How Website Compliance Scanning Actually Works

Raw HTML fetched with a simple HTTP request often looks nothing like what a visitor's browser actually renders. Cookie banners, tracking scripts, and consent logic are frequently injected or modified by JavaScript after the initial page load — a plain HTML fetch never executes that JavaScript, so it can miss the exact behavior a compliance check cares about.

Rendering the page in a real browser engine executes that JavaScript the same way a visitor's browser would, which is what makes it possible to observe things like: does a tracking script actually fire before the user interacts with a consent banner, or only after.

Once a page is rendered, it's converted into a structured snapshot rather than analyzed as raw markup. That snapshot typically includes which scripts loaded and from where, what cookies were set and when, the page's DOM structure and text content, and — critically — the page's state both before and after simulated consent interaction, so a scanner can distinguish a script that fires immediately from one that only fires after consent is given.

Each module — GDPR, AI Act, accessibility — is a distinct rule set that reads the same underlying snapshot rather than triggering its own separate page load. The GDPR module looks for tracking scripts and cookies relative to consent state; the accessibility module evaluates DOM structure against WCAG success criteria; the AI Act module looks for signals of AI-system usage and related disclosures.

This is why adding a new compliance domain doesn't require rebuilding the scanning mechanism — it requires writing a new module that reads the signals already being captured, or extending the snapshot to capture new signals a module needs.

Some checks require limited interaction — for example, distinguishing scripts that fire only after a consent banner is dismissed from ones that fire regardless. The scanner does not create accounts, submit forms with real data, or take actions beyond what's needed to observe consent-gated behavior.