Most scanners check what happens when visitors accept. Regulators check what happens when they refuse.

It has long been clear that the world of cookies, tracking pixels and online data harvesting has been a dark art. They impact the entire online population, yet are understood by few, and controlled by fewer.

We in the DataPal team have been deep down in those weeds working on our first IEEE 7012/ MyTerms product with MyData Global and Civic Cookie Control, the Edinburgh and Athens based consent management platform. In that work we learned an awful lot about the inner workings of cookies, banners, scanners, trackers, identity graphs and other such delights that power surveillance capitalism.

Then along came our colleague Eli, the expert's expert in that space, and said ‘we could build a tool that really helps privacy officers, website managers and their agencies make sense of this space’.

So she led the technical architecture and backend engineering for DataPal's Privacy Pulse platform.

We’ll leave the rest of the origin story for another day as that in itself was a fascinating journey into what can be built when you give a true subject matter expert the most modern of AI powered development tools.

Those tools are Privacy Pulse, a forensic-grade website scanner. And the Privacy Pulse Index; the database of scans that we and others can learn from as to what is really going on in that space and how it is changing over time.

Let’s start with Privacy Pulse. Here’s what it does…

It shows up at a website, as a visitor, with a completely clean browser. It checks and record what the website does:

Before anything on the site is touched - I’ve just arrived !
When ‘Accept All’ is clicked
When ‘Reject All’ is clicked

It then reviews what it has found, categorises, scores and grades the website; and lists out what it has found, providing technical insight on what should be checked to address the issues idenitified.

Some sites are in great shape, like this one:

Many have some issues to resolve, but not really significant ones. Like this:

But a significant number are in very poor shape:

In each case the findings are set out in detail:

What technology architecture or platform is in place?
Is there a Consent Management Platform (CMP) in place; and if so, which?
Which cookies and trackers are in place?

So far we have completed over 3,000 scans. Even at this early stage some clear patterns are emerging:

A wide sectoral and scale spread in the F scoring sites
Specific tools appear to problematic
Specific platforms appear to be problematic
Specific Consent Management Platforms appear to be problematic

Drilling into those ‘F Scores’. So far, and at this stage, what we are seeing is very troubling. It is quite clear that there are a LOT of large organisations currently doing an awful lot of things around cookies and trackers that they should not be. Clear breaches of legislation. Many of those would appear to be mis-configurations. Many are not - organisations that clearly have the resources and scale to not be subject to under-resourcing or mis-configuration; but still doing all those things anyway.

Some poor scoring sites that we see are from

…. Large B2C brands
…. Charities
…. Local Authorities
…. Publishers
…. Political parties

We are not in the business of naming and shaming… DataPal is in the business of building trusted online relationships, working on a fiduciary basis from the individual perspective.

So, problems are identified with Privacy Pulse; as are positive stories - sites scoring highly; demonstrably doing what they should be doing.

Privacy Pulse finds and articulates the well deployed sites, and also the problematic ones. Privacy Pulse Index looks across the wider context to identify patterns.

Once we collectively understand the patterns, we can find solutions.

That’s our next product on the block

Privacy Pulse went live today; a small understated step with big intentions. So this is just a heads up that help is on the way for those now massively over-run Data Protection and Privacy Officers….and of course regulators.

Want to try Privacy Pulse yourself for Free, scan your own website and see what score and grade you get?

Scan your website for Free