How every score stays tied to evidence.

Each run opens an isolated browser session, validates the final storefront document, and retains sanitized receipts from page navigation, safe commerce controls, network delivery, cookies, data layers, scripts, consent interactions, and Google PageSpeed Insights when available.

Challenge pages, HTTP error documents, and unrelated redirects are access outcomes—not tracking evidence. The audit never places an order, submits payment, bypasses a security challenge, or treats an unexercised action as a failed event.

• Measurement & attribution combines ads and analytics evidence: 35 weighted points in the overall score.
• Consent & privacy measures verified choice behavior and outbound data hygiene: 20 weighted points.
• Implementation measures first-party delivery, ownership, duplication, GTM, and data-layer operation: 10 weighted points.
• Security measures trusted conversion proof, deduplication boundaries, and verified exposure: 25 weighted points.
• Storefront performance measures PageSpeed and retained tracking cost: 10 weighted points.

The six technical categories add to 100 weighted points and roll up into five merchant-facing areas. A category earns points only after every applicable rule has an explicit pass, fail, or review receipt. Missing, blocked, and unexercised coverage contributes no verified points and is not disguised as a deduction.

Every actual category deduction must reconcile to a visible evidence-bound finding. The public report shows one current score from earned retained evidence, while evidence coverage stays separate. A score and grade become final only when all six weighted technical categories and every requested regional profile are verified. Zero verified weighted coverage produces no score.

A ceiling is valid only when it names one of the five areas, references a visible rule, and carries retained evidence. Hidden backend scores and unverified legacy ceilings cannot lower the public score.

Traffic from a page labeled REJECT_ALL is not automatically post-reject evidence. The browser must retain proof that the reject control was found, attempted, and clicked. Without that receipt, reload traffic remains a coverage review and cannot fail consent or cap the score.

A perfect consent score is available only when retained default-state evidence explicitly supports that non-essential tracking was absent, or every required regional choice receipt is verified. Empty evidence makes applicability undetermined; it never becomes not required, clear, or compliant. Active non-EU marketing with no detectable privacy mechanism is scored as a governance gap. Neither finding alone asserts a universal US banner mandate or a legal conclusion.

• Verified: every applicable rule retained an explicit outcome and the exercised checks produced no scored or review finding.
• Failed: retained evidence supports a scored rule finding.
• Review: configuration or legacy evidence needs verification but is not a scored failure.
• Not exercised: the run did not safely complete that action; this is never treated as a pass or failure.
• Blocked: privacy policy, browser policy, or access controls prevented the check and are reported separately.

Google PageSpeed is retained per device. The report opens on mobile and shows one strategy at a time; switch to desktop for comparison. When both device results are available, the internal storefront performance composite weights mobile 70% and desktop 30%; a single available device remains explicitly single-device. Accessibility, best-practices, and SEO scores are context and do not affect the tracking score.

PageSpeed describes the whole page and never proves that tracking caused a diagnostic. Browser-measured tracking transfer, request, and main-thread evidence remains separate. A measured zero is shown only when that measurement completed; otherwise the field is unavailable.

Confidence reflects scenario and requested-profile coverage, interaction receipts, proof coverage, and semantic consistency. Missing required scenarios or regional captures keep the audit provisional and reduce coverage; score, cap, or evidence inconsistencies prevent a high-confidence label. Confidence describes the audit evidence, not the quality of the storefront itself.

Public auditing cannot see private server logs, ad-platform dashboards, unpublished GTM workspaces, authenticated checkout state, or a real completed order unless the operator supplies a separate trusted receipt. Results are a timestamped observation and should be rerun after theme, app, consent, tag, or routing changes.