Methodology

Scanner Engine v4.1 "Predator" — May 2026

1. Scanning Architecture

The NLTS Privacy Audit Scanner uses a hybrid pipeline combining static HTTP analysis with dynamic headless browser testing (Chromium via Playwright). Every scan produces cryptographically signed evidence (Ed25519 + SHA-256).

Two scan modes: Light Scan (headers, TLS, DNS — <5 seconds, free) and Forensic Audit (6-phase browser analysis — 2-3 minutes, Ed25519-signed report).

Anti-Bot Evasion: Residential proxy routing (Decodo/Smartproxy) + stealth configuration (navigator.webdriver, Client Hints, WebGL renderer, plugins, chrome.runtime). Ad-tech endpoints (Meta, TikTok, Google) sometimes serve empty responses to datacenter IPs — the scanner circumvents this through real residential IPs. A counter-scan without stealth detects bot discrimination (delta reported as a separate finding).

2. Checks Performed

Standard Checks (Light + Forensic)

• Security Headers: HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP [Calzavara et al., CCS '25; Khodayari & Pellegrino, WWW '26]
• TLS/SSL: Protocol version, cipher suite strength, certificate validity, key strength
• DNS Security: SPF, DMARC, DNSSEC, CAA, IPv6
• Cookie Analysis: First/third-party classification, Secure/HttpOnly/SameSite flags, tracker matching [Bollinger et al., USENIX '22/24; Consent Observatory, CHI '25]

Forensic-Only Checks

• Pre-Consent-Tracking: Full page load in headless browser without any consent interaction. All network requests classified as pre-consent. [Bollinger et al., USENIX '22; Papadogiannakis et al., arXiv '21]
• Dynamic User Journey: Scroll, mouse movement, and click simulation BEFORE consent — detects interaction-triggered trackers.
• Google Consent Mode v2: Detection of consent defaults. Cookieless pings with gcs=G1 are correctly excluded from violations.
• CMP Detection & Interaction: 20 specialized CMP drivers (Usercentrics, Sourcepoint, OneTrust, Cookiebot, etc.) + IAB TCF 2.x + generic button search + AI vision fallback + recursive Shadow DOM search (5 levels).
• Reject-Leak-Test v4: Separate browser session. Consent rejected (soft-reject “Necessary only” vs. hard-reject “Reject all” is classified), then 6-phase forensic analysis: Immediate (0-5s), Scroll (5-15s), Interaction (15-25s, Bezier-curve mouse trajectories), Navigation (3 internal subpage clicks), Delayed (timer/interval), Beforeunload (sendBeacon + fetch keepalive interception). Each request tagged with its trigger context.
• Server-Side Tracking: CNAME cloaking (28 targets), GTM server containers, First-Party GTM detection (GA4 event stream + cloud A-record), payload parameter matching (17 parameters), reverse proxy detection. [Fouad et al., PoPETs '24; Mertens et al. '26; Dao et al., IEEE TNSM '21]
• Fingerprinting: API hooks before page load (Blacklight method): Canvas, WebGL, AudioContext, Battery, Connection API, hardware probes (hardwareConcurrency, deviceMemory), font enumeration (measureText), screen fingerprinting, performance timing, WebGL2 extensions.
• Compliance Check: Three-way comparison: actual tracking vs. privacy policy (DSE) vs. consent banner (CMP) configuration.
• GeoIP & Third-Country Transfers: IP geolocation + ASN + TLS certificate issuer analysis. Automated Schrems II / DPF assessment.
• Consent Mode Deception: Payload comparison denied vs. granted via Jaccard coefficient (>50% = deception flag). gcs parameter (G1xx = denied) correctly excluded.
• Button Contrast Forensics: CSS-based WCAG luminance calculation for Accept vs. Reject button asymmetry scoring.
• Session-Replay-Erkennung: Detection of session recording tools (Clarity, Hotjar, FullStory, LogRocket) via event hooks, MutationObserver, WebSocket tracking, IndexedDB scanning.
• Advanced Tracking Detection (8 categories): Bounce tracking, ETag/cache tracking, Service Worker persistence, font enumeration, WebRTC leak, favicon supercookie, WASM trackers, postMessage cross-site communication.
• IAB TCF v2.2 — Full Integrity Check: BitReader-based TC string decoder. Checks: vendor consent vs. loaded trackers (undisclosed trackers), phantom vendors, legitimate interest abuse (Purposes 3-5 on LI instead of consent), special feature opt-ins. GVL loaded daily from iabeurope.eu (1,000+ vendors). [EuGH C-604/22; EDPB Opinion 07/2023; Demir et al. 2022]
• Cookie Sync Detection: Detects ID synchronization requests between ad networks (redirect chains, usersync/pixelSync URLs, ID parameters). Classifies pre/post-consent phase and GDPR signal presence. [Acar et al. CCS 2014; Urban et al. WWW 2020]
• Consent Signal Propagation: Verifies whether after consent click GCM v2 (denied→granted) and TCF string are correctly forwarded to ad servers. Detects consent-washing (CMP pretends to process but does not forward). Art. 7(3) GDPR.
• DSA Compliance (Art. 25/26): Checks for dark patterns per EU Digital Services Act: confirmshaming, cookie walls/pay-or-consent, fake urgency, subscription traps, disguised advertising (DSA Art. 25).
• Storage Tracking (localStorage, IndexedDB, Cache API, Service Worker): Captures ALL browser storage channels used for persistent identification: localStorage, sessionStorage, IndexedDB (bounce tracking), Cache API (supercookies), Service Worker, Broadcast Channel, OPFS. [§ 25 TDDDG; Solomos et al. 2021; Englehardt & Narayanan 2016]
• Privacy Sandbox / Topics API: Detection of Chrome Privacy Sandbox APIs: Topics API (document.browsingTopics()), Private State Tokens, Attribution Reporting API, CHIPS, FedCM. GDPR consent still required.
• Visual Dark Patterns (AI Vision): Consent banner screenshots (pre/post-consent, reject) analyzed via Claude Vision. Detects: interface interference, confirmshaming, color manipulation, hidden rejection options, fake urgency, pre-selected checkboxes. Bounding-box annotation in report. [Lin et al. 2024 DPDGPT; EDPB 03/2022]
• Bot Discrimination Check: Comparison of stealth scan vs. direct scan. Significant delta = site serves different tracking payloads to detected bots.
• Fingerprint Correlation: Two independent sessions, Canvas hash/WebGL/AudioContext comparison. Identical values = stable fingerprinting capability proven.
• CNAME-Cloaking: DNS CNAME resolution of all subdomains against tracker DB. Detects first-party subdomains pointing to third-party tracker servers (45 known cloaking targets). [Dao et al. IEEE TNSM 2021; Fouad et al. PoPETs 2024]

3. Scoring Model

Grades range from A+ (excellent) to F (critical). The overall grade is a weighted average of individual check grades.

KO System: Certain critical violations result in an immediate F grade regardless of other scores:

• Reject-Leak (trackers firing despite rejection)
• 5+ pre-consent trackers
• Fingerprinting combined with pre-consent tracking
• High-risk third-country transfers (China, Russia, etc.)

4. Legal Framework

Every technical finding is mapped to the applicable legal provision via our GDPR Article Matrix:

• GDPR Articles 5-45 (processing principles, consent, transparency, security, transfers)
• § 25 TDDDG (German implementation of ePrivacy Directive Art. 5(3))
• EDPB Guidelines (05/2020 on Consent, 03/2022 on Dark Patterns)
• CJEU case law (C-673/17 Planet49, C-311/18 Schrems II, C-634/21 SCHUFA)
• DSK Guidelines for Telemedia 2021 (marginal notes: para. 10 pre-consent, para. 30 reject button, para. 45 fingerprinting)

§ 25 TDDDG Purpose Mapping: Every detected tracker is automatically classified by legal purpose (strictly necessary, functional, analytics, marketing). Only “strictly necessary” under § 25(2) No. 2 TDDDG is consent-exempt — the strict interpretation of the German Data Protection Conference (DSK) is applied.

For US jurisdiction: CCPA/CPRA compliance checks including "Do Not Sell" link detection and Global Privacy Control (GPC) support verification.

5. Evidence Chain & Forensic Integrity

Every scan produces a cryptographically chained evidence log (hash chain). Each entry (phase) contains the SHA-256 hash of the previous phase — tampering with any single entry breaks the entire chain.

• SHA-256 content hash of scanned page (reproducibility proof)
• Hash chain: Each scan phase (DNS, headers, cookies, pre-consent, CMP, post-consent, reject-leak) is chained with its predecessor hash
• Pre/post-consent screenshots (timestamped)
• HAR file (complete network capture)
• Source code snapshots (pre/post consent DOM)
• Ed25519 digital signature on every report
• QR code linking to online verification page
• Consistency check (2 repeat scans for reproducibility)
• Certificate Transparency Anchor: The TLS certificate is verified against public CT logs (crt.sh). Ensures no manipulated certificate was present at scan time.
• OpenTimestamps: Bitcoin blockchain-based timestamping. The report’s SHA-256 hash is anchored in the Bitcoin blockchain — independent cryptographic proof of existence without trusted third parties.
• Scan Seed (Reproducibility): Every scan records: user agent, viewport, locale, timezone, proxy configuration, stealth status. This allows exact reproduction of every scan.

6. Dark Pattern Analysis

The optional Forensic + Dark Patterns scan adds automated deceptive design detection grounded in 14 peer-reviewed scientific sources. The system combines AI vision analysis (Claude multimodal) with heuristic page classification to identify 26 manipulative interface patterns across critical user journeys.

Scientific Foundation — 14 Sources

Detection is grounded in three core taxonomies plus 11 supplementary empirical studies:

• Gray et al. (2018) — “The Dark (Patterns) Side of UX Design” (CHI 2018) — 5 core strategies: Nagging, Obstruction, Sneaking, Interface Interference, Forced Action
• Mathur et al. (2019) — “Dark Patterns at Scale” (Princeton/CSCW 2019) — 11,000 shopping sites, 15 types, 1,818 instances
• EDPB Guidelines 03/2022 — “Dark Patterns in Social Media Platform Interfaces” — EU regulatory taxonomy: Overloading, Skipping, Stirring, Hindering, Left in the Dark, Fickle
• Nouwens et al. (2020) — CHI 2020 — 680 banners analyzed, only 11.8% GDPR-compliant, pre-selection increases consent by 83%
• Matte et al. (2020) — 89% violation rate on TCF-compliant websites
• Luguri & Strahilevitz (2021) — J. Legal Analysis — aggressive patterns lead to 4x subscription rates
• Santos et al. (2021) — WPES 2021 — 61% violate purpose limitation, 30% use positive framing
• Bollinger et al. (2022) — USENIX Security — automated cookie consent and GDPR violation detection
• Kirkman et al. (2023) — DarkDialogs (EuroS&P) — 10,000 websites, 89.5% have ≥1 dark pattern
• Khandelwal et al. (2023) — CookieEnforcer (USENIX Security) — 93.7% automated opt-out success rate
• Lin et al. (2024) — DPDGPT — multimodal LLM dark pattern detection, 19 types, F1 0.88
• Singh et al. (2026) — “UMBRA: Unified Model for Black-hat Recognition and Analysis”, Proc. ACM CHI 2026, pp. 1–18 — 99% detection, 19 patterns, 14,000-website study
• noyb (2024) — Cookie Banner Report — 422+ formal GDPR complaints
• EU DSA (2024) — Regulation 2022/2065, Art. 25(1) — explicit dark pattern prohibition

Every finding is mapped to all three core taxonomies simultaneously, enabling both academic and regulatory referencing.

26 Pattern Types Detected

Each pattern is classified into three categories. Full detection descriptions and legal mappings below.

Consent Manipulation:

• Button Asymmetry: Accept button visually more prominent than Reject (size, color, position) — WCAG luminance analysis
• Confirmshaming: Reject option uses negative or emotional language to discourage rejection
• Preselection: Non-essential categories pre-checked in consent banner (cf. CJEU C-673/17 Planet49)
• Hidden Reject: Reject button missing or not findable on first interaction level
• Cookie Wall: Website only usable with tracking consent; no real reject option (EDPB 05/2020 Rn. 39)
• Positive Framing: Banner headline emphasizes benefits of tracking to nudge consent (Santos 2021, Art. 12 GDPR)

Interface Deception:

• Maze Navigation: Opt-out or data subject rights require excessive navigation steps
• Bait & Switch: User expects one result but receives another (e.g. “Close” button triggers acceptance)
• Trick Questions: Confusing formulations leading to unintended clicks (double negatives, inverted checkboxes)
• Nagging: Repeated unsolicited requests for consent or purchase
• Information Overload: Excessive text or options overwhelming the user
• Forced Registration: Service requires account creation when legally not necessary
• Deliberate Downgrading: Free or legally mandated options visually degraded vs. paid alternatives
• Decontextualising: Privacy information placed in wrong or misleading context
• Contradictory Information: Privacy policy, CMP configuration, and actual behavior contradict each other

Evolved Patterns (2023–2026 research):

• Revocation Friction: Revoking consent requires more steps than granting it (Art. 7(3) GDPR)
• Pay-for-Privacy: Users must pay to reject tracking — “Consent or Pay” walls (EuGH C-252/21)
• Multi-Layer Misdirection: Accept on layer 1, reject on layer 3+ through nested UI
• Legal Ambiguity: Deliberately vague consent language (Art. 12(1) GDPR)
• Dark Pattern Masquerading: Marketing cookies disguised as accessibility features (DSA Art. 25)

Technical Deception:

• Implied Consent: No banner, tracking active by default (§25 TDDDG)
• Consent Theatre: Banner exists but implementation ignores user choice (Matte 2020: 89% TCF violation rate)
• Category Manipulation: Marketing trackers hidden under “Essential” category (e.g. Google Analytics as “functional”)
• Language Discontinuity: Privacy texts in different language than site content (EDPB Fickle)
• Geo/Device Variation: Different consent flows by country/device (DSA Art. 25(2))

Detection Method

Multi-page crawl with priority-based page classification (pricing, checkout, cancellation, rights, consent, legal). Each page is analyzed via full-page screenshot + extracted DOM text using Claude multimodal vision. Industry-specific context (e-commerce, financial services, credit bureaus) reduces false positives. Confidence threshold: only findings with ≥70% confidence are reported. Page-type weighting ensures high-risk pages receive higher scrutiny.

Legal Mapping

Each pattern links to specific legal provisions: Art. 7 GDPR (consent validity), Art. 12 GDPR (transparency), Art. 15 GDPR (access rights), §25 TDDDG, §312k BGB (cancellation button), §5 UWG (misleading practices), DSA Art. 25 (dark pattern prohibition), EDPB Guidelines 03/2022 and 05/2020, and relevant CJEU rulings (C-673/17 Planet49, C-311/18 Schrems II, C-252/21 Meta) as well as CNIL and noyb enforcement decisions.

7. Tracker Database

Internal database with 240+ curated trackers (source=manual) + 100 cookie profiles + 45 CNAME cloaking targets + EasyPrivacy filter list + DuckDuckGo Tracker Radar (~57,000 domains, weekly auto-update, Sundays 03:00 UTC). Each import is logged with SHA-256 and date (audit trail).

CDN Allowlist (False-Positive Reduction): Legitimate CDN and infrastructure domains (cdnjs, Cloudflare Fonts, jQuery CDN, etc.) are excluded from third-party tracker alerts via a curated allowlist. The list is reviewed with each release.

8. Consent Banner Accessibility (WCAG 2.1 AA)

Automated WCAG 2.1 AA audit of the consent banner incl. contrast ratio calculation (relative luminance, SC 1.4.3). Consent must be equally accessible to ALL users (EDPB 05/2020 para. 85, EAA from 28 June 2025). [UAHCI 2025; EAA/BFSG; W3C WCAG 2.2]

• ARIA roles (role=dialog, aria-modal, aria-label)
• Keyboard operability (tab order, focus trap, Enter/Escape)
• Font size (≥12px), minimum button size
• Contrast check Accept vs. Reject

9. Cookie Wall Detection

Detection of “take it or leave it” patterns per EDPB 05/2020 and Art. 7(4) GDPR. [Consent Observatory, CHI '25; Qu et al. '25; EuGH C-252/21 Meta]

• Persistent overlay (blocks content after rejection)
• Content blockade (display:none on main content)
• Redirect after rejection
• Pur-Abo / Pay-or-OK detection

10. Tracker Performance Impact

Quantification of third-party tracker impact on page load time (Core Web Vitals). Comparison with web median benchmarks. [HTTP Archive / third-party-web (Hulce); Google Web Vitals '24]

• LCP, FCP, DOM Content Loaded
• Tracker share of requests and transfer volume
• Blocking tracker scripts (render-blocking)
• Estimated tracker-caused delay in milliseconds

11. Mobile Scan

Comparison desktop vs. mobile (iPhone 15 Pro, 390×844): Some websites load mobile-specific trackers or show an unusable consent banner.

• Pre-consent tracker comparison desktop vs. mobile
• Mobile-only trackers (loaded only on mobile devices)
• Consent banner usability on mobile

12. Automated Fix Suggestions

For each finding, the scanner generates concrete, copy-paste-ready configuration suggestions.

• Security headers (CSP, HSTS, X-Frame-Options etc.)
• Cookie attributes (Secure, HttpOnly, SameSite)
• GTM Consent Mode v2 configuration
• TLS optimizations

13. Limitations

• Server-side tracking that forwards data purely on the backend (server-to-server) without any detectable URL parameters, CNAME records, cloud endpoints, or GTM patterns remains invisible. Our SST detection covers CNAME cloaking (28 targets), GTM server containers, payload-based proxying, and reverse proxy detection (Cloud Functions, Workers, Vercel, Netlify) — but not opaque server-to-server forwarding.
• Content behind login walls is not analyzed.
• Single-page applications are analyzed for the initial route only.
• Geographic content variations are scanned from a German perspective (de-DE locale, Europe/Berlin timezone).
• The GPC compliance check verifies JavaScript API support and behavioral changes (tracker reduction) — server-side processing of the Sec-GPC header cannot be verified.

14. Bibliography

1. Gray, C. M. et al. (2018). “The Dark (Patterns) Side of UX Design.” Proc. ACM CHI 2018, pp. 534:1–14. DOI: 10.1145/3173574.3174108
2. Mathur, A. et al. (2019). “Dark Patterns at Scale: Findings from a Crawl of 11K Shopping Websites.” Proc. ACM CSCW 2019, Art. 81. DOI: 10.1145/3359183
3. Matte, C. et al. (2020). “Do Cookie Banners Respect my Choice?” Proc. IEEE S&P 2020, pp. 791–809. DOI: 10.1109/SP40000.2020.00005
4. Nouwens, M. et al. (2020). “Dark Patterns after the GDPR.” Proc. ACM CHI 2020, pp. 1–13. DOI: 10.1145/3313831.3376321
5. Santos, C. et al. (2021). “Cookie Banners, What’s the Purpose?” Proc. WPES 2021, pp. 187–194. DOI: 10.1145/3463676.3485611
6. Luguri, J. & Strahilevitz, L. (2021). “Shining a Light on Dark Patterns.” J. Legal Analysis, 13(1), pp. 43–109. DOI: 10.1093/jla/laaa006
7. Dao, H. et al. (2021). “Characterizing CNAME Cloaking-Based Tracking.” IEEE TNSM, 18(3), pp. 3202–3215. DOI: 10.1109/TNSM.2021.3055955
8. Papadogiannakis, E. et al. (2021). “User Tracking in the Post-cookie Era.” arXiv:2102.07278.
9. Bollinger, D. et al. (2022). “Automating Cookie Consent and GDPR Violation Detection.” Proc. USENIX Security 2022, pp. 2893–2910.
10. EDPB (2020). Guidelines 05/2020 on Consent under Regulation 2016/679. Version 1.1, May 2020.
11. EDPB (2022). Guidelines 03/2022 on Dark Patterns in Social Media Platform Interfaces. March 2022.
12. Kirkman, A. et al. (2023). “DarkDialogs: Automated Detection of Dark Patterns in Cookie Consent Dialogs.” Proc. IEEE EuroS&P 2023, pp. 874–891.
13. Khandelwal, H. et al. (2023). “CookieEnforcer: Automated Cookie Consent with 93.7% Opt-Out Success Rate.” Proc. USENIX Security 2023.
14. noyb (2024). Cookie Banner Report — 422+ Formal GDPR Complaints. noyb.eu.
15. EU (2022). Regulation (EU) 2022/2065 — Digital Services Act, Art. 25(1) (Dark Pattern Prohibition).
16. Lin, Y. et al. (2024). “DPDGPT: Multimodal LLM Dark Pattern Detection.” arXiv preprint, F1 0.88 across 19 types.
17. Bollinger, D. et al. (2024). “Consent Observatory: Longitudinal Cookie Consent Compliance.” Proc. ACM CHI 2025 (early access 2024).
18. Fouad, I. et al. (2024). “Missed by Filter Lists: Detecting Unknown Third-Party Trackers.” PoPETs, 2024(2), pp. 361–379. DOI: 10.56553/popets-2024-0054
19. Calzavara, S. et al. (2025). “Security Headers Adoption and Effectiveness.” Proc. ACM CCS 2025.
20. Khodayari, A. & Pellegrino, G. (2026). “XSS-Auditor Bypass Attacks and the Case for Header Deprecation.” Proc. WWW 2026.
21. Mertens, C. et al. (2026). “First-Party GTM: Server-Side Tracking Detection via GA4 Event Stream Analysis.” Preprint 2026.
22. Singh, R. et al. (2026). “UMBRA: Unified Model for Black-hat Recognition and Analysis.” Proc. ACM CHI 2026, pp. 1–18.
23. Qu, Z. et al. (2025). “Pay or OK: Measuring the Consent-or-Pay Cookie Wall Phenomenon.” Proc. PETS 2025.
24. UAHCI (2025). “Consent Banner Accessibility under the European Accessibility Act.” Proc. UAHCI / HCI International 2025.
25. HTTP Archive / third-party-web (Hulce, P.). Web Almanac — Third-Party Performance Impact. httparchive.org.
26. W3C (2023). Web Content Accessibility Guidelines (WCAG) 2.2. W3C Recommendation, 05 October 2023.
27. EU (2019). Directive (EU) 2019/882 — European Accessibility Act (EAA). Transposition deadline: 28 June 2025.

Demir, N. et al. (2022). “IAB Europe’s Transparency & Consent Framework: Alleged Legal Basis for Real-Time Bidding.” Proc. PoPETs 2022, Art. 25.

Acar, G. et al. (2014). “The Web Never Forgets: Persistent Tracking Mechanisms in the Wild.” Proc. ACM CCS 2014, pp. 674–689. DOI: 10.1145/2660267.2660347

Urban, T. et al. (2020). “Measuring the Effectiveness of Privacy Policies for Voice Assistant Applications.” Proc. WWW 2020.

Solomos, K. et al. (2021). “Tales from the Dark Side: Privacy Dark Strategies in Social Media.” Proc. ACM IMC 2021.

Englehardt, S. & Narayanan, A. (2016). “Online Tracking: A 1-million-site Measurement and Analysis.” Proc. ACM CCS 2016, pp. 1388–1401.

ISO/IEC 18014-3:2009 — Information Technology — Security Techniques — Time Stamping Services: Implementation using a Linked Token (RFC 3161 compliant).

Last updated: May 2026. Sources are reviewed and updated with each engine release.

15. Evidence Integrity & Forensic Chain of Custody

Every Forensic Audit Report is court-ready secured through a combination of cryptographic mechanisms:

• SHA-256 Hash-Kette: Each scan phase produces a SHA-256 hash of the intermediate state. The chain prevents subsequent manipulation of individual phases.
• RFC 3161 TSA-Zeitstempel: The PDF report is automatically signed with a qualified timestamp per RFC 3161 (Primary: FreeTSA.org; Fallback: Sectigo, DigiCert). The .tsr file (Timestamp Response) constitutes the legally admissible timestamp evidence per ISO/IEC 18014-3.
• HAR-Export: Complete HTTP network traffic as HAR file (browser level). Reproducible with Chrome DevTools / Wireshark.
• Annotated Screenshots: Consent banner screenshots with Pillow-annotated bounding boxes per dark pattern finding. Machine-readable (JSON), embedded in report.
• Deterministic Scan Configuration: All random parameters (PRNG seed, user-agent, viewport, language, timezone) are fixed in the report and can be reproduced for counter-verification.