How the score is calculated

Severity levels and the points each check carries

Every check that applies to your scan carries points. How many depends on the check’s usual severity, which is the severity its article in the Handbook shows.

The points are PeekWell’s own. We set them from how we read the rules and what we’ve seen regulators act on. You won’t find them in any law.

Six checks carry a little more or a little less than their level gives.

Three high checks carry 8 instead of 6, because that’s where we’ve seen regulators most active:

• UK-02 Whether rejecting cookies is as easy as accepting them.
• US-04 Whether the policy mentions selling or sharing data when the ad tools on the site suggest it happens.
• US-06 Whether the site works with a keyboard, a screen reader and readable contrast.

Three medium checks carry 2 instead of 3, because the duty is new and has little record yet:

• UK-05 Whether ad-tech partners load before the visitor has agreed.
• UK-08 Whether there is a clear way to complain about how you handle data.
• EU-16 Whether a customer can withdraw from an online purchase on the site itself, in two clear steps.

Four checks that follow company size

Four checks carry more points for a bigger company. That’s our own weighting: on these four we expect more of a business that has more people to do the work. Every other check weighs the same at any size.

Company size, further down, says which size Peeky uses for you.

What is left out

Two kinds of check are left out of the score entirely. They neither earn points nor cost any.

• A check that doesn’t apply to the company. The subscription checks on a site that sells no subscription, for example, or the California checks when California isn’t one of your markets.
• A check that could not be tested.

What remains is the points that applied, and the score is worked out over those alone.

What a finding costs

Each check that applied ends up one of six ways on the report. This is what each one costs.

When a finding comes out milder

Peeky starts from the check’s usual severity and moves at most one step, depending on what it saw: how many pages, how many trackers, whether personal data left the browser. A milder finding costs a share.

• A high check found at medium costs 3/6, half its points.
• A critical check found at high costs 6/10.
• A medium check found at low costs 1/3.

A few checks set the severity for what was seen, and those can land further from their usual one. The privacy policy checks, EU-09, UK-10 and US-13, are critical when a site has no policy at all and high when the policy is hard to find or in another language. On US-13, a posted policy that leaves out points the law lists is medium, or low for one small point, and a critical check found at medium costs 3/10.

Some findings don’t come out milder. On a site with no cookie banner, trackers that start before anyone answers stay critical, however few there are, because no visitor can say no to them.

When a finding is AI-flagged

An AI-flagged finding is one AI raised that a person hasn’t confirmed yet, and the report labels it that way. It costs half of what it otherwise would. Once a PeekWell reviewer confirms it, it costs in full.

When a finding is left open

A finding is left open, or inconclusive, when what Peeky recorded can be read two ways: a sentence in the policy with two meanings, say, or a request to a service the site may need in order to work. It costs a quarter of the check’s points until a PeekWell review rules on it.

Some things never leave a finding open. A tracker that started on some visits and not on others did start, and the report says how often. A privacy policy that doesn’t exist is missing. And a question only you can answer, such as what your contract with a service says, goes into the fix as a question to settle first. Peeky decides each of these on what it saw.

Weighted scoring: how the points add up

The score is the points you kept, divided by the points that applied, times 100, rounded to the nearest whole number.

score =points keptpoints that applied× 100

Points kept are what’s left once every finding has taken its cost. Points that applied are the points of every check that was scored, after the checks in What is left out are gone.

This is ordinary weighted scoring. A check with 10 points pulls on the result ten times as hard as a check with 1.

The critical rule

If the report has any finding at critical severity, the score can’t be higher than 69. That’s one point under the accreditation line of 70. It holds however many other checks passed, and however the finding was detected.

The rule lifts when the finding is fixed and the next scan passes the check. It also lifts when a PeekWell review withdraws the finding or lowers its severity. A scan whose points already put it under 69 isn’t changed by the rule.

What counts is the severity on the finding. If the same check is found at high, say on one page only, it costs 6 points, the score is 93 and the rule stays out of it.

Worked examples

Every example here is an EU scan of a medium-sized company where all 16 EU checks apply. That’s 81 points. The first one is worked line by line.

What your website score means

Wherever a score is drawn, its colour tells you the zone.

• 70
  Mint green from 70
• 40
  Brass from 40 to 69
• 39
  Brick red under 40

The same number can come from different reports, so read each band as what usually sits behind it.

• 93

  of 100

  90 to 100 mint green

  Close to clean. No critical finding, and at most one high finding or a couple of small ones.

  In plain words Nearly everything Peeky looked for was there. There’s one thing to fix, maybe two small ones.

  For example Everything is in order, except the privacy policy doesn’t name the chat tool the site loads.

• 78

  of 100

  70 to 89 mint green

  The accreditation range. The report has real findings on it, typically two or three high ones or a handful of medium ones, and none is critical.

  In plain words Enough for the badge, with a to-do list attached. Nothing on the list is critical.

  For example Mostly in order. Saying no to cookies takes more clicks than saying yes, the privacy policy leaves out the email tool, and there’s no clear way to ask for your data.

• 69

  of 100

  50 to 69 brass

  Not in the accreditation range. Either one critical finding is holding an otherwise good site at 69, or there are four to six substantial findings.

  In plain words Two different sites end up here. One has a single critical thing to fix and little else. The other has a list. A score of exactly 69 is very often the first kind.

  For example One site passes everything but one check: an analytics script starts before the visitor has answered the cookie banner. That one finding holds the score at 69. Another has nothing critical, but saying no takes extra clicks, the privacy policy leaves out a tool and promises something the site doesn’t do, there’s no clear way to ask for your data and nothing says who runs the business.

• 47

  of 100

  40 to 49 brass

  Roughly half the points are gone. Usually a critical finding together with several high ones.

  In plain words About half of what Peeky weighs came back with a finding, and one of those findings is critical.

  For example Ad trackers start before the visitor agrees, and saying no takes extra clicks. The privacy policy leaves out tools and where the data goes, promises things the site doesn’t do and gives no way to ask for your data. A sale countdown restarts on every visit, and nothing says who runs the business.

• 38

  of 100

  20 to 39 brick red

  Most of what weighs the most found something: typically two critical checks and most of the high ones.

  In plain words The heavy checks nearly all have a finding. The critical ones are the place to start, at 10 points each.

  For example Tracking starts before the visitor agrees and carries on after they say no. Saying no takes extra clicks, too. The privacy policy leaves out tools and where the data goes, misses what it has to tell visitors, promises things the site doesn’t do and gives no way to ask for your data.

• 15

  of 100

  0 to 19 brick red

  Nearly every check found something.

  In plain words Almost nothing Peeky looked for was in place. The report is long, and at this end every fix moves the number.

  For example Ad trackers run with no cookie banner. The privacy policy is a template paragraph that says the site uses no cookies. Nothing says who runs the business or where the reviews came from, and that’s only the start of the list.

Company size

For most checks, your size changes nothing. The exception is the four checks that follow company size.

Peeky uses the size on your company profile when the scan is requested. Micro is under 10 people, small is 10 to 49, medium is 50 to 249 and large is 250 or more. A company that hasn’t said its size is scored at the medium figure.

Size also decides whether one check is scored at all. Peeky leaves EU-10, the accessibility check, out for a company of under 10 people. It goes by the head count on your profile and nothing else.

When a score changes

A score belongs to one scan. Three things can give you a different one.

• A new scan.
• A PeekWell review that rules on a finding. A finding that’s withdrawn or fixed counts as passed, and a finding whose severity changes is scored at the new severity.
• A new rule set. Each score is measured against the rule set of its date, and a new one can add checks or change the points they carry.

A report issued before this method keeps the score it was issued with. The company’s next scan uses this method.

What the score is not

The score adds up what Peeky observed on the pages it scanned, weighed by the points on this page. It isn’t a statement that a website is compliant, and it isn’t legal advice.

The points, the line of 70 and the critical rule are PeekWell’s own way of weighing what it saw. For the law itself, read the check’s article in the Handbook.

Passed means the expected behaviour was observed on the pages scanned. Neither a Passed nor the score says a website is compliant.

Points for every check

Every check Peeky runs, with its usual severity and the points it carries. Each one links to its article.