Illustrative EU compliance report
Static concept sample, generated January 15, 2026 – 06:02 UTC. Illustrative data. Not generated from a customer scan.
67%
Overall EU Compliance Score
Three items need attention — see findings below.
Not counted here: 1/9: DORA page-signal markers. 62% of the 8 checks that apply (5 of 8).
Attention needed
Score Summary
67%
Overall score
6/9
Checks passed
5/8
Passed, of the checks that apply
3
Items needing attention
30
Days of history
Detailed Check Results
- ✓ Google Consent Mode v2 Consent Mode v2 default state found (ad_storage and analytics_storage).
- ! IAB TCF One TCF signal found: __tcfapi. No IAB consent string is stored, so ad-tech partners cannot read the visitor's consent. → Store an IAB consent string through your CMP and expose it on __tcfapi. See https://iabeurope.eu/tcf/.
- ✕ Third-party trackers Trackers found in the served markup: Google Analytics, Meta Pixel. No consent platform is loaded before them, so they fire before consent. → Block non-essential tags until the visitor consents (GDPR Art. 6 and ePrivacy require consent BEFORE the tracker loads, not a banner afterwards).
- ✓ HTTPS & HSTS TLS 1.3 active, valid certificate (Let's Encrypt), HSTS max-age=31536000.
- ✓ Cookie consent Consent banner detected and cookie categories are declared (GDPR Art. 13).
- ✓ Forms & privacy link 5 forms detected, privacy policy linked in the footer.
- ✓ Legal pages Privacy policy and terms of service found on common paths.
- ! Security headers No Content-Security-Policy and no X-Frame-Options. NIS2 Art. 21 expects basic technical measures, and CSP is the one auditors ask for first. → Add Content-Security-Policy: default-src 'self'. Start in report-only mode and tighten from the violations it reports.
- ✓ DORA page-signal markers Page-text markers found: Incident response / SOC reporting, Status page / uptime monitoring, SPF (email sender auth). This is not a DORA assessment. Not counted here — DORA applies to financial entities, and a public page scan cannot tell whether the operator is one. This scan is not a DORA assessment.
This is the same set of checks the free scanner runs on every site, so nothing here is held back for Pro.
Recommended Fixes (priority order)
- IAB TCF — Store an IAB consent string through your CMP and expose it on __tcfapi. See https://iabeurope.eu/tcf/.
- Third-party trackers — Block non-essential tags until the visitor consents (GDPR Art. 6 and ePrivacy require consent BEFORE the tracker loads, not a banner afterwards).
- Security headers — Add Content-Security-Policy: default-src 'self'. Start in report-only mode and tighten from the violations it reports.
Illustrative 30-day history
Example score trend in this static sample:
Dec 17
Dec 21: illustrative score change in this static sample; no monitoring event occurred.
Attachments
This static concept sample shows the following illustrative documents. They are not included with the current Pro license.
- Compliance score badge concept — illustrative only; a live verification badge is not included today
- GDPR Data Processing Agreement (Art. 28) — controller → processor DPA with EU hosting clauses
- NIS2 Vendor Compliance Clause Set — audit-trail, incident-reporting and subcontractor clauses
- EAA Accessibility Statement — editable starter covering common EAA topics; it does not determine compliance