What's wrong with your website?

Every WCAG-based accessibility finding cites the specific WCAG 2.1 success criterion it tested, alongside the jurisdictional instruments that reference that criterion, including the DOJ’s 2024 Title II rule, which makes WCAG 2.1 Level AA a binding target for state and local government web content. Findings from best-practice checks cite the general WCAG standard only, because they map to no success criterion.

Section 508 sets WCAG 2.0 Level AA as the benchmark for federal agencies’ information technology. Our checks target WCAG 2.1 Level AA, which contains all of 2.0 Level AA. We don’t test Section 508’s non-web provisions such as hardware, software, or documentation.

Our security checks read response headers, the negotiated TLS configuration, and mixed content, concrete instances of the secure-defaults principle CISA’s guidance asks software makers to ship. That guidance is a set of principles rather than a testable specification, so this is alignment, not a clause-by-clause mapping.

Privacy findings carry FTC Section 5 and data minimization as their reference. We check whether known trackers load before a consent choice is made, whether third-party cookies are set on first load, whether a privacy policy link exists, and whether a form asks for more data than its apparent purpose needs.

On a site that shows commercial signals (a cart or checkout flow, a pricing page, or an embedded payment provider), we check whether it offers a “Do Not Sell or Share My Personal Information” or “Your Privacy Choices” opt-out link (the clear-and-conspicuous link CPRA §1798.135 requires) and flag the finding for California. The scan still does not score opt-out preference signals such as Global Privacy Control, or consumer request flows. Our free cookie consent checker does send a GPC signal and reports what loaded with it set, which is an observation of one page load rather than a finding: it cannot certify that a site honours the signal, because answering that needs a second load to compare against.

The Deceptive Design Risk dimension checks the patterns that report describes: pre-checked marketing opt-ins, consent banners where Accept is more prominent than Reject, rejecting that takes extra steps, costs that appear only inside a form, and countdown or scarcity widgets.

EN 301 549 is the European accessibility standard for information technology, and its web clause adopts WCAG 2.1 Level AA, exactly the criteria our accessibility rules test. We evaluate the web criteria only, not EN 301 549’s non-web clauses. Separately, we check whether the site links to an accessibility statement (the transparency obligation the EAA places on in-scope service providers under Art. 13(2) and Annex V) and flag its absence for the EU. That is a non-WCAG check on link presence, so it cites no success criterion.

Our consent checks examine the mechanics these rules turn on: whether tracking scripts load before any choice is made, and whether a banner offers a visible reject control at all. Region-specific findings are now flagged with the instrument that governs them in each market (ePrivacy Art. 5(3) and GDPR Art. 7 here) via RegionScopes; some are multi-jurisdiction, such as the third-party-cookie-before-consent finding, which is flagged for the EU (ePrivacy Art. 5(3)), the UK (PECR Reg. 6) and California (CPRA §1798.100). We do not assess lawful basis, international transfers, or records of processing.

The Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations require public sector sites to meet an accessibility requirement that maps to WCAG 2.1 Level AA through EN 301 549, the criteria our accessibility rules test. They also require an accessibility statement (Reg. 8); we check whether the site links to one and flag its absence for the UK. That is a non-WCAG check on link presence, so it cites no success criterion, and the statement obligation binds public sector bodies specifically.

The Equality Act names no technical standard. It requires reasonable adjustments for disabled people, and WCAG 2.1 Level AA is the benchmark UK practice points to. Our checks give you evidence about that benchmark; they do not determine whether an adjustment was reasonable.

Ontario’s Integrated Accessibility Standards Regulation requires WCAG 2.0 Level AA for public websites. Our checks target WCAG 2.1 Level AA, which contains all of 2.0 Level AA, so the criteria the regulation names are among those we evaluate. We don’t test the IASR’s non-web requirements, and evaluating those criteria is not the same as certifying conformance with them.

Federally regulated organisations work to the Accessible Canada Act, whose information-technology accessibility standard adopts EN 301 549, which in turn adopts WCAG 2.1 Level AA for web content.

The DDA names no technical standard for web content. WCAG Level AA is the benchmark Australian government digital guidance uses, and those criteria are what our accessibility rules evaluate, producing evidence about accessibility, not a conclusion about discrimination liability.