Evidence and methodology

• European Union: Directive 2002/58/EC (ePrivacy Directive), Article 5(3). Storing information on, or gaining access to information stored on, a user's device, and the consent and exemptions that relate to it.
• European Union: Regulation (EU) 2016/679 (GDPR), Articles 4(11), 6(1)(a) and 7. The definition of consent and the conditions for relying on it.
• United Kingdom: Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 6. Storing or accessing information on a user's device, and the consent and exemptions that relate to it.
• California: Cal. Civ. Code § 1798.100(a); Cal. Code Regs. tit. 11, § 7012. Notice to consumers at or before the point of collection.
• California: Cal. Penal Code §§ 631 and 638.51 (California Invasion of Privacy Act). Interception of communications, and the use of pen registers and trap-and-trace devices; frequently pleaded in litigation about website tracking technologies.

Not established by the scan: Whether each request stored or read information on the device, what data it carried, whether an exemption applies, and which jurisdictions' visitors the site serves.

• European Union: Directive 2002/58/EC (ePrivacy Directive), Article 5(3). Storing information on, or gaining access to information stored on, a user's device, and the consent and exemptions that relate to it.
• European Union: GDPR, Articles 7(3) and 21. Withdrawal of consent and the right to object.
• United Kingdom: Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 6. Storing or accessing information on a user's device, and the consent and exemptions that relate to it.
• California: Cal. Civ. Code §§ 1798.120 and 1798.135. A consumer's right to opt out of the sale or sharing of personal information, and the methods a business provides for doing so.
• California: Cal. Code Regs. tit. 11, § 7004. Requirements for methods of submitting consumer requests and obtaining consent, including symmetry of choice.

Not established by the scan: What the recorded requests contained, whether the recipients act as processors or service providers under contract, and whether the control the scanner activated is the site's intended opt-out mechanism.

• California: Cal. Civ. Code § 1798.135(b) and (e); Cal. Code Regs. tit. 11, § 7025. Opt-out preference signals and how a business processes them.
• Colorado: Colo. Rev. Stat. § 6-1-1306(1)(a)(IV); 4 Colo. Code Regs. 904-3, Part 5. Universal opt-out mechanisms.
• Connecticut: Conn. Gen. Stat. § 42-520(e). Opt-out preference signals sent by a platform, technology or mechanism.
• United States (other states): Other state comprehensive privacy statutes. Several other states have adopted opt-out preference signal provisions with differing effective dates; counsel should confirm which apply.

Not established by the scan: Whether the site sells or shares personal information as those terms are defined, whether the signal changed what was sent to the same hosts (a server-side response is not externally observable), and whether the business is subject to these statutes.

• California: Cal. Penal Code §§ 631 and 638.51 (California Invasion of Privacy Act). Interception of communications, and the use of pen registers and trap-and-trace devices; frequently pleaded in litigation about website tracking technologies.
• United States (federal): 18 U.S.C. § 2511 (Wiretap Act). Interception of electronic communications and the consent exception.
• United States (other states): State wiretap statutes, including Fla. Stat. § 934.03 and 18 Pa. Cons. Stat. § 5701 et seq.. State interception statutes, some of which require the consent of all parties.
• European Union: GDPR, Articles 5(1)(c), 6 and 13. Data minimisation, lawful basis and information given to data subjects.
• European Union: Directive 2002/58/EC (ePrivacy Directive), Article 5(3). Storing information on, or gaining access to information stored on, a user's device, and the consent and exemptions that relate to it.

Not established by the scan: Which interactions or form fields the tool captures, how it is configured for masking, whether visitors were told about it and agreed, and the vendor's contractual role.

• European Union: GDPR, Articles 4(11) and 7(3). Freely given consent, and withdrawing consent as easily as it was given.
• European Union: European Data Protection Board, Report of the work undertaken by the Cookie Banner Taskforce (17 January 2023). Supervisory authorities' shared positions on reject options and banner design.
• United Kingdom: Information Commissioner's Office, Guidance on the use of storage and access technologies. The regulator's expectations for consent mechanisms.
• California: Cal. Civ. Code § 1798.140(l); Cal. Code Regs. tit. 11, § 7004. Dark patterns and symmetry in choice.

Not established by the scan: Whether a reject option exists in a form the scanner does not detect (a second layer, a non-English label, a banner inside a frame, or a banner shown only to visitors from particular regions).

• European Union: GDPR, Article 5(1)(e). Storage limitation.
• European Union: CNIL (France), Guidelines and Recommendation on cookies and other trackers (17 September 2020). A supervisory authority's recommendations on cookie lifetimes and how long a recorded choice remains valid.
• European Union: Directive 2002/58/EC (ePrivacy Directive), Article 5(3). Storing information on, or gaining access to information stored on, a user's device, and the consent and exemptions that relate to it.

Not established by the scan: The purpose of each cookie, whether it is exempt as strictly necessary, and whether its value identifies a person.

• European Union: Directive 2002/58/EC (ePrivacy Directive), Article 5(3). Storing information on, or gaining access to information stored on, a user's device, and the consent and exemptions that relate to it.
• United Kingdom: Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 6. Storing or accessing information on a user's device, and the consent and exemptions that relate to it.
• California: Cal. Civ. Code § 1798.140(k), (ad) and (ah). Definitions of cross-context behavioural advertising, sale and sharing of personal information.
• California: Cal. Civ. Code §§ 1798.120 and 1798.135. A consumer's right to opt out of the sale or sharing of personal information, and the methods a business provides for doing so.

Not established by the scan: What each cookie is used for, whether the recipient combines it with activity on other sites, and the contractual terms with that recipient.

• European Union: GDPR, Articles 13(1)(e), 28 and 30. Informing data subjects of recipients, contracts with processors, and records of processing activities.
• California: Cal. Civ. Code § 1798.100(d); Cal. Code Regs. tit. 11, § 7051. Agreements with service providers, contractors and third parties.

Not established by the scan: Who operates each host, what it received, and whether it is already covered by an existing vendor agreement under a different name.