Which rules apply to your website, and what an automated scan can actually check
A country-by-country map of what Veracly monitors, what the automated scan detects, and the requirements that still need manual verification. Including the parts we cannot check.
Two questions come up before anyone reads a compliance report: which rules actually apply to me, and how much of this can a scanner really tell me?
This page answers both, honestly, including the parts where the answer is that we cannot help. Pick a market below.
Selected markets choose comparison frameworks. Legal applicability also depends on establishment, targeting, business activity and statutory exceptions.
Frameworks compared for Germany
- European Accessibility Act
- GDPR & ePrivacy
What the automated scan checks for Germany
- Trackers firing before consentA request to a known tracking endpoint made before any consent gesture. We match the receiving host, and we separate a data-firing hit from a loader script that may never send anything.
- Cookies set before consentCookies observed before any banner interaction. Known tracker cookies (Google Analytics, Meta Pixel and other recognised vendors) are reported as observed evidence at full severity. Cookies we cannot classify by name are flagged for review at low severity, because a name alone does not establish purpose or an exemption.
- Web Storage / IndexedDB writes before consentlocalStorage, sessionStorage and IndexedDB entries written before any banner interaction. Keys written by recognised tracking SDKs are reported as observed evidence; keys we cannot classify are flagged for review at low severity until their purpose is established.
- No consent banner at allNo banner DOM detected on a page with a recognized tracking network signal. Cookie/storage names alone do not trigger this check. Banner timing, consent purpose and exceptions remain subject to review.
- No reject optionNo reject path recognized among the banner controls inspected. Nested settings, custom controls and the effect of rejecting require manual verification.
- Reject harder to find than acceptA visual-weight heuristic flags a recognized reject control as less prominent than accept. This does not establish equal ease of refusal across the complete interaction.
- Pre-ticked consent boxesCategory controls classified as non-essential appear selected on initial render. Verify actual category purpose, prior consent state and what the controls authorize.
- Google Fonts loaded from GoogleA request to fonts.googleapis.com or fonts.gstatic.com rather than self-hosting.
- reCAPTCHA on pages without a detected formA reCAPTCHA request on pages with no form to protect.
- Trackers absent from your privacy policyA detected vendor name absent from discovered policy text. This is a review prompt: sufficiently specific recipient categories may satisfy disclosure requirements.
- Privacy policy present and reachableSame-host links or guessed paths returning HTML with policy keywords. This is a discovery heuristic; it does not verify operator relevance, completeness or external-host notices.
- Accessibility statement presentSame-host accessibility information discovered through links, paths and keywords. Verify EAA scope, exemptions, equivalent information in terms and the accuracy of any claims.
- Imprint / legal notice presentSame-host legal-notice discovery by links, paths and keywords. The finding is triggered only for a primary market of Germany or Austria; legal applicability and required contents need review.
Coverage and manual verification
This inventory describes scanner capabilities, not which checks ran or passed in this scan. Automated signals and manual review overlap. No entry establishes full conformance. Review the applicable requirements, complete processes and relevant page states; newer WCAG criteria may be comparison guidance rather than a legal duty for your organization.
Criterion names and detailed technical guidance are provided in English. Follow the official links for the complete requirements and exceptions.
Coverage inventory version: 2026-09-11
WCAG 2.0 / 2.1 / 2.2 - A / AA
4.1.1 Parsing is obsolete in WCAG 2.2. Current W3C notes consider it satisfied for HTML/XML in WCAG 2.0 and 2.1; it is not counted as automated coverage or a manual failure.
- 1.1.1 Non-text Content
A · WCAG 2.0 · Partial automated check
Automated observation: Missing or invalid text-alternative markup for supported elements.
Manual verification: Review whether alternatives convey the purpose of meaningful content and whether decorative content is appropriately ignored.
- 1.2.1 Audio-only and Video-only (Prerecorded)
A · WCAG 2.0 · Not automated by Veracly
Automated observation: No criterion-specific automated check is implemented in this scanner.
Manual verification: For prerecorded audio-only, verify an equivalent text alternative; for video-only, verify an equivalent text alternative or audio track. Check clearly labelled media-alternative exceptions.
- 1.2.2 Captions (Prerecorded)
A · WCAG 2.0 · Automated review signal
Automated observation: Video markup without a caption/subtitle track; media content is not verified.
Manual verification: Review caption accuracy, synchronization and meaningful sounds for prerecorded synchronized audio; verify media-alternative exceptions and open/custom-player captions.
- 1.2.3 Audio Description or Media Alternative (Prerecorded)
A · WCAG 2.0 · Not automated by Veracly
Automated observation: No criterion-specific automated check is implemented in this scanner.
Manual verification: For prerecorded synchronized media, review audio description or a full media alternative, subject to the clearly labelled media-alternative exception.
- 1.2.4 Captions (Live)
AA · WCAG 2.0 · Not automated by Veracly
Automated observation: No criterion-specific automated check is implemented in this scanner.
Manual verification: Review captions for live audio in synchronized media. Audio-only live content is not the same criterion.
- 1.2.5 Audio Description (Prerecorded)
AA · WCAG 2.0 · Not automated by Veracly
Automated observation: No criterion-specific automated check is implemented in this scanner.
Manual verification: Review audio description of necessary visual information in prerecorded synchronized video.
- 1.3.1 Info and Relationships
A · WCAG 2.0 · Partial automated check
Automated observation: Selected structural, table and form relationships.
Manual verification: Verify that structure and relationships conveyed visually are also available programmatically or in text, including tables and form groups.
- 1.3.2 Meaningful Sequence
A · WCAG 2.0 · Not automated by Veracly
Automated observation: No criterion-specific automated check is implemented in this scanner.
Manual verification: Check whether meaningful reading sequence is programmatically available. Keyboard focus order needs its own review under 2.4.3.
- 1.3.3 Sensory Characteristics
A · WCAG 2.0 · Not automated by Veracly
Automated observation: No criterion-specific automated check is implemented in this scanner.
Manual verification: Verify instructions do not rely solely on sensory characteristics such as shape, color, size, visual location, orientation or sound.
- 1.3.4 Orientation
AA · WCAG 2.1 · Automated review signal
Automated observation: Orientation-query/transform patterns; actual restriction is not established.
Manual verification: Use the content in portrait and landscape; verify any restriction is essential. An orientation-related CSS transform alone proves neither failure nor conformance.
- 1.3.5 Identify Input Purpose
AA · WCAG 2.1 · Partial automated check
Automated observation: Selected autocomplete attribute checks.
Manual verification: Review fields collecting user information for applicable standardized input purposes and correct programmatic identification.
- 1.4.1 Use of Color
A · WCAG 2.0 · Partial automated check
Automated observation: Selected inline links distinguished by color alone; other uses of color need review.
Manual verification: Colour is not the only means of conveying information (e.g. links, errors).
- 1.4.2 Audio Control
A · WCAG 2.0 · Automated review signal
Automated observation: Autoplay, sound and visible native-control signals; actual duration/custom controls are not verified.
Manual verification: Check actual audio playback, duration and available pause/stop or independent volume controls when automatic audio lasts more than three seconds.
- 1.4.3 Contrast (Minimum)
AA · WCAG 2.0 · Partial automated check
Automated observation: Measurable text/background contrast in the inspected state.
Manual verification: Check text contrast in relevant states and backgrounds, including content that automation cannot measure; apply the criterion thresholds and exceptions.
- 1.4.4 Resize Text
AA · WCAG 2.0 · Partial automated check
Automated observation: Viewport settings that may restrict zoom; no complete 200% resize test.
Manual verification: Resize text to 200% and verify usable content and controls without loss, accounting for the criterion exceptions.
- 1.4.5 Images of Text
AA · WCAG 2.0 · Not automated by Veracly
Automated observation: No criterion-specific automated check is implemented in this scanner.
Manual verification: Prefer text over images of text where the technology can achieve the presentation; check customization or essential-presentation exceptions, including logos.
- 1.4.10 Reflow
AA · WCAG 2.1 · Not automated by Veracly
Automated observation: No criterion-specific automated check is implemented in this scanner.
Manual verification: Check vertical content at 320 CSS pixels wide and horizontal content at 256 CSS pixels high, without two-dimensional scrolling or loss; account for content requiring a two-dimensional layout.
- 1.4.11 Non-text Contrast
AA · WCAG 2.1 · Not automated by Veracly
Automated observation: No criterion-specific automated check is implemented in this scanner.
Manual verification: Check required visual information for controls, states and meaningful graphics against adjacent colors; account for inactive, unmodified user-agent and essential-presentation exceptions.
- 1.4.12 Text Spacing
AA · WCAG 2.1 · Partial automated check
Automated observation: Inline spacing styles that can prevent user text-spacing overrides; actual resizing and content loss require review.
Manual verification: Apply the specified line, paragraph, letter and word spacing overrides without loss of content or functionality; account for language and markup conditions.
- 1.4.13 Content on Hover or Focus
AA · WCAG 2.1 · Not automated by Veracly
Automated observation: No criterion-specific automated check is implemented in this scanner.
Manual verification: Verify additional hover/focus content can be dismissed, hovered and kept visible as required; review applicable exceptions.
- 2.1.1 Keyboard
A · WCAG 2.0 · Partial automated check
Automated observation: Selected markup and focusability failures; not complete keyboard workflows.
Manual verification: Complete all applicable functions by keyboard, including custom controls and workflows; verify essential path-dependent input exceptions.
- 2.1.2 No Keyboard Trap
A · WCAG 2.0 · Not automated by Veracly
Automated observation: No criterion-specific automated check is implemented in this scanner.
Manual verification: Verify focus can leave every component by keyboard; if exit needs more than standard arrow/tab or other standard methods, verify users are advised of the exit method.
- 2.1.4 Character Key Shortcuts
A · WCAG 2.1 · Not automated by Veracly
Automated observation: No criterion-specific automated check is implemented in this scanner.
Manual verification: For character-key shortcuts, verify they can be disabled, remapped to include a non-character key, or are active only while the relevant component has focus.
- 2.2.1 Timing Adjustable
A · WCAG 2.0 · Automated review signal
Automated observation: Certain timed meta-refresh patterns; not session or process time limits.
Manual verification: Review time limits throughout tasks, including sessions and forms. Check turn-off, adjustment or extension mechanisms and applicable essential, real-time or longer-than-20-hour exceptions.
- 2.2.2 Pause, Stop, Hide
A · WCAG 2.0 · Partial automated check
Automated observation: Selected obsolete blinking/scrolling markup; not all dynamic content.
Manual verification: Check moving, blinking, scrolling and auto-updating content for the required pause, stop, hide or update controls and applicable conditions/exceptions.
- 2.3.1 Three Flashes or Below Threshold
A · WCAG 2.0 · Not automated by Veracly
Automated observation: No criterion-specific automated check is implemented in this scanner.
Manual verification: Assess whether flashing stays at no more than three flashes in any one-second period OR remains below the general/red flash thresholds. Use suitable analysis for suspect media.
- 2.4.1 Bypass Blocks
A · WCAG 2.0 · Automated review signal
Automated observation: Landmark advice only, unscored; absence of a landmark does not prove missing bypass mechanisms.
Manual verification: Verify an operable mechanism bypasses blocks repeated across pages; check actual skip links, landmarks or heading navigation with appropriate assistive technology.
- 2.4.2 Page Titled
A · WCAG 2.0 · Partial automated check
Automated observation: Missing page title; descriptive quality needs review.
Manual verification: Confirm each page title describes its topic or purpose; existence of a title alone is insufficient.
- 2.4.3 Focus Order
A · WCAG 2.0 · Automated review signal
Automated observation: Positive-tabindex advice only, unscored; meaningful focus order is not verified.
Manual verification: Navigate complete tasks by keyboard and confirm focus order preserves meaning and operation, including dialogs and dynamically inserted content.
- 2.4.4 Link Purpose (In Context)
A · WCAG 2.0 · Partial automated check
Automated observation: Selected missing link names; purpose in context needs review.
Manual verification: Review whether each link purpose can be determined from its text or programmatically associated context, subject to the criterion exception.
- 2.4.5 Multiple Ways
AA · WCAG 2.0 · Not automated by Veracly
Automated observation: No criterion-specific automated check is implemented in this scanner.
Manual verification: Verify more than one way to locate pages in a set, except pages that are a result of, or a step in, a process.
- 2.4.6 Headings and Labels
AA · WCAG 2.0 · Automated review signal
Automated observation: Empty-heading advice only, unscored; descriptive quality is not verified.
Manual verification: Confirm headings and labels describe their topic or purpose. An empty-heading check does not evaluate their quality or meaning.
- 2.4.7 Focus Visible
AA · WCAG 2.0 · Not automated by Veracly
Automated observation: No criterion-specific automated check is implemented in this scanner.
Manual verification: A visible focus indicator appears on every keyboard-focusable element.
- 2.4.11 Focus Not Obscured (Minimum)
AA · WCAG 2.2 · Not automated by Veracly
Automated observation: No criterion-specific automated check is implemented in this scanner.
Manual verification: Move keyboard focus through relevant states; confirm author-created content does not entirely hide the focused component, considering criterion notes.
- 2.5.1 Pointer Gestures
A · WCAG 2.1 · Not automated by Veracly
Automated observation: No criterion-specific automated check is implemented in this scanner.
Manual verification: Verify single-pointer operation without path-based gestures unless the gesture is essential; check the criterion scope and user-agent exception.
- 2.5.2 Pointer Cancellation
A · WCAG 2.1 · Not automated by Veracly
Automated observation: No criterion-specific automated check is implemented in this scanner.
Manual verification: For single-pointer input, review no-down-event activation, abort/undo, up-reversal or essential-down-event alternatives; up-event activation is not the only allowed route.
- 2.5.3 Label in Name
A · WCAG 2.1 · Partial automated check
Automated observation: Selected visible-label and accessible-name mismatches; verify speech-input operation and all controls.
Manual verification: The accessible name of a control contains its visible label text.
- 2.5.4 Motion Actuation
A · WCAG 2.1 · Not automated by Veracly
Automated observation: No criterion-specific automated check is implemented in this scanner.
Manual verification: Review alternatives to motion-based operation and ability to disable motion response, subject to supported-interface and essential exceptions.
- 2.5.7 Dragging Movements
AA · WCAG 2.2 · Not automated by Veracly
Automated observation: No criterion-specific automated check is implemented in this scanner.
Manual verification: Verify a single-pointer alternative without dragging for drag-based functions, unless dragging is essential or an applicable user-agent exception applies.
- 2.5.8 Target Size (Minimum)
AA · WCAG 2.2 · Partial automated check
Automated observation: Supported target-size/spacing checks in the inspected viewport/state.
Manual verification: Check pointer target dimensions or sufficient spacing against the 24 CSS pixel criterion and its equivalent, inline, user-agent and essential exceptions.
- 3.1.1 Language of Page
A · WCAG 2.0 · Partial automated check
Automated observation: Presence and syntax of the document language.
Manual verification: Confirm the programmatically identified page language matches the actual content; a syntactically valid language code is not enough.
- 3.1.2 Language of Parts
AA · WCAG 2.0 · Partial automated check
Automated observation: Language-attribute syntax; actual language changes are not identified.
Manual verification: Review language changes in passages and phrases for correct programmatic identification and applicable exceptions.
- 3.2.1 On Focus
A · WCAG 2.0 · Not automated by Veracly
Automated observation: No criterion-specific automated check is implemented in this scanner.
Manual verification: Verify receiving focus does not itself initiate a change of context.
- 3.2.2 On Input
A · WCAG 2.0 · Not automated by Veracly
Automated observation: No criterion-specific automated check is implemented in this scanner.
Manual verification: Verify changing a user-interface setting does not automatically change context unless the user was advised of that behavior before using the component.
- 3.2.3 Consistent Navigation
AA · WCAG 2.0 · Not automated by Veracly
Automated observation: No criterion-specific automated check is implemented in this scanner.
Manual verification: Within a set of pages, verify repeated navigation mechanisms keep the same relative order unless a change is initiated by the user.
- 3.2.4 Consistent Identification
AA · WCAG 2.0 · Not automated by Veracly
Automated observation: No criterion-specific automated check is implemented in this scanner.
Manual verification: Within a set of pages, verify components with the same functionality are identified consistently.
- 3.2.6 Consistent Help
A · WCAG 2.2 · Not automated by Veracly
Automated observation: No criterion-specific automated check is implemented in this scanner.
Manual verification: Across pages sharing help mechanisms, verify their relative order remains consistent unless the user initiated a change.
- 3.3.1 Error Identification
A · WCAG 2.0 · Not automated by Veracly
Automated observation: No criterion-specific automated check is implemented in this scanner.
Manual verification: For automatically detected input errors, verify the item in error is identified and the error is described in text.
- 3.3.2 Labels or Instructions
A · WCAG 2.0 · Partial automated check
Automated observation: Selected missing/placeholder-only labels; instruction adequacy needs review.
Manual verification: Verify appropriate labels and instructions for required user input; accessible-name presence alone does not establish sufficient instructions.
- 3.3.3 Error Suggestion
AA · WCAG 2.0 · Not automated by Veracly
Automated observation: No criterion-specific automated check is implemented in this scanner.
Manual verification: Where input errors are detected and correction suggestions are known, provide suggestions unless doing so would compromise security or purpose.
- 3.3.4 Error Prevention (Legal, Financial, Data)
AA · WCAG 2.0 · Not automated by Veracly
Automated observation: No criterion-specific automated check is implemented in this scanner.
Manual verification: For legal commitments, financial transactions, changes/deletions of user-controlled stored data, or test-response submissions, verify reversibility, error checking with correction, or review and confirmation before finalizing.
- 3.3.7 Redundant Entry
A · WCAG 2.2 · Not automated by Veracly
Automated observation: No criterion-specific automated check is implemented in this scanner.
Manual verification: Complete multi-step processes; previously supplied information should be populated or selectable when required again, subject to essential, security and validity exceptions.
- 3.3.8 Accessible Authentication (Minimum)
AA · WCAG 2.2 · Not automated by Veracly
Automated observation: No criterion-specific automated check is implemented in this scanner.
Manual verification: Test authentication for cognitive-function tests and available alternatives or assistance; verify the object-recognition and personal-content exceptions where relevant.
- 4.1.2 Name, Role, Value
A · WCAG 2.0 · Partial automated check
Automated observation: Selected accessible-name, ARIA and control markup failures.
Manual verification: Inspect custom and native controls with assistive technology; verify names, roles, states, values and updates throughout interactions.
- 4.1.3 Status Messages
AA · WCAG 2.1 · Not automated by Veracly
Automated observation: No criterion-specific automated check is implemented in this scanner.
Manual verification: Trigger success, error and progress messages and verify that assistive technology can announce appropriate status updates without moving focus.
Assessment limits
- Server-side tracking is invisible to us. Conversions API, server-side tag managers, hashed-email backend sends and anything firing only inside a logged-in area cannot be observed from a public crawl.
- We see one moment in time. A/B tests, geo-targeted tags and consent state all change what loads, so a scan is a sample rather than a proof.
- We check that required documents exist, not whether they are correct. A privacy policy that is present but wrong passes this check.
- No detected issues is not proof of compliance. This inventory describes capabilities, not completed tests. Check scan findings, unsuccessful assessments, applicable business facts and manual results separately.
- Country selection triggers comparison frameworks; it does not establish territorial, sector, size or exemption conditions. WCAG versions and applicable legal requirements may differ.
- Consent checks inspect supported UI patterns and observed initial state. They do not verify complete accept/reject journeys, granular choices, later withdrawal, preference persistence or downstream vendor behavior.
- AI transparency checks use limited vendor and page-text signals. They do not establish actual AI use, all disclosure obligations, or full AI Act compliance.
- The numeric score prioritizes findings; it is not a percentage of requirements passed. A signed report proves document integrity, not the truth of every legal conclusion.
Selected markets and legal scope
Veracly uses your configured primary market and visitor countries to choose comparison frameworks. This does not determine legal applicability: establishment, targeting, service type, business size and exceptions may all matter. A jurisdiction marked not evaluated has not been assessed by this scan; that label does not mean its laws cannot apply.
What “automated” means
Our versioned inventory covers the 55 current WCAG 2.2 A/AA criteria, identifies when each was introduced, and separates partial automated checks, review signals and criteria we do not automate. The obsolete Parsing criterion is explained separately. This is a capability inventory, not a scan execution log.
Manual verification overlaps automated checks. Detecting missing alternative text does not establish whether existing text describes an image accurately. A clean automated result does not establish that a criterion or a complete user journey conforms.
New reports include this inventory and its limitations. Manual checks remain unverified until someone performs them; the inventory itself does not add score deductions.
On the privacy side, the limit is structural
Tracker and cookie detection is not a sampling problem — it is an observability one. We drive a real browser to a public page and record what it does. That makes what we find highly reliable: if we say a request fired before consent, you can open DevTools and watch it fire.
It also means an entire category is invisible. Server-side tracking — Conversions API, server-side tag managers, hashed-email backend sends — leaves no trace in the browser. Neither does anything that only fires inside a logged-in area. If those matter to you, a scan is not the tool; a server-log audit is.
Where we say “we are not sure”
Not every finding is equally solid, and reports that pretend otherwise are less useful, not more. Veracly separates three kinds:
- Observed — we watched it happen and can point at the element or the request. You can reproduce it yourself.
- Inferred — established by absence, or by a heuristic. We probed for a privacy policy across a fixed set of locations and did not find one; a site that publishes it somewhere we did not look looks identical to a site with none.
- Contextual — the technical observation is right, but the conclusion depends on facts a scan cannot reach, such as what your privacy policy actually says or whether a tag is consent-gated at runtime.
A finding in the second or third group is a prompt to look, not a verdict. We would rather tell you that than hand you a confident number built on an inference.
What this page is not
It is a description of what our software checks. It is not legal advice, and the list of regulations we monitor is not a list of the regulations that bind you — those are different questions, and only the second one matters to a regulator. If a finding has consequences, take it to a qualified lawyer in the relevant jurisdiction.
If you think a finding is wrong, we would like to know: corrections@veracly.app. We re-scan and reissue or retract within five business days.
Common questions
Does an automated scan prove my site is compliant?
No, and no automated tool can. Veracly documents partial automated checks, review signals and requirements it does not automate in one version-labelled inventory. Manual verification overlaps automated checks; a detected failure pattern or a clean result does not establish full conformance. On the privacy side the limit is structural rather than statistical: we observe what a browser does on a public page, so server-side tracking, authenticated-area tracking, and anything that fires only for some visitors are invisible to us. A clean result means no client-side evidence was found on the pages crawled.
Which countries does Veracly cover?
The 27 EU member states (European Accessibility Act), the 30 EU/EEA states including Iceland, Liechtenstein and Norway (GDPR and ePrivacy), the United Kingdom (Equality Act 2010), the United States (ADA), Canada, and Australia (Disability Discrimination Act). The inventory labels WCAG versions without implying that every jurisdiction requires every version. Canada uses an Ontario AODA comparison; actual federal or provincial duties require separate scope verification. Selected primary and visitor markets trigger comparison frameworks. Actual legal applicability also depends on establishment, targeting, business activity and statutory exceptions. If your market is not on the list, a scan still runs and still reports what it technically observes, but nothing is scored against a statute we do not monitor.
Why does my report not mention an Impressum?
The imprint finding is raised only for sites whose primary market is Germany or Austria, where § 5 DDG and § 5 ECG bind essentially every commercial website. Switzerland has a real duty too, under Art. 3(1)(s) UWG, but it applies specifically to electronic commerce rather than to every site, and a crawl cannot tell whether a site trades online. Raising it for every Swiss site would tell brochure operators a statute binds them when it does not, so we do not.
What is the difference between the free scan and a paid report?
The engine is identical — same rules, same jurisdictions, same scoring. The free scan covers a single page and shows the top three priorities with plain-English explanations; the paid report covers your configured page limit on a schedule, lists every priority, and adds remediation snippets, per-jurisdiction detail pages, and evidence screenshots. A finding that appears in a free scan is the same finding a paid scan would produce.
How do I check a finding myself?
Every finding we can reproduce carries a DevTools recipe — the filter to type and what you should see. That is deliberate: a compliance finding you have to take on trust is worth less than one you can confirm in a minute. Findings we cannot reproduce that way say so instead of pretending otherwise, and the report distinguishes what we watched happen from what we inferred from absence.
See where your site stands.
Run a free Veracly scan and get a multi-jurisdiction report, EAA, GDPR, ADA, UK Equality Act, AODA, with copy-paste developer fixes.
Run a free scan