is configured, and distinguishes a content delivery network from a tracker so a font host is not reported as a privacy failure.

TLS checks HTTPS availability, certificate validity, whether plain HTTP redirects, whether HSTS is set and whether the common security headers are present. The children's domain looks for an age gate, for parental-consent language, for tracking on pages aimed at minors and for advertising targeting on them. The cross-border domain identifies non-Indian third-party hosts, then tests whether the notice discloses transfers at all, whether a transfer mechanism is named, and whether a data-localisation statement is made — relevant mainly to regulated sectors.

Five severities and five bands

Each finding carries a severity — critical, high, medium, low or informational — and a signed point impact, so a failure costs the domain points and a pass earns them. Domain scores roll up into a weighted overall score, and that score maps to one of five bands: Compliant at 85 and above, Largely Compliant from 70, Partially Compliant from 50, Non-Compliant from 25, and Critical Risk below that.

The report also computes what you would get back. Failed and partial checks are ranked by the weighted points recoverable, each with a running projection of the score if you fixed that item and everything above it — and the projection is produced by re-scoring with those checks flipped rather than by estimating. /methodology carries the weighting model itself.

What a scan cannot see, and why that is a design choice

The crawler is an HTTP client, not a headless browser. It fetches and parses; it does not execute JavaScript or drive a rendering engine. The trade is deliberate — no Chromium on the worker, no per-scan browser cost — and the consequence is that checks which strictly need a real browser report as not applicable rather than guessing. A cookie set only after a client-side script runs may be missed.

The other limits are of the same kind. It visits up to ten pages from the home page, following links that look privacy-relevant. It honours robots.txt. It waits between requests rather than hammering the origin, and it gives up on a page that does not answer within a few seconds. It cannot see anything behind a login, anything that only appears to visitors from a particular geography, or anything your server does with the data after it has it.

Which means a perfect score is evidence that your public surfaces look right, not evidence that you are compliant. The readiness assessment is the instrument for the part a crawler cannot reach.