What this scan cannot see

It sees only what an unauthenticated visitor sees

The scanner arrives at a site the way a stranger does: no account, no session, no cookies from a previous visit. Everything behind that boundary is invisible to it.

• It cannot log in, so nothing inside an account area is examined.
• It cannot test the cancellation flow. It can observe whether a link or control that reads as an online cancellation route exists on the pages it reached. It cannot follow that route, count the steps it takes, see the retention offers along the way, or find out whether it completes.
• It cannot read confirmation emails. Post-transaction acknowledgments are generated after a purchase this scanner never makes, and delivered to an inbox it has no access to.
• It cannot verify renewal reminders. Reminders are sent to existing subscribers on a schedule measured from their signup date. Nothing about them is observable at checkout.

Checks that depend on any of these appear in every report under requires manual verification. They are listed rather than skipped, because the fact that an outside scan cannot see them is itself something a reader needs to know.

“Clear and conspicuous” is a legal standard, not a measurement

Several state statutes are summarized as requiring automatic-renewal terms to be presented clearly and conspicuously. Whether a particular presentation meets that standard is decided by a court, weighing the whole context of a transaction. It is not a threshold, and this tool cannot measure it.

What the scanner reports is narrower and more literal: that renewal wording was or was not found in the visible text of the page carrying the consent control; that the smallest element matching the renewal pattern computed to a particular font size in pixels, and which element that was; that a price with a billing interval was or was not found within a stated distance of the submit control; that a screenshot review described the terms as prominent, subdued or absent. Those are observations about pixels and text. Turning them into a conclusion about a legal standard is a lawyer's job, and this tool does not attempt it. What each of those measurements is, and how each one is known to go wrong.

The rule summaries are drafted from secondary sources

Every statute summary, effective date and scope description in this tool is demo-seed text drafted from public secondary sources — law-firm client alerts, legislative summaries and trade-press coverage. They have not been checked line by line against primary statutory text, and they are not a substitute for counsel. State automatic-renewal law is also moving quickly: statutes are amended, effective dates slip, and courts read the same words differently. Treat the citations as a starting point for a lawyer to confirm, and see what we check for the full matrix and every citation in it.

Protected, gated and JavaScript-heavy sites produce partial results or none

Real checkouts are defended. Bot protection, WAF challenges, login walls, geographic gating, A/B-tested flows and interfaces that render entirely in client-side JavaScript will all stop the walk short — sometimes at the first page.

When that happens the report says so rather than pretending otherwise. It is marked partial, it names what could not be reached, and the steps that were captured before the failure are still analysed. If robots.txt disallows the path, the scan does not start at all. Paste mode exists for exactly these cases: you fetch the page in your own browser, and the scanner analyses what you captured without ever touching the site.

A clean scan is not evidence of compliance

A report with no findings means one thing only: none of the automated checks this scanner runs met their thresholds on the pages it reached. It does not mean a business meets the requirements of any statute. It does not cover any of the things listed above that no outside scan can see. It is not a certificate, an audit opinion, or a defence.

The reverse is also true. A finding is not an accusation. It records that a signal was, or was not, observed on a page at a moment in time — nothing more. Several perfectly ordinary implementation choices will produce findings, and several presentations a court might find perfectly adequate will produce findings too, because a scanner reads pixels and text rather than context.

Other limits worth stating plainly

• Pattern matching misses wording it was not written for. The signals are regular expressions over English-language text. A flow that describes its renewal terms in wording the patterns do not anticipate will read as absent.
• One path through the flow. The walk follows a single route. Multi-step, localised, segmented or A/B-tested checkouts may present something different to a different visitor.
• A moment in time. A report describes the pages as they were served on the date of the scan, to this scanner, from this network location.
• The visual pass is a model describing an image. It is prompted to describe rather than judge, its output is parsed strictly, and it is wrong sometimes. Where it did not run, the checks that depend on it are reported as undetermined.
• Only the states you select. Scoping a scan narrows which rules are reported. Rules for states you did not select are always still shown, collapsed, so nothing disappears silently.

Read the full legal disclaimer.