How a scan works

What browser does a scan use?

• A real Chromium browser running on Cloudflare, with a fresh profile for every visitor: no cookies, no storage, no earlier choices.
• A desktop window of 1280 × 800 pixels by default, or a phone (390 × 844, touch) on Pro and Agency. British English, on Central European time.
• Consent visits run from the EU by default. On paid plans you can choose the EU, the UK or the US for each site. Every report prints the country the visit came from. Some sites show their cookie banner only to visitors from the EU or UK. When we recognise the consent tool but it shows us no banner, the report says so instead of calling the banner missing.
• AI only helps with judgement calls: unusual button wording, alt text, link purpose. Those findings are marked “likely” or “Check by hand”, and never counted as certain.
• Service workers are switched off and every address is checked before it loads, so a scan can never be pointed at a private network.

The vendors we name are on the tracker list. How often we’re right, misses included, is on the accuracy page.

What happens, step by step?

1. 01
   Load the page as a strangerA fresh browser opens your page and waits for it to settle without touching anything. We record every request and cookie with its timing, and match them against more than 40 analytics, advertising and session-replay vendors (the full list is on the tracker page).
2. 02
   Find the consent bannerWe look for the banner on the page, inside frames and inside shadow DOM, and recognise the common consent tools by their markup. Rules read the buttons (accept, reject, settings) in many languages; AI helps only when the wording is unusual.
3. 03
   Click “Reject” and reloadWe click the banner’s own reject button, reload the page and record what still fires. Requests already on their way when we clicked don’t count against you.
4. 04
   Open the preferences as a new visitorA second fresh visitor opens the banner’s settings layer and reads every category before changing anything, to catch options that are switched on by default.
5. 05
   Click “Accept”, then change our mindA third visitor accepts and reloads, so we can read what your Google tags report after consent and how long tracking cookies are set to last. Then it looks for your “Cookie settings” link or consent icon, withdraws through it and records anything that still fires.
6. 06
   Visit with Global Privacy Control onWhen ad trackers load without a choice (no banner, or a US-style “Do not sell or share” link), another visitor comes with GPC switched on. Ad trackers that still load are reported.
7. 07
   Re-read any countdownIf a timer is counting down, another first-time visitor reads it again at least 20 seconds later. A deadline that moves later is a timer that restarts per visitor.
8. 08
   Visit your key pagesWe pick the pages most likely to hold forms, prices and pressure: checkout, signup, pricing, newsletter, product and contact pages. On each we read checkboxes as they load, timers, stock and viewer claims, decline wording, the privacy policy link and, for EU shops, the withdrawal button.
9. 09
   Keep the evidenceScreenshots with the problem outlined, the exact requests and cookies, and the wording we read, so anyone can check our work.

How many pages does a scan test?

Each scan tests key pages in depth, the way a visitor uses them: the cookie banner, consent choices and checkout. Free tests your homepage. Starter tests up to 3 key pages, Pro up to 6, and Agency up to 6. When a scan finds key pages it didn’t open, the report lists them.

A lighter accessibility check covers more of the site with the automatic WCAG rules: 25 pages on Free and 250 per site on Starter, every 30 days, and 500 per site on Pro and Agency, every 7 days.

How does the accessibility check work?

1. 01
   Run the automatic rulesOn every plan, each page we scan is checked with axe-core, an open-source rules engine, limited to the WCAG 2.2 A and AA rules: contrast, alt text, labels, button and link names, page language and title, headings, landmarks and ARIA. Paid plans also check the homepage at phone width.
2. 02
   Use the page like a person (paid plans)We press Tab up to 60 times to catch focus that gets stuck, can’t be seen or hides behind sticky bars and cookie banners. Then we zoom text to 200%, widen the spacing, shrink the screen to 320 pixels, look for motion that won’t stop, open pop-ups and send empty forms. Nothing is ever submitted to your server.
3. 03
   Ask AI about judgment calls (paid plans)An AI model reads alt text next to the image’s file name and nearby words, vague links, headings, labels and the page title. Its findings are marked “likely”, and every quote it gives is checked against the page.
4. 04
   Map all 55 checksPaid plans get a map of all 55 WCAG 2.2 A and AA success criteria, each marked failed, passed, needs review or not tested, with how it was tested. What only a person can judge goes into a guided checklist your team ticks off.

Accessibility gets its own score out of 100, separate from the consent grade. It is worked out over the WCAG criteria we could test, not by counting issues: Level A criteria count 3 and AA criteria 2. A passed criterion earns its full weight; a failed one loses part of it, by its worst issue: critical 100%, serious 80%, moderate 50%, minor 20%. It’s an automated check, not a certification.

How do we go from findings to a grade?

Consent, dark patterns and withdrawal each get a score out of 100. A part’s worst problem decides its range, however much else passed:

• Critical15–49
• High50–74
• Medium75–89
• Low90–97

Inside that range, the more of the part’s checks passed, the higher it sits. Each kind of problem counts once, however many pages it appears on. A problem marked “check by hand” may be a miss on our side, so it counts half and sits one range softer. A part with no problems scores 100; a part we couldn’t check has no score instead of a free 100.

The overall score follows your weakest part: it starts there and moves a quarter of the way towards the average of the others, but never out of the weakest part’s range. Two clean parts can’t hide tracking before consent.

90 or more is an A, 75 a B, 50 a C and 35 a D; anything lower is an F. The Google Consent Mode panel explains your ad signals but doesn’t change the grade. Scores from before 26 October 2026 used an older formula that took points off per problem, so they are lower than today’s.

How do we avoid false alarms?

• Locked “necessary” toggles and “remember me” boxes are ignored.
• Google tags that report consent as denied aren’t counted as tracking.
• A countdown is only called fake with two readings from two different first-time visitors.
• The withdrawal button is only checked on shops that sell to EU consumers.
• Each scarcity claim is counted once and quoted in full.

What can’t an automated scan see?

• Pages behind a login, and flows that need a real order or payment. Pro and Agency can open a few logged-in pages for the accessibility check only.
• Accessibility problems only a person can judge, such as whether a screen reader’s reading order makes sense or a caption is accurate.
• Server-side tracking, which never shows up in the browser.
• Banners shown only to visitors from certain countries or on mobile.
• A/B tests: we see the version our browser was given.
• Pages we didn’t visit, beyond the key pages your plan includes.
• Pop-ups that need scrolling, time on page or an exit intent.
• Whether your privacy policy says the right things, and whether stock or viewer numbers are true.
• Prices on pages that only show them after JavaScript runs: the daily price check reads the page’s own product data.

untick shows risk with evidence. It isn’t legal advice, and a clean scan isn’t a certificate of compliance.