Notable changes to the scanner, the web app and the report pipeline, newest first. Dates are the day a change reached production. Anything that changes how a finding is graded names the rule, so you can compare an older report with a newer one.
UK rule set: PECR statistical-purposes exception
Grading changes
UK rule set: pre-consent analytics that may qualify for the PECR statistical purposes exception (Data (Use and Access) Act 2025, in force 5 February 2026) are now listed as review items, graded low, with the conditions a person must confirm, instead of graded critical. Evidence that includes advertising, social, session-recording or marketing-automation tools is graded as before. EU grading is unchanged.
The UK cookie citation now reads PECR Regulation 6 as amended by the Data (Use and Access) Act 2025.
Heap and Snowplow cookies set before consent are now attributed to their vendor in every rule set, instead of being listed as unclassified names for review.
Coverage inventory in every report, review items, and rule changes
Reports
Every report now carries a version-labelled inventory of all 55 WCAG 2.2 Level A and AA criteria, marking each as partly automated, an automated review signal, or not automated. The same inventory is saved with the report, so an older report keeps the inventory it was issued with. Per-criterion detail is on the coverage page.
Each scorecard lists, in one sentence in the report language, the findings that jurisdiction treated as review items rather than graded failures.
A page that returns an error is skipped; the score covers the pages that were assessed.
Grading changes
Cookies and browser storage written before consent: entries from recognised tracking vendors keep their severity. Entries the scanner cannot classify by name are now reported as two new low-severity review findings, pre-consent-cookies-unclassified and pre-consent-storage-unclassified, until their purpose is established.
missing-cookie-banner now requires an observed tracker request on the page; cookie or storage names alone do not trigger it.
tracker-not-disclosed is graded low and flagged for review, because GDPR Art. 13(1)(e) allows categories of recipients. css-orientation-lock is graded low as a review signal.
landmark-one-main, landmark-complementary-is-top-level, tabindex and empty-heading are still reported but no longer scored by any jurisdiction; they are axe best-practice rules with no WCAG success criterion.
Ontario (AODA) legal-floor comparison: rule types for WCAG 2.0 criteria, such as frame-title, select-name, meta-refresh and media-missing-captions, now count toward the legal-floor score; autocomplete-valid remains a 2.1 comparison only.
media-missing-captions now reviews every video without a caption track, not only those with controls, as a low-severity review item. meta-refresh is graded low as a review item and honours the 20-hour exception in WCAG 2.2.1. Checks axe cannot decide are listed as accessibility-review-required and are not scored.
missing-accessibility-statement (EAA) and autoplay-audio are graded low as review items: the scanner can see the pattern but not whether the duty applies or an exception is met.
EU AI Act chatbot check: a known chat vendor without a disclosure is now a warning (medium), not a failure.
Australia: a reported annual turnover at or below AUD 3,000,000 still applies the Privacy Act s6D small-business exemption. When no turnover is given, missing-privacy-policy is graded low with a note that applicability needs review.
Isolated scan browser, newer Chromium, fair-use limits on the free scan
Scanning
Each scan runs in its own isolated browser, which is discarded when the scan ends.
Scanning and PDF rendering moved to a newer Chromium (Playwright 1.63). No rule or grading changed in this release.
Free scan
Fair-use limits. On top of the existing one scan per email address every 7 days, the free scan now limits submissions per network address and across the site as a whole. Most visitors will not notice them. When a limit applies, the form says which one: a site-wide busy limit, or the one-scan-per-week rule for your email address.
If the free-scan service is unavailable, the form shows an error instead of accepting the request.
Web app
The web app moved to Next.js 15.
“Start free scan” in the navigation now takes you straight to the scan form.
Each language homepage now has search-specific title and description text, written separately from the page copy. The Trust Center, Verify, Corrections, Abuse and “How we use AI” pages are listed in the sitemap.