> For the complete documentation index, see [llms.txt](https://doc.commandersact.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc.commandersact.com/features/realtime-cookie-scanner/compliance-score/compliance-score-formula.md). # Compliance score formula ## Cookie Compliance Score: How Does It Work? Your compliance score, out of 100, estimates the compliance level of cookie deposits observed during scans, based on GDPR and ePrivacy rules.\ Please note that it does not, by itself, cover all the criteria reviewed by data protection authorities, particularly certain aspects of the consent interface. It starts at **100**, representing perfect compliance, and decreases according to the violations detected, taking into account their **actual impact**, based on their frequency of occurrence, their **severity**, based on when they are deposited, and their **category**, based on the cookie’s purpose. #### Calculation rule: points lost **Score = 100 − total points lost**\ The score never falls below 0. For each problematic cookie, the following calculation is applied: **Points lost = frequency in % × category weight × base rate** * **Frequency**: percentage of the site’s pages on which the cookie is deposited, for example, 100% means all pages and 5% means very rare. * **Base rate**: * Cookies deposited **before consent**, without prior validation: **0.10** points per percentage point of presence. * Cookies deposited **after a “refuse all” action**: **0.15** points per percentage point of presence, as this is more serious because it disregards an explicit refusal. * **Category weight**, a multiplier based on the cookie’s purpose: * **Marketing / Advertising / Targeting / Remarketing**: ×2, as these cookies are subject to the most severe enforcement actions by data protection authorities. * **Analytics / Audience measurement**: ×1, as an exemption may be possible when processing is anonymised and limited, resulting in medium severity. * **Uncategorized**, meaning a cookie unknown to the scanner: ×1.5, due to the default risk associated with an unclassified cookie. * **Essential / Strictly necessary**: ×0.5. Until the user has confirmed that the cookie is exempt from consent by applying the “exempted” flag, points are deducted as a precaution. The system has classified the cookie as Essential, but this classification must still be validated. The points lost displayed for each individual cookie are rounded to the nearest whole number. However, the final score is calculated using the sum of the unrounded points lost for all cookies. The resulting final score is then rounded to the nearest whole number. #### Complete formula **Score = 100 − the sum of all problematic cookies of:** ``` frequency in % × category weight × 0.10 if deposited before consent, or 0.15 if deposited after “refuse all”. ``` The sum is calculated using the unrounded points lost for each cookie. The final result is then rounded to the nearest whole number. #### Practical examples | Situation | Cookie type | Category | Frequency | Points lost | Final score | Colour | Comment | | --------------------------------------------------------------------------------------- | -------------- | ------------- | ------------------------- | ------------------------- | ------------ | ------ | ----------------------------------------------------------------------------------------------- | | No issue | – | – | – | 0 | **100** | Green | Excellent compliance, routine monitoring | | One advertising cookie before consent on the checkout page, representing 20% of traffic | Before consent | Marketing | 20% | 20 × 2 × 0.10 = **4** | **96** | Green | Non-compliant advertising cookie, moderate risk, correct it quickly | | One Meta Ads cookie before consent on 100% of pages | Before consent | Marketing | 100% | 100 × 2 × 0.10 = **20** | **80** | Yellow | Serious violation, targeting without prior consent, high regulatory audit risk, priority action | | One Google Analytics cookie before consent on 100% of pages | Before consent | Analytics | 100% | 100 × 1 × 0.10 = **10** | **90** | Green | Violation detected, check anonymisation and possible exemption | | One Essential cookie before consent on 100% of pages, not yet confirmed as exempted | Before consent | Essential | 100% | 100 × 0.5 × 0.10 = **5** | **95** | Green | Cookie classified as Essential by the system, flag it as “exempted” to validate it | | One unknown cookie deposited before consent on 100% of pages | Before consent | Uncategorized | 100% | 100 × 1.5 × 0.10 = **15** | **85** | Yellow | Unknown cookie deposited before consent, high risk, classify or remove it | | One advertising cookie after “refuse all” on 90% of pages | After refusal | Marketing | 90% | 90 × 2 × 0.15 = **27** | **73** | Yellow | Serious violation after explicit refusal, absolute priority | | Severe cumulative violations, including multiple advertising and analytics cookies | Mixed | Mixed | High cumulative frequency | More than 70 points lost | **Below 30** | Red | Major non-compliance, regulatory audit emergency, consult a GDPR expert | #### Why these weights and rates? * **Marketing ×2**: regulatory authorities impose severe penalties for advertising and targeting cookies, including Meta, Google Ads, remarketing and similar technologies. * **Analytics ×1**: an exemption may be possible when processing is anonymised and limited, resulting in a reduced penalty. * **Uncategorized ×1.5**: an unidentified cookie represents a potential risk, resulting in an intermediate penalty intended to encourage review. * **Essential ×0.5**: points are deducted until the user applies the “exempted” flag to confirm the cookie’s exemption. Essential cookies must be confirmed. * **Reduced rates, 0.10 and 0.15**: these rates balance the introduction of category multipliers and prevent excessive overall penalties. #### Colours and urgency levels | Score | Colour | Meaning | Recommended action | Comment | | -----: | :----: | ------------------------------------ | --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 90–100 | Green | Very good compliance | Verify and stabilise | Good level, but not a free pass. Correct the remaining issues as soon as possible and perform checks after every production release. The objective is to remain consistently above 95. | | 70–89 | Yellow | Moderate issues | Correct quickly | Actions should be planned immediately. Prioritise the issues responsible for the greatest loss of points. If the decrease is caused by marketing cookies before consent or deposits after “refuse all”, treat them as high priority even if the score remains yellow. | | 50–69 | Orange | Significant violations | Correct as a priority | High level of exposure. Start a remediation plan immediately. The recommended target is to return above 70 quickly, and then above 90 as soon as possible. | | 0–49 | Red | Serious or systematic non-compliance | Immediate action | Critical level, with a high risk of findings during an audit. Correct the issues immediately. First eliminate marketing cookies deposited before consent and all cookies deposited after explicit refusal, then stabilise the score above 70. | Your score is recalculated at least once a day, usually with the flow. If you flag a cookie as “consent exempted”, for example an Essential cookie or a compliant Analytics cookie, the score will generally increase quickly. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://doc.commandersact.com/features/realtime-cookie-scanner/compliance-score/compliance-score-formula.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.