Understanding your compliance score

When to use this

Read this article when a scan completes and you need to interpret the headline score or explain it to non-technical colleagues. The compliance score is a weighted summary of automated checks—not a legal certification. High scores indicate fewer detected gaps against GDPRChecker’s rule set; low scores highlight prioritized fixes.

Scores can change between scans when you add tags, remove a banner, break policy URLs, or fix issues. Always compare findings lists, not only the number. A single critical finding may cap the score until resolved even if minor issues are clean.

Managed customers should correlate score drops with Runtime Health: sometimes public scan lags behind protection you already deployed due to caching or regional variance.

Category weights may emphasize pre-consent trackers heavily—a site with perfect policies but leaking GA4 before accept will still score poorly until blocking works. Conversely, cosmetic banner improvements alone rarely move the score if network behavior unchanged.

When presenting to executives, show trend lines across weekly scans rather than a single point-in-time number; compliance programs are judged on trajectory and open critical count.

Regression gates in CI can fail builds when critical finding count increases scan-over-scan for staging URLs you monitor automatically.

Step-by-step instructions

1. Open a completed scan report from /scanner or dashboard history.
2. Note the overall score and color band (good, needs attention, critical).
3. Expand each category: trackers, consent, policies, security headers where applicable.
4. Sort or filter by severity if the UI offers critical vs warning buckets.
5. For each critical item, read the recommendation text and linked help where present.
6. Fix highest-severity issues first—pre-consent trackers and missing reject paths typically dominate.
7. Republish consent or policies on managed sites, then wait and rescan.
8. Document score before/after in change tickets for audit trails.
9. Share the report PDF or link with legal review when findings touch policy content.
10. Tag scans in ticketing with domain and environment to compare trends quarter over quarter.
11. Export score history if dashboard provides timeline charts for leadership reviews.

Expected result

You can explain what the score measures and which three fixes would improve it most. Stakeholders understand that 100 is aspirational under automated rules, not a guarantee of regulatory outcome.

After remediation, rescans should show higher category scores and fewer open critical findings.

Teach reviewers to expand evidence sections: a failing tracker row should link to a GTM change ticket. Scores become a program management tool when every critical finding has owner and due date, not merely a marketing badge.

Troubleshooting