Methodology and evidence standards

Privacy Exposure Score (0 to 100)

Higher means greater measured exposure. Five dimensions each contribute up to 20 points.

1. 1

   Sensitivity of observed information

   Location precision, sensitive context, account data.

   0–20
2. 2

   Persistence and linkability of identifiers

   Resettable versus persistent; seen across sessions; sent to identity services.

   0–20
3. 3

   Recipient roles and dissemination evidence

   Advertising, identity, and documented broker recipients weigh more than infrastructure.

   0–20
4. 4

   Behavior under tested privacy choices

   What continued after rejection or withdrawal, in tested scenarios only.

   0–20
5. 5

   Disclosure–observation discrepancies

   Only where a specific statement can be matched to an observation.

   0–20

Bands and “Not rated”

• 0–24Lower measured exposure
• 25–49Moderate measured exposure
• 50–74High measured exposure
• 75–100Very high measured exposure
• —Not rated

Not rated is shown when evidence does not meet the minimum coverage requirement: readable runtime traffic in at least one tested scenario. Coverage and uncertainty never reduce a score or make an untested product appear safer. We say “No transmission observed in the tested session,” never “No data sharing.”

Evidence labels

●Observed

Directly recorded in the tested session.

◆Declared

Stated by the publisher or another identified source.

△Inferred

An analytical conclusion with visible premises.

?Unknown

Not established by available evidence.

Severity, confidence, coverage, and evidence status are separate. Fingerprinting behavior is reported as a signal unless evidence supports more. Contact before a consent choice is described as observed behavior, not as a legal violation. Identifiers, tokens, and email addresses are redacted in all evidence previews.

Coverage

Full:

All supported scenarios tested; request contents readable for nearly all recipients.

Substantial:

Meets the minimum for rating. Some scenarios or contents were not assessable.

Partial:

Meets the minimum for rating, but significant parts of behavior could not be observed.

Insufficient:

Below the minimum coverage needed for a rating.

Children’s privacy

Child-audience assessment is recorded separately as publisher-declared, independently assessed, uncertain, or not assessed. It does not change the score. Ratings are not legal compliance certifications or universal safety guarantees.

Versions and comparability

0.9

Sep 2026. Persistence now counts cross-session identifiers separately. Scores from 0.8 are not directly comparable; reports flag this.

0.8

Jun 2026. First public draft.

Independence and corrections

No paid rating improvements, sponsorship, or commercial relationships influence scores or rankings. Publishers and users can report an error on any finding. Findings under review stay visible with a label; every correction is logged with its date and outcome.