What Automated Compliance Scanners Can (and Can't) Detect

Anything that shows up as an observable technical or content signal on a rendered page. That includes tracking scripts and cookies relative to consent state, the presence and basic implementation of a cookie banner, whether a privacy policy exists and covers expected disclosures, signals of AI-system usage and related disclosure text, and DOM-level accessibility issues — missing alt text, unlabeled form fields, insufficient color contrast, invalid ARIA roles, and similar structural problems.

A scan has no visibility into what happens after data leaves the browser: whether a data processing agreement exists with a third-party vendor, whether the legal basis claimed for processing is actually correct, how long data is retained on a server, or how an internal team handles a data subject access request. Those are organizational and contractual facts, not observable page signals.

It also can't make the subjective judgment calls a human reviewer makes — for example, whether alt text is merely present or actually describes the image meaningfully, or whether a page's reading order makes sense to someone using a screen reader in practice rather than just passing a structural check.

A scan reflects a site at the moment it was scanned. Sites change — a new marketing script gets added, a cookie banner is reconfigured, a plugin update changes what loads before consent. A single scan says nothing about that drift after the fact, which is the reason continuous monitoring exists as a distinct product tier rather than a one-off report being treated as a permanent certificate of compliance.

No. A scan crawls a set of representative URLs on a domain rather than exhausting every possible page, and it only evaluates pages that are publicly reachable — not content behind a login, a paywall, or a multi-step form flow. A site with thousands of pages built from a shared template is well represented by scanning a sample of that template's pages; a site where individual pages diverge significantly from each other is not fully covered by any single scan.

No, and no compliance platform should claim otherwise. A scanner is well suited to catching the technical issues that are easy to introduce and cheap to fix — an errant tracking script, a missing cookie banner, an unlabeled form field — continuously and at low cost. A lawyer or accessibility auditor is suited to evaluating legal basis, contracts, organizational processes, and the subjective judgment calls no automated tool can make. Businesses with meaningful compliance exposure typically need both: automated scanning for continuous technical monitoring, and qualified professional review for anything involving legal interpretation or nuanced accessibility judgment.