Questions

Questions, including the uncomfortable ones

If an answer here reads as hedged, it is because the honest answer is hedged. Where the answer is simply no, it says no.

Is this legal advice?

No. This tool produces automated observations about what was visible on a set of web pages at a point in time. It is not legal advice, using it creates no attorney-client relationship, and nothing it outputs is a determination about any business. The statute summaries it shows were drafted from secondary sources and have not been verified by counsel. If you need to know where you stand, that is a question for a qualified lawyer, and a report from this tool is at most a set of notes to hand them. Full disclaimer.

Will this hold up in court?

Treat the answer as no. This tool was not built to produce evidence, and nothing about it has been designed to meet an evidentiary standard. There is no chain of custody, no tamper-evident storage, no attestation, and no independent verification that a screenshot corresponds to what a given visitor saw. A screenshot and a timestamp written by an automated tool are worth what the process behind them is worth, and this process is a demonstration. If evidence is what you need, that is a job for counsel and, usually, for a specialist who does forensic web capture for a living.

Why did it find nothing?

Most often because the walk never reached a page where a subscription is selected — it stopped at a marketing page, was blocked, or could not find a forward call-to-action. Check the what this scan reached note and the filmstrip at the foot of the report; they name every screen the scanner actually saw. A report built from one marketing page is not a quiet pass, it is a scan that did not get far.

It may also be that the checks genuinely did not meet their thresholds on the pages reached. That is worth knowing, but it is not the same as meeting the requirements of a statute — see limitations. And check the could not be determined section: a rule that could not be evaluated is listed there rather than counted as a finding.

Why can’t it check my cancel button?

Because cancelling is something an existing subscriber does from inside an account, and this scanner has no account. It can see whether a link or control whose text reads as an online cancellation route exists on the pages it reached, and whether the terms it fetched describe cancelling by telephone. It cannot click through the route, count how many screens it takes, see what retention offers appear, or find out whether it ends in an actual cancellation. Every report lists that gap explicitly under requires manual verification rather than leaving you to infer it.

What if my site blocks it?

That is the normal case for a defended checkout, and there are three routes. Manual URL mode skips discovery when you already have the direct checkout URL. Paste mode analyses markup, terms text and screenshots that you captured in your own browser, with every network request blocked so nothing is requested from your site at all. And if robots.txt disallows the path, the scan does not start — that is deliberate, and paste mode is the way around it. A blocked scan produces a partial report explaining what was refused, never a crash.

How often should I re-scan?

There is no schedule this tool can justify on legal grounds, so here is the practical answer: re-scan when the thing being scanned changes, or when the rules do. In practice that means after any change to pricing, plan structure, the checkout flow, the consent step or the terms; when a state framework in the matrix takes effect or is amended; and before a launch into a new state. The scan history — operator-only, behind the same credentials as running a scan — shows what changed between one scan of a domain and the next, which is the fastest way to catch a checkout change that nobody flagged internally.

What happens when a new state law passes?

A rule is added to the matrix as data — a statute citation, a link to the official code page, a plain-English requirement, the conditions under which it applies and the conditions under which the scanner records a finding. Every page that presents rules is generated from that matrix, so what we check and the state pages update as soon as the rule exists. Nothing is hand-maintained, which is what stops the documentation drifting away from the code.

States with bills in progress are tracked separately and shown as informational only. A pending bill never produces a finding, because there is nothing in effect to relate a finding to.

Who maintains the rule data?

For this demonstration, nobody with a licence to practise law. The matrix is seed data drafted from public secondary sources by the person who built the scanner, and it carries that warning in the source file, on every report and in the footer of every page. Before this tool is used for anything real, the matrix needs a named owner who is qualified to read the primary statutes, a review pass against the official code text for every citation in it, and a standing process for catching amendments. Everything the site asserts about a statute is listed in one file, LEGAL-CLAIMS-TO-VERIFY.md, so that review can be done in a single pass.

What does a finding actually mean?

It means a named signal was observed, or was not observed, on a page the scanner reached, and that a rule in the matrix relates that observation to a statute. That is the whole claim. It is not a statement that anything is wrong, and it is not a determination about the business. Each finding names the statute it relates to, links to the official code page, shows the screenshot region it came from, and lists the raw signal values that produced it — so you can disagree with it on the evidence.

What does “could not be determined” mean, and why isn’t it a pass?

Rules are evaluated with three-valued logic: true, false, or unknown. If a rule depends on a signal that was never observed — the visual pass did not run, no terms page was reachable, styles never loaded — the result is unknown, and the rule is listed under could not be determined with the missing signal names shown.

It is not folded into the pass column because absent evidence is not evidence. A tool that quietly treats "I could not see it" as "it was fine" is worse than no tool, because it manufactures confidence that nothing supports.

Does the scanner ever buy anything, or enter card details?

No. It has no payment details and no code path that submits a purchase. It refuses to click controls whose text reads as completing a purchase, and it stops the walk as soon as it detects a card-number field or an embedded payment iframe. The report names the step where it stopped and why. Every screen it reached is in the filmstrip, so you can confirm where it ended.

Why do I have to pick states before scanning?

Because the requirements differ by state and the answer to "does this matter to me" depends on where your subscribers are. Selecting states scopes the report to the frameworks that relate to your situation instead of burying them in ones that do not. Rules for the states you did not select are always shown as well, collapsed, so you can see what expanding into a state would surface before you expand into it. Nothing is deleted from a report by scoping it.

Can I scan a competitor’s site?

The terms of this tool ask you to scan only sites you own or are authorized to assess, and scanning a site you do not control may be inconsistent with that site's own terms of use. That is your call and your risk, not something this tool can decide for you. What it does do is behave conservatively regardless: it identifies itself, respects robots.txt, runs one scan at a time, never logs in and never transacts. See terms and privacy.

Where does my data go?

Nowhere except the machine running the scanner, with one exception. Scans are written to local disk as one JSON file and a set of PNG screenshots. There is no database, no account system and no analytics. The exception is the visual pass: if an API key is configured, each screenshot and its structured capture are sent to the model provider for analysis. Without a key that pass does not run and nothing leaves the machine. Privacy details.

Still unanswered? The pipeline description and the limitations cover the mechanics in more detail, and what we check lists every rule and citation in the matrix.