Read this first
This is an automated observation report, not legal advice and not a determination about any business. Whether a disclosure is “clear and conspicuous” is decided by a court, not by a scanner. Consult qualified counsel before acting on anything here.
Full disclaimer.
Methodology
How each measurement is made, and how each one fails
A report is a set of measurements. This page says what each one is measuring, exactly how it
is computed, and the ways it is known to be wrong — so a finding can be argued with on the evidence rather
than accepted or dismissed on the tool's authority.
This page is the specification the code is supposed to meet
Every description below is stored next to the function that computes the signal it describes, in
src/signals.ts. If a description says a signal is computed one way and the scanner does it
another, that is a defect, and it is worth reporting — publishing how a measurement works is only useful
if the description can be checked against the behaviour.
How to report one.
- Signals documented
- 17 — 13 deterministic,
4 from the visual pass
- Checks they drive
- 9
- Scanner version
0.15.0
- Rule matrix version
2026-08-04
The two passes, and why the difference matters
Signals come from two places, and they are not the same kind of evidence.
The two numbers this tool chose
Two checks compare a measurement against a threshold. Neither threshold comes from a statute — no
framework in this matrix states a minimum type size or a maximum distance — and both are published here so
that a finding resting on one can be weighed accordingly.
- 12px — the computed font size below which a renewal disclosure is
reported as small type. Chosen because it sits below the default body size of every mainstream browser,
not because any authority names it. The size compared against it is the smallest of every
visible element matching the renewal pattern, not the first one down the page: the check exists to find
fine print, so a page that states the terms plainly near the offer and restates them in 8px grey at the
foot is measured on the 8px. The report names the element measured, how many matched, and the largest
among them, so the number can be checked against the words it came from. The cost of measuring the
minimum is that an incidental small mention — a footer badge, a cookie banner — is what gets measured
on a page whose real disclosure is well set; the named element is how a reader catches that.
- 400px — the gap within which a price with a billing interval counts
as near the control that submits the order. Chosen as roughly half a laptop viewport height, not because
any authority names it.
Both are stated in every finding that uses them, in the same sentence as the measurement, rather than
only here.
Which screen counts as the consent step
Several signals are computed against “the consent step” rather than the whole walk. That step is chosen
by a single rule: the last captured step that carries a checkbox or a submit control, and failing that, the
last step captured at all.
It is a heuristic, and it is the one most likely to put an otherwise sound report on the wrong screen.
Where the walk stopped early — bot protection, a login wall, no forward call-to-action — the last step with
a control may be a marketing page rather than a checkout. Every report names the step each finding was
observed on and shows the filmstrip of every screen reached, so this is checkable in a few seconds rather
than taken on trust.
Why paste mode cannot evaluate visual prominence
This is a structural limit, not a gap waiting to be closed
Prominence, type size and element positions are properties of a rendered page. What renders them
is the site's stylesheets — and in paste mode those are external files that the tool deliberately never
fetches, because the entire point of paste mode is that nothing at all is requested from the target site.
The pasted markup is rendered locally with every network request blocked. Any computed style therefore
reflects browser defaults, not the live page.
The tool's response to that is to withhold rather than guess. When a paste-mode capture is found to have
external stylesheets that never loaded, three things happen:
disclosureFontSize and priceAndIntervalNearCTA are recorded as
undetermined, with the reason stored alongside them, rather than computed from browser
defaults.
- The checks that depend on them land in could not be determined in the report, never in the
findings and never in a pass column.
- The report's notes state that external resources were refused, how many, and of which kinds.
The visual-pass signals have the same problem for a different reason: there is no screenshot of the live
page to describe. Paste mode accepts up to four screenshots that you captured yourself in your own browser,
and the visual pass runs on those instead — which is the only way prominence can be assessed without the
tool touching the site. Without them, every visual signal is undetermined.
One consequence worth stating plainly: a paste-mode report with no findings about type size or placement
is not a report that found those things acceptable. It is a report that could not see them. The report says
so in the notes, and the checks appear in the undetermined section by name.
Undetermined, and why it is never folded into a pass
Rules are evaluated with three-valued logic. A condition referring to a signal that was never observed
evaluates to unknown, and a rule whose condition is unknown produces no finding at any severity — it is
listed separately with the missing signal names shown.
The alternative, treating “could not see it” as “it was fine”, would manufacture confidence that nothing
supports. It is also the specific failure that would make this tool actively harmful rather than merely
limited: a report that quietly passes what it could not measure is worse than no report, because somebody
would rely on it.
Determinism, and what is reproducible
- The rule matrix is deterministic. Given a set of signal values, the same findings
come out in the same order every time. Ordering is by severity, then by the first related state, then by
rule identifier — fully determined by the rules, so two reports for one site line up line by line.
- The deterministic pass is reproducible from a stored capture. Every signal records
its value and where it came from, and both are in the report and in the JSON.
- The walk is not reproducible. It follows one path, on one day, from one network
location, at a fixed 1440×900 viewport. Sites change, A/B tests split traffic, and a call-to-action that
was clicked last week may not exist this week.
- The visual pass is not reproducible. It is a model, and it can answer differently on
the same image. Findings that rest on it are capped at medium for that reason.
Every signal
In the order they are computed. Each block states what the signal measures, how it is
computed, the ways it is known to go wrong, and which direction it errs in.
Deterministic pass
subscriptionFlowReached
deterministic pass
recorded for context — no check fires on it
- What it measures
- Whether the walk arrived anywhere that could carry the disclosures the other checks look for. Every absence-of-evidence check is gated on it: an absent renewal checkbox is an observation on a checkout and noise on a marketing site.
- How it is computed
- True when any step showed a price with a recurring billing interval, recurring-billing wording, plan-selection wording, a card field, or a consent control on a step that also shows a price. A checkbox alone is not enough — cookie banners and newsletter signups have checkboxes. When false, every rule marked as requiring a flow resolves to could-not-determine rather than to a finding, and the report opens by saying no flow was found.
- Known failure modes
- The patterns are English-only, so a localised checkout can read as no flow reached — which under-reports rather than over-reports, but still hides real findings behind could-not-determine.
- A flow expressed entirely in images, or priced in a currency format the price pattern does not cover, is not recognised.
- A page that shows recurring pricing but sells nothing — a pricing comparison article, say — satisfies the gate, and the absence checks then run against a page that never had a checkout.
- False positives
- Recurring-price wording quoted on a page that is not actually selling anything opens the gate, and every absence check then runs where nothing could have been present.
- False negatives
- A real checkout the patterns fail to recognise closes the gate and turns real findings into could-not-determine. The gate errs toward saying less, deliberately: a missed finding is recoverable, a fabricated one is not.
renewalTextOnPage
deterministic pass
drives 1 check
- What it measures
- Whether a customer standing at the consent moment could read anything at all describing that the charge recurs — without following a link.
- How it is computed
- A case-insensitive regular expression is tested against the rendered text of the consent step only, not the whole walk. The pattern covers “automatically renew(s/al/ing/ed)”, “recurring charge/billing/payment/subscription/basis”, “until you cancel”, “continuous service”, “subscription will renew” and “renews automatically/each/every”. The text comes from the browser’s own innerText, so wording hidden by CSS is excluded the same way it is for a reader.
- Known failure modes
- The consent step is chosen as the last captured step carrying a checkbox or submit control. On a flow where the walk stopped early, that step may not be the real consent moment.
- Wording rendered inside an image, a canvas or an SVG is not text and is never seen.
- The patterns are English-only. A localised checkout reads as having no renewal wording at all.
- False positives
- Renewal wording anywhere on the same page counts — an FAQ block, a footer, or a plan comparison far below the consent control. The signal says the words were on the page, not that they were near the control. Proximity is a separate signal, and on the visual pass rather than this one.
- False negatives
- Wording that describes the same thing in terms the pattern was not written for — “you will be charged $9 every 30 days”, “billed again on the 1st” — reads as absent. This is the most common way this signal is wrong.
renewalTextInLinkedTerms
deterministic pass
recorded for context — no check fires on it
- What it measures
- Whether the renewal terms exist in the linked documents, which is what separates “not disclosed anywhere” from “disclosed only behind a link”.
- How it is computed
- The same renewal pattern, tested against the concatenated text of up to three documents linked from the captured pages whose link text or path matches terms, conditions, refund, cancel or subscription agreement. Each document is truncated to 50,000 characters.
- Known failure modes
- Only the first three matching links are fetched, in the order they appear. A site with four such links may have the operative one skipped.
- A terms page that renders its text in client-side JavaScript, sits behind a login, or returns an error is recorded as unread, and this signal is computed from whatever else was fetched.
- Truncation at 50,000 characters can cut off renewal wording in a long agreement.
- False positives
- A refund policy or privacy page can match the pattern without being the document that carries the automatic-renewal terms. The signal records that the wording was found in something the scan fetched, not that the right document was found.
- False negatives
- If no terms link was found or none could be fetched, this reads as false rather than undetermined — but the composite signal built on it, renewalTextOnlyInLinkedTerms, is held as undetermined in exactly that case, so no rule fires on the absence.
renewalTextOnlyInLinkedTerms
deterministic pass
drives 1 check
- What it measures
- The specific shape several frameworks are summarized as being about: terms that exist, but only behind a link, rather than in front of the customer at the moment of consent.
- How it is computed
- True when renewalTextOnPage is false and renewalTextInLinkedTerms is true. Deliberately held as undetermined — never false — when no terms document was fetched and no renewal wording was on the page, because with nothing fetched the word “only” cannot be established.
- Known failure modes
- It inherits every failure mode of the two signals it is built from.
- A page whose renewal wording is present but not matched by the pattern, plus a terms document where it is matched, reads as “only in the terms” when it was in fact on both.
- False positives
- The case above: a page whose wording the pattern missed, alongside a terms document whose wording it caught, produces this signal wrongly. It drives a high-severity check, so it is the single most consequential false positive in the tool.
- False negatives
- A flow that discloses nothing anywhere produces false here, not true — that case is caught by renewalTextOnPage being false, which the same rule also tests.
separateConsentCheckbox
deterministic pass
drives 1 check
- What it measures
- Whether consent to the renewal terms was collected by its own control rather than folded into a single box accepting everything at once.
- How it is computed
- Checkboxes on the consent step are collected with their labels, resolved in order from aria-label, a label[for] pointing at the control, an enclosing label element, aria-labelledby, and finally the parent element. A checkbox counts when its label matches the renewal pattern and does not also match the terms-of-service pattern.
- Known failure modes
- Only input elements of type checkbox are considered. A dedicated consent implemented as a radio pair, a toggle switch, a button, or a custom component that is not a checkbox input reads as absent.
- The parent-element fallback can pull in a whole block of surrounding copy, so a checkbox next to a paragraph of renewal wording can inherit it as a label.
- A single control whose label covers both the renewal terms and the terms of service is treated as not separate, which is the intended reading but is a judgement rather than a measurement.
- False positives
- The label fallback described above: a plain terms checkbox that happens to sit inside a container holding renewal wording reads as a dedicated consent control when it is not.
- False negatives
- Any dedicated consent mechanism that is not an HTML checkbox. This is a common modern pattern and is the most likely reason this signal is wrong on a real checkout.
prechecked
deterministic pass
drives 1 check
- What it measures
- Whether agreement was recorded by a default rather than by an action the customer took.
- How it is computed
- Every checkbox captured on every step of the walk is examined, including ones that are visually hidden, and the signal is true if any of them was checked at capture time.
- Known failure modes
- It is not scoped to renewal consent. Any pre-ticked checkbox anywhere in the flow sets it — a marketing opt-in, a “remember me”, a hidden state field.
- A box ticked by script after the capture, or on a later interaction, is not seen.
- A capture taken before a framework has finished setting default state can read as unticked.
- False positives
- A pre-ticked newsletter box on an otherwise careful checkout sets this signal, and it feeds a high-severity check. When reading a finding that rests on it, look at the signal table: it records the label of every box that was ticked, which usually settles in one line whether the finding is about renewal consent at all.
- False negatives
- Consent defaulted on by something other than a checked checkbox — a pre-selected radio, a control whose state is held in JavaScript rather than in the DOM — is not detected.
priceAndIntervalNearCTA
deterministic pass
drives 1 check
- What it measures
- Whether the recurring amount and its interval were stated close to the control the customer uses to proceed, rather than only higher up the page.
- How it is computed
- Innermost visible elements whose text is at most 400 characters and matches a price-with-interval pattern (a dollar amount followed by a month, year, week or day interval) are measured against every submit-like control and CTA link on the page. The distance is the gap in CSS pixels between the two rectangles, and the signal is true when the smallest such gap is 400px or less. 400px is a threshold this tool chose; no statute in the matrix states a distance.
- Known failure modes
- It measures a gap between rectangles in a full-page coordinate space. Two elements 200px apart vertically are “near” even if one is off-screen on a phone-sized viewport, and the walk runs at a fixed 1440×900 desktop viewport, so a responsive layout is measured in one configuration only.
- Prices in a currency other than dollars, or written without a currency symbol, are not matched.
- Where styles did not apply — paste mode with external stylesheets — positions are meaningless, and the signal is deliberately withheld as undetermined rather than computed.
- False positives
- A price and interval in an unrelated plan card can sit close to some other submit control on the page and satisfy the threshold, without the customer ever seeing the two together at the consent moment.
- False negatives
- A checkout that states the recurring amount in wording the price pattern does not match — “$9 monthly thereafter”, a price split across two elements, or an amount rendered in an image — reads as absent, and the check that uses it fires.
trialLanguage
deterministic pass
drives 1 check
- What it measures
- Whether the offer being presented begins free or discounted, which is what brings the trial-conversion checks into scope at all.
- How it is computed
- A pattern covering “free trial”, “try it free”, “N-day trial”, “start your free”, “first month free” and “no charge for”, tested against the text of every captured step joined together.
- Known failure modes
- It reads the whole walk rather than the consent step, so trial wording on a marketing page brings the trial checks into scope for a flow whose actual offer is not a trial.
- Promotional pricing described without the word trial — “50% off for three months” — is not matched.
- False positives
- A site that advertises a free trial elsewhere while the flow being scanned sells a paid plan will have the trial checks applied to it.
- False negatives
- An introductory-price offer that never uses trial vocabulary takes the trial checks out of scope entirely, so nothing is reported about its conversion terms.
trialConversionTerms
deterministic pass
drives 1 check
- What it measures
- Whether the customer was told, in the same place as the trial offer, what happens when it ends.
- How it is computed
- Computed only when trialLanguage is true. A pattern covering “then $”, “after the trial”, “automatically charged/billed”, “converts to”, “renews at”, “billed … after/once/when”, “unless you cancel” and “trial ends”, tested against the text of every captured step joined together.
- Known failure modes
- Like trialLanguage, it reads the whole walk rather than the screen carrying the offer, so conversion wording anywhere counts.
- It cannot tell whether the wording states the correct amount or the correct date — only that wording of that shape is present.
- False positives
- Boilerplate such as “unless you cancel” in an unrelated footer satisfies this signal without the conversion terms being stated anywhere near the offer.
- False negatives
- Conversion terms expressed only as a date and an amount — “$12 on 14 March” — do not match, and the check fires.
trialConversionInLinkedTermsOnly
deterministic pass
recorded for context — no check fires on it
- What it measures
- Whether the terms of a trial conversion exist, but only behind a link.
- How it is computed
- True when trialConversionTerms is false and the same conversion pattern matches the fetched terms text. Recorded for context — no rule fires on it directly.
- Known failure modes
- It inherits the failure modes of the conversion pattern and of the terms fetch.
- False positives
- A terms document that discusses trials generally, without being the document governing this offer, satisfies it.
- False negatives
- With no terms fetched, it reads as false rather than undetermined. Nothing depends on it, so nothing fires on that.
disclosureFontSize
deterministic pass
drives 1 check
- What it measures
- How small the renewal disclosure is set at its smallest, as one proxy — and only one — for whether it is legible.
- How it is computed
- Elements whose own text matches the renewal pattern, are at most 800 characters long, are visible, and have no child element that also matches, are collected. Every one of them is measured, and the SMALLEST computed font-size in pixels is the signal; ties keep document order. The element measured is named in the report, along with how many matched and the largest among them. A rule fires when the smallest value is below 12px.
- Known failure modes
- Measuring the minimum means any incidental small mention counts. A page that discloses the terms properly beside the button, and also carries the word “renews” inside an 9px cookie banner or a footer badge, is measured on the banner. The reported element name is what a reader has to check this against.
- It reads whichever captured step carries a match, so a mention on a page other than the one carrying the offer can supply the measurement.
- Computed font size ignores everything else that determines legibility: contrast, weight, letter spacing, whether the text sits over an image, and the viewport the customer is actually on.
- Under paste mode with external stylesheets, the computed size reflects browser defaults, so the signal is withheld as undetermined rather than reported.
- False positives
- A disclosure legitimately set below 12px in a design where it is nonetheless perfectly legible — high contrast, generous spacing — is flagged. So is a page whose real disclosure is well set but which mentions renewal somewhere else in small type. The threshold is this tool’s, and no statute states one.
- False negatives
- Fine print set at or above 12px does not fire, however hard it is to read in context. Text rendered inside an image is not matched at all, because there is no element to measure.
onlineCancelPath
deterministic pass
drives 1 check
- What it measures
- Whether anything visible from outside the account reads as a route to cancel online.
- How it is computed
- The text and href of every captured link, the text of every button, and the link texts inside fetched terms documents are collected into one list and tested against a pattern covering “cancel my/your subscription/membership/plan”, “cancel anytime”, “cancel online”, “manage your subscription” and “subscription settings”. The number of labels searched is recorded in the signal table.
- Known failure modes
- The walk never authenticates and stops at the card field, so a cancellation route inside an account — the usual place for one — is structurally out of reach. The check built on this is capped at medium severity for that reason.
- It matches a label, never a working route. A link reading “cancel anytime” that leads to a support form satisfies it.
- False positives
- Marketing copy is the common case: “cancel anytime” in a plan card sets this signal without any cancellation route existing on the pages scanned.
- False negatives
- A real online cancellation route that lives behind a login, or that is labelled in words the pattern does not cover, reads as absent — and the check fires. This is why the finding says how many labels were searched.
phoneOnlyCancel
deterministic pass
drives 1 check
- What it measures
- Whether the terms describe a telephone route to cancel.
- How it is computed
- A pattern covering “call … to cancel”, “cancel … by phone/calling/telephone”, “by phone only”, “must call … cancel” and “cancellations … by telephone”, tested against the fetched terms text. The matched sentence is recorded verbatim in the report so the wording can be read in context. Withheld as undetermined when no terms were fetched.
- Known failure modes
- The signal name overstates what is measured. It detects that telephone cancellation is described; it does not establish that telephone is the only route. Terms offering both an online and a telephone route match it.
- It reads only the documents the scan managed to fetch, and only the first three of them.
- False positives
- Terms that offer telephone cancellation alongside a perfectly good online route match this signal and produce a high-severity finding. Read the quoted sentence in the report before treating the finding as meaningful — that is why the sentence is quoted.
- False negatives
- Telephone-only cancellation described in wording the pattern does not cover, or stated on a page the scan did not fetch, is not detected.
Visual pass
Every signal below is capped at medium severity wherever it contributes to a finding,
and every one of them is reported as undetermined when the pass does not run — which is the case whenever no
API key is configured, when the pass is switched off, and in paste mode unless you uploaded screenshots
yourself.
renewalTermsVisible
visual pass
recorded for context — no check fires on it
- What it measures
- Whether a person looking at the screen would see renewal terms at all.
- How it is computed
- A vision model is sent the full-page screenshot of the consent step together with that step’s structured capture, and asked to answer in four fixed fields. It is told to describe what is visually present and not to judge legality. The response is parsed strictly as JSON; an unparseable answer is retried once and then the step is marked analysis unavailable.
- Known failure modes
- It is a model describing an image. It is wrong sometimes, and it can be confidently wrong.
- The screenshot is a full-page capture at a 1440px desktop width. On a long page the disclosure may be thousands of pixels below the consent control and still be in the same image.
- Where the capture exceeds the image size limit, a clipped copy of the top 4000px is sent instead, so anything below that is not reviewed.
- If no API key is configured, or the pass is switched off, it does not run at all and every check depending on it is reported as undetermined.
- False positives
- A model may report renewal terms as visible on the strength of nearby subscription wording that is not in fact a renewal disclosure.
- False negatives
- Small or low-contrast type in a large full-page capture can be missed, which reads as terms not being visible.
renewalTermsProminence
visual pass
drives 1 check
- What it measures
- How much visual weight the disclosure carries relative to everything else on the screen.
- How it is computed
- One of three fixed values returned by the same vision request. Any other value is discarded rather than coerced. A finding that depends on it is capped at medium severity, because a model describing a screenshot is making an observation rather than a measurement.
- Known failure modes
- Prominence has no definition the model and a court would share. The three values are this tool’s vocabulary, not a legal standard.
- Paste mode without uploaded screenshots cannot produce this signal at all — see the note below on why.
- False positives
- A disclosure set in a heavy weight but placed in a footer can be described as prominent.
- False negatives
- A perfectly readable disclosure in a dense screen can be described as subdued.
proximityToConsentAction
visual pass
drives 1 check
- What it measures
- Whether the terms and the control that records agreement are in view together.
- How it is computed
- One of four fixed values from the same vision request. “requires-scroll” is the value that drives a high-severity check, because it is the one describing the disclosure and the consent moment being separated.
- Known failure modes
- The model is shown a full-page capture, not a viewport. Judging what “requires a scroll” means from a stitched full-page image is exactly the kind of inference a screenshot supports poorly.
- It is capped at medium severity through the ceiling on visual-pass signals, but the rule it feeds is high severity when other signals also fire.
- False positives
- A tall capture can read as requiring a scroll when the two elements were in view together on a real viewport.
- False negatives
- A capture that happens to place both elements near each other in the image can read as adjacent when a customer would have had to scroll.
consentMechanism
visual pass
recorded for context — no check fires on it
- What it measures
- What kind of control the customer used to agree, as it appears on screen rather than in the DOM.
- How it is computed
- One of three fixed values from the same vision request. Recorded alongside the deterministic separateConsentCheckbox signal so the two can be compared: they are measuring the same thing by different means, and they disagree often enough to be worth reading together.
- Known failure modes
- It describes appearance, and a control that looks dedicated may not be.
- No rule fires on it directly; it exists so a reader can weigh the deterministic checkbox signal against what the screen looks like.
- False positives
- A single bundled checkbox with renewal wording immediately above it can read as dedicated.
- False negatives
- A genuinely dedicated control rendered as a custom component can read as not visible.
Checkout health — a separate category of observation
Every walk also records whether the checkout was mechanically working that day: errors in the console,
requests that answered 4xx or 5xx, linked terms documents that did not resolve, a call-to-action that led
nowhere, a price that changed between the plans page and the consent step, and whether the consent step fits
a phone viewport. These reuse the walk that already happens — none of them makes the scan heavier, and none
of them is a site-wide crawl, a performance audit, or an uptime check.
They are kept strictly apart from the legal observations: no statute references, no
state names, their own status words, and their own section at the foot of every report. The observed counts
appear on every report; the itemised detail is included with the paid monitoring plans, and on any scan of a
domain a monitor covers. The same three-valued logic applies throughout — a check the walk never reached the
place to run is reported as could-not-be-determined, never as passing.
Console errors console-errors
- What it measures
- Whether the checkout’s own code is erroring for a customer arriving today — the kind of defect that silently drops conversions.
- How it is computed
- The browser’s pageerror and console events are listened to on every step of the walk. Uncaught exceptions and console messages of type error are recorded with their message, source file where the browser names one, and the step they fired on. Warnings and logs are ignored, network-failure echo lines are excluded (they are recorded as failed requests instead), and repeated identical messages are recorded once.
- Known failure modes
- An error thrown after capture — on a later interaction the walk never makes — is not seen.
- Errors from third-party scripts count the same as first-party ones; the source file is recorded so a reader can tell them apart.
- A page that swallows its own exceptions reports clean here while still misbehaving.
- Description last reviewed
- 2026-08-05
Failed network requests failed-requests
- What it measures
- Whether the resources and calls the checkout depends on are answering.
- How it is computed
- Every response with status 400 or above, and every request the browser reports as failed (timeout, DNS, connection refused), is recorded with its method, URL and status, deduplicated by URL and status. Requests cancelled by ordinary navigation are excluded — cancelling in-flight requests is how browsers navigate, not a defect.
- Known failure modes
- A request that succeeds with the wrong content is invisible here; only transport-level failure is observed.
- Third-party beacons and trackers that 4xx are recorded the same as first-party calls. The URL is recorded so a reader can weigh them.
- The walk runs once, from one network location; an intermittent failure may or may not be caught.
- Description last reviewed
- 2026-08-05
Broken links to terms and cancellation documents linked-documents
- What it measures
- Whether the documents the checkout points customers at actually resolve — a 404 on a linked Terms page is a real defect whatever else is true.
- How it is computed
- The scan already fetches up to three documents whose link text or path reads as terms, conditions, refund, cancellation or subscription agreement. The HTTP status of each fetch is recorded; anything other than a readable 200 is listed with the link text and the error. No additional request is made — this reads the statuses of fetches the scan already performed.
- Known failure modes
- Only the first three matching links are fetched, so a broken fourth link is not seen.
- A page that answers 200 with an error message in its body reads as fine here.
- A document behind a login or a cookie wall records the refusal it answered with, which may not be what a signed-in customer sees.
- Description last reviewed
- 2026-08-05
Dead-end call-to-action dead-end-cta
- What it measures
- Whether the button a customer must press to buy actually leads anywhere.
- How it is computed
- The walk clicks the primary call-to-action on each step. If the click completes but neither the URL nor the page text changes, or the click itself errors, the outcome is recorded with the control’s label and the step. A walk that never clicked a call-to-action records this as undetermined.
- Known failure modes
- A control that opens a modal styled to look like page content can read as no change when a customer would see one.
- The scanner picks one call-to-action per step by heuristic; a page with several plan buttons may have a different one working.
- Slow client-side navigation that finishes after the settle window reads as no change.
- Description last reviewed
- 2026-08-05
Price mismatch between plans page and consent step price-mismatch
- What it measures
- Whether the amount a customer agreed to at the end is the amount they were shown when they chose.
- How it is computed
- Every distinct price-with-interval string on each step is recorded as matched, then reduced to amount and period. The check compares the final step against the earlier ones, and reports only when the final step shows exactly one distinct price and some earlier step showed at least one. Anything less — no price, several prices — is undetermined rather than guessed at.
- Known failure modes
- A legitimate difference — a first-period discount stated as such — compares as a mismatch, because only the strings are compared, not what they mean.
- Prices in a currency other than dollars, or split across elements, are not matched at all and produce undetermined.
- A plans page listing many tiers satisfies the comparison as long as the consent-step price appears among them, even if the customer clicked a different tier.
- Description last reviewed
- 2026-08-05
Mobile consent rendering mobile-consent
- What it measures
- Whether a customer on a phone can reach the consent moment without scrolling sideways — the majority of checkout traffic renders at widths like this.
- How it is computed
- After the walk, the consent step is re-rendered once in a fresh page at 390×844 and measured: the page’s layout width against the viewport, and whether the visible checkboxes and at least one submit control sit inside the 390px width. A screenshot of the render is stored. If the walk never reached a consent step, or the re-render fails, the check is undetermined with the reason recorded.
- Known failure modes
- A step reached by clicks may not be reproducible by re-navigating its URL; the re-render then measures a different state, or fails and records undetermined.
- 390px is one width. A layout that turns at 380px or 400px is measured only at 390.
- Fitting the viewport is not the same as being usable; overlap, contrast and tap-target size are not measured.
- Description last reviewed
- 2026-08-05
Every check these signals drive, with the date each summary was last
reviewed · The pipeline, from URL to report ·
What no outside scan can see ·
What has changed, and when