56 checks on every site, broad and deep.
Coverage is usually pieced together: a scanner here, a consent tool’s report there, an accessibility checker, a one-off audit when someone gets worried. One Tolbrook audit runs 56 checks on every site, from the first second a page loads to long after a visitor says no, and from the promises in a privacy policy to what the code actually does. No other provider we compared checks this much, in one place.
Find it. Fix it. Watch it.
Watch: How Tolbrook checks a website
Read the transcript
How do you check what a website really does? Not with one button. Here's how Tolbrook goes through a site, step by step.
We use a real browser, the same kind your shoppers use. We visit the way a shopper in the US would, on a laptop and on a phone. And each visit starts fresh, like someone arriving for the very first time.
First, we land and wait. We watch what starts running before anyone has made a choice, and which outside services already receive data about the visit.
Next, we say no. We press the reject button, the way a shopper would, and watch what keeps running, and who keeps receiving data. Then we visit again and say yes, so we can compare the two.
Some shoppers never click at all. Their browser sends an opt-out signal, called Global Privacy Control, asking sites not to sell or share their data. We send that signal too, on a visit of its own, and see how the site responds.
Then we go deeper. We open the contact, booking and checkout pages. We type made-up details into the forms, and we never send them. If those details reach an outside service before anyone presses send, we see it.
We also read your privacy policy, and check what it promises against what the site actually did. Every finding is checked again before it goes in a report, with the evidence: what was sent, where, and when.
So in one check: before any choice, after a no, with the signal on, inside the forms, and against your policy. On a laptop and on a phone. And with The Promise-Kept Year, we check again every week, as your site changes.
Read our sector reviews at tolbrook dot com slash reports. Find it. Fix it. Watch it.
56 checks in five categories
- Privacy choices · 27 checks
- What runs before anyone makes a choice, what keeps running after a no, and what the site does with the browser’s opt-out signal. Every outside service named, with what it was sent.
- What visitors type and look for · 6 checks
- Whether what a visitor types leaves the page before they press send, and whether health and other sensitive details reach advertisers.
- Policies and state rules · 16 checks
- The promises in the privacy and cookie policies, checked against what the site actually did, and the US state rules that apply.
- Security and accessibility · 4 checks
- Secret keys left in the site’s own code, its security headers, and an automated check for the accessibility barriers a machine can find.
- On a phone · 3 checks
- A separate phone-sized visit, compared with desktop, because many sites treat phones differently.
Ask any provider whether they do these
With The Promise-Kept Year, a full re-audit every week
Agencies, apps and campaigns change your site all the time. A monthly or one-off check can leave weeks where a new tag sends shopper data and nobody knows.
Ask: How often do you re-check the whole site?
A second visit before “nothing found”
A scanner that misses something and calls it clean gives false comfort. Before we report that something isn’t there, a second, slower visit has to agree. When we couldn’t check, we say so, and never call it a pass.
Ask: What do you do when your scan couldn’t see something?
A phone-sized visit, compared with desktop
Many sites show phones a different banner, or none at all. A desktop-only check never sees it.
Ask: Do you test the phone version separately?
A recording of the visit
Not a screenshot. The whole visit, captioned with each press and what was sent after it, so your developer, agency or lawyer sees exactly what we saw.
Ask: Can I watch what your scanner did?
What Google’s tags really carried
A banner can say “rejected” while the consent settings sent to Google say something else. We read the settings on Google’s own requests and set them beside the shopper’s choice.
Ask: Do you check Google’s consent settings, or only the banner?
Device fingerprinting
Some scripts recognise a device without storing anything on it, so a cookie list never shows them. We name which script read what, before any choice was made.
Ask: Do you look for fingerprinting, or only cookies?
Sensitive words in what’s sent to ad services
A page title or search term sent to an ad service can carry words about health, religion or sexual orientation. Those are the words shoppers least expect to be shared, so we look for them inside the requests themselves.
Ask: Do you read what’s inside the requests, or only where they go?
Secret keys in your site’s code
A key left in the code a browser downloads can be read by anyone. We name its kind and the file it’s in, never the key itself.
Ask: Does your privacy check look at security too?
Findings that stay yours
What we find on your site goes only to you. Our reviews give figures across a niche and name no business.
Ask: Who else sees my results?
Evidence kept four years, independently timestamped
Each audit is stamped by an independent timestamp service and kept at least four years, so you can show what was checked, and when, long after the site has changed.
Ask: How long do you keep my audits, and can anyone verify the dates?
Questions people ask
What does Tolbrook check that other website audits don’t?
With The Promise-Kept Year, Tolbrook re-audits the whole site every week, on desktop and phone, and records each visit. It confirms with a second visit before reporting that something isn’t there. It also checks what Google’s consent settings carried, device fingerprinting, sensitive words sent to ad services and secret keys in the site’s code, and keeps every audit with an independent timestamp for at least four years.
Do I still need a consent tool?
Yes. A consent tool puts the banner on your site. Tolbrook checks from the outside, as a shopper, whether the site does what the banner and your policies promise.
Is Tolbrook a law firm?
No. Your lawyer writes your privacy and cookie policies. We check that your changing website still keeps those promises, and give your lawyer the evidence.
Your digital presence holds promises. We make sure you keep them.