For law firms
Technical evidence for your privacy assessment
For privacy counsel and litigation teams. Sasquatch Privacy loads a website in a real browser before consent, after Accept All, after Reject All and with a Global Privacy Control signal, and records the third-party requests, cookies and storage keys it observes. You get neutral, reproducible observations to analyse yourself.
Sasquatch Privacy provides technical privacy observations and is not legal advice.
01
What you get
A scan reports what happened, not what it means. Each finding is written as an observation (detected, observed, review recommended) and links to the hosts and consent state behind it. The scoring rubric is published and embedded in every result with its version, so the same observations can be re-derived by someone else.
02
How firms use it
- 01
Client intake snapshot
Before you advise on cookie and consent practice, record what the client's site does today: which third parties it contacts, in which consent state, and how it responds to Reject All and Global Privacy Control.
- 02
Before and after remediation
Re-scan after the client changes a tag or a consent setting and compare the two records. Each finding names the hosts, pages and consent states behind it, so a change between two scans can be traced to a specific observation.
- 03
Pre-suit diligence and demand letters
When a client receives a letter about tracking technologies, a scan gives you a dated technical record of what the site did, to set beside the allegations. It does not tell you what any vendor received.
- 04
M&A diligence and regulator inquiries
A baseline of the externally observable behaviour of a target's or client's website, with the method and the limits written down, for your own analysis.
- 05
A client portfolio over time
The Agency plan includes client management, scheduled checks across about ten sites, exports, and PDF reports that can carry your firm's name and colour.
03
What is in the evidence package
Paid audits and monitor scans offer an evidence package download.
The full method, including how to verify hashes and signatures, is on the evidence and methodology page.
- 01
A JSON record per finding: a stable finding id, the hosts behind it, and for each host the pages and consent states where requests to it were recorded, with counts and time offsets.
- 02
A screenshot manifest, with a SHA-256 hash of each screenshot computed at capture time (scans completed before this feature do not have capture-time hashes).
- 03
Collection details: start and finish times, region, whether the scan's network egress was verified to be in that region, scanner and browser version, rubric version and coverage.
- 04
A SHA-256 digest of the result as recorded when the platform received it from the scanner, and a custody record. The package is signed (Ed25519) when the deployment has a signing key configured; the public key is published at /.well-known/evidence-signing-key.
- 05
A per-finding CSV export.
- 06
A frameworks annex: for each kind of observation, the statutes, regulations and regulator guidance counsel commonly reviews in connection with it. A reading list, not an analysis.
- 07
A declaration template: a fill-in drafting aid for counsel describing how the record was generated. It is not legal advice, and counsel decides how, or whether, to use it.
- 08
Stated limitations, in the package itself.
04
What it does not establish
- 01
The scanner records the host and a hash of the path of each request, never the full URL, query string or payload. It shows that a request went to a vendor and when, not what data it carried.
- 02
Storage is recorded as keys without values.
- 03
It is one automated visit per page per consent state, from one region, at one point in time. Behaviour can differ for other visitors, devices, regions and dates.
- 04
Results are observations for counsel to analyse, not conclusions. They do not establish that any statute applies to the site or that any practice is or is not permitted.
- 05
It covers externally observable website behaviour only: not privacy-policy content review, data mapping, access and deletion requests, vendor contracts, mobile apps or internal systems.
- 06
Audits are retained for 365 days; monitor scans are retained according to the plan. Download the evidence package if you need it for longer.
05
Independence and method
The rubric is public, and we never publish a scan of someone else’s site. Scanning a client’s site should be authorised by the client; ordering a paid audit already requires confirming that authorisation. See how we make money.
06
Pricing
Most counsel start with a Full Privacy Audit for one client site, and use the Agency plan for a portfolio. All prices are on the pricing section of the home page. For a specific matter or a larger arrangement, talk to us.
07
Questions
- Is this legal advice?
- No. Sasquatch Privacy provides technical privacy observations and is not legal advice. Findings are written as observations, and the frameworks annex is a reading list, not an analysis. Counsel decides what the observations mean for a given client.
- Can I rely on this in a filing?
- That is counsel's judgement, and we do not offer an opinion on it. What we can tell you is what the record contains: dated, repeatable observations of hosts contacted, cookies and storage keys in four consent states, with collection details and integrity hashes. What it does not contain: request payloads, full URLs, storage values, or anything about what a vendor did with what it received. The methodology page describes the method in full.
- Can you scan a site my client does not own?
- The free scan works on any publicly reachable site. A paid audit crawls much deeper, so ordering one means confirming that you own the site or are authorised to have it tested; for a client's site, that authorisation should come from the client. We do not circumvent access controls.
- How long is evidence kept?
- Audits are retained for 365 days. Monitor scans are retained according to the plan. If you need a record for longer, download the evidence package and keep it with your matter file.
- Can the result be verified later?
- You can recompute the SHA-256 of a screenshot file and compare it to the manifest. The package can be signed with an Ed25519 key when the deployment has one configured, and the public key is published at /.well-known/evidence-signing-key. Scans completed before the evidence package was introduced do not have capture-time screenshot hashes.
- Do you offer expert testimony or a declaration?
- The package includes a declaration template as a drafting aid for counsel. If you have a question about evidence or expert support for a particular matter, use the contact form and pick the evidence option; we will tell you plainly what we can and cannot do.
Sasquatch Privacy provides technical privacy observations and is not legal advice.