Methodology

The base grade

The starting letter comes from one question: what does refusing cost you? Everything else adjusts it.

The seven values of that axis, as recorded: free_toggle (one switch), self_serve_stated (a setting, depth unverified), buried_toggle (a buried switch), contact_required (you have to ask), paid_tier (you have to pay), account_deletion_only (leave, or nothing), none_offered (no way out), not_stated (not stated).

The modifiers

Applied in this order after the base grade, then clamped: nothing falls below F and nothing rises above A. Each verdict page lists which of these fired on it.

Those examples are computed by the grader itself when this page is built, not written out by hand. If a rule changes, the example changes with it, and the build fails if an example stops demonstrating the rule it's filed under.

You may notice three of them start from B, not A. That isn't a typo. A gap in what the refusal covers both drops afree_toggle from A to B and fires its own modifier, so it's counted twice. A buried_toggle with the same gap pays only the modifier. That asymmetry is in the rule as written and is recorded here, not smoothed over.

On an entity page, the third axis lists each of these six points. A line labelled Gap is something the document states: the refusal doesn't cover it. A line labelled Not statedis a point the document doesn't address. Both count against the grade, because silence doesn't demonstrate coverage. Only the first is a claim about what the company wrote, and the page keeps them apart for that reason.

There is deliberately no modifier for the number of recipients a company names. Publishing a long list honestly shouldn't score worse than publishing nothing, and a rule that punished the count would reward silence.

Why silence is unrated, not an F

Where a document says nothing about what refusing costs you, the verdict is Unrated. It's sorted last on the scoreboard and shown in a neutral treatment, not as a worse-than-F.

This isn't generosity. An F on this site means we read a document and it said there's no way out. If silence were also an F, every F would mean one of two quite different things, and none of them would be worth much. Unrated is what makes the F's credible.

The one number that isn't a quotation

Click counts are observations, not quotations. Somebody sat down with a device and counted. Every click count on this site is published with who counted it, when, and on what, because the path differs by device, by operating system and by app version, and a count without those three facts isn't checkable by anybody.

They're rendered inside a dashed rule, not the solid one used for quotations, so the difference is visible before it's read.

Staleness

Evidence more than 180 days old is marked stale and excluded from the site's headline counts. It still renders. Hiding an ageing verdict would make the corpus look fresher than it is, which is the opposite of the point.

Each of the three axes carries its own date, because each is established separately and they are rarely read on the same day. An entity can be current on one axis and eighteen months stale on another, and the page says so per axis instead of averaging it into one badge.

What documents can't establish

Everything here is graded from what a company published. That's a real limit, not a disclaimer, and it means several things a reader might reasonably want to know are outside what any grade on this site can say.

A grade can't tell you:

• What actually happens inside the business. A policy describes permissions the company has given itself. Whether the data is used that way, more narrowly, or more widely, isn't visible from outside. Only a regulator with audit powers or a subject access request can reach it.
• Whether a refusal works. We can establish that a control exists, where it is, and what the document says it covers. We can't establish that pressing it stops anything.
• Who the recipients really are. A named-partner list is a claim about a moment. Lists go stale, are published per-user, and routinely name categories that resolve to hundreds of companies.
• Whether the company is breaking the law. This is not a compliance assessment and no grade should be read as one. A document can be candid and unlawful, or evasive and perfectly legal.
• Intent. An F means a document is silent or absolute about refusing. It doesn't mean anyone decided to be hostile. It may be a drafting decision nobody revisited.

Two things narrow the gap, and both are slow. A subject access request is the only route to covers_inferences andretroactive that doesn't rely on the company's own summary of itself. A hand count of the refusal path establishes what a document never states, and is published as an observation, not a quotation, for that reason.

Where a document doesn't permit a determination, the verdict is Unrated and says so. Guessing would be more useful to a reader and less true, which is the wrong trade for this site to make.

Documents we could not obtain

Of the 65 documents this site tracks, 40 are served to an ordinary HTTP client. The rest are not, and the pattern is worth publishing because it shapes what the site can cover.

Measured across 41 archive runs between 2026-08-27 and 2026-10-12. Of the documents served to a plain client, 3 were served only once the client sent an ordinary browser's User-Agent string instead of its own name; each of those is counted here as served, and named: Amazon (US) (privacy policy); Experian Marketing Services (US) (privacy policy); Experian Marketing Services (US) (policy-0b6c990d).

Served only to a browser

A plain request is refused, or is answered with a script shell that carries none of the document. The same URL fetched with a headless browser returns it.

• Amazon Ads (UK), privacy policy: a plain request is answered (HTTP 200, 403, 429, 503) but not with the document, 24 words of text on the last run; retrieved with a browser on 10 of 34 attempts.
• Co-op, privacy policy: a plain request is answered (HTTP 200) but not with the document, 111 words of text on the last run; retrieved with a browser on 32 of 33 attempts.
• Criteo, privacy policy: refused on all 33 attempts (HTTP 403), retrieved with a browser.
• Experian Marketing Services (US), advertising preferences: a plain request is answered (HTTP 200, 403) but not with the document, 111 words of text on the last run; retrieved with a browser on 21 of 21 attempts.
• Experian Marketing Services (US), policy-c22965c6: a plain request is answered (HTTP 200, 403) but not with the document, 111 words of text on the last run; retrieved with a browser on 21 of 21 attempts.
• ID5, privacy policy: a plain request is answered (HTTP 200) but not with the document, 2 words of text on the last run; retrieved with a browser on 32 of 33 attempts.
• Reddit, privacy policy: a plain request is answered (HTTP 200) but not with the document, 1 words of text on the last run; retrieved with a browser on 32 of 34 attempts.
• Target / Roundel, privacy policy: a plain request is answered (HTTP 200) but not with the document, 48 words of text on the last run; retrieved with a browser on 24 of 24 attempts.
• TransUnion UK, privacy policy: refused on all 35 attempts (HTTP 403), retrieved with a browser.
• TransUnion (US) / TruAudience, advertising preferences: refused on all 21 attempts (HTTP 403), retrieved with a browser.
• TransUnion (US) / TruAudience, privacy policy: refused on all 24 attempts (HTTP 403), retrieved with a browser.
• TransUnion (US) / TruAudience, policy-46b32946: refused on all 21 attempts (HTTP 403), retrieved with a browser.

Answering, but not with the document

The host responds, and what comes back fails the archiver's check that it is the document at all: a shell page, a stub, an interstitial. A 200 with six words on it is an answer, not a policy, and nothing here is graded from one.

• Boots / Advantage Card, privacy policy: 33 attempts (HTTP 200, 403 to a plain request, HTTP 200 to a browser); nothing that came back was the document (too little text to be the document); 6 words of text on the last run.
• Meta (Facebook / Instagram), advertising preferences: 35 attempts (HTTP 200, 400 to a plain request, HTTP 200 to a browser); nothing that came back was the document (a login wall); 6 words of text on the last run.
• Sainsbury's / Nectar, loyalty scheme terms: 38 attempts (HTTP 200, 403 to a plain request, HTTP 403 to a browser); nothing that came back was the document (an interstitial page); 108 words of text on the last run.

Not retrievable by anything we have

• Asda / Asda Rewards, privacy policy: 35 attempts, none successful by plain request (HTTP 403) or browser (HTTP 403, 404).
• Kroger / Kroger Precision Marketing, policy-93ba1eb6: 24 attempts, none successful by plain request (HTTP 403) or browser (HTTP 403). The only copy we hold of it came from the Internet Archive.
• Tesco / Clubcard, loyalty scheme terms: 38 attempts, none successful by plain request (HTTP 403, 503) or browser (HTTP 403).
• Tesco / Clubcard, privacy policy: 38 attempts, none successful by plain request (HTTP 403) or browser (HTTP 403). The only copy we hold of it came from the Internet Archive.
• Waitrose / myWaitrose, privacy policy: 35 attempts, none successful by plain request (HTTP no response) or browser (HTTP no response).

A further 5 are served sometimes and refused others, which is its own kind of answer.

What this does and doesn't say

It reports what our client observed, counted and dated. It doesn't say why, and in particular it is not a finding that these companies block crawlers. Our archiver identifies itself by name, and identifying itself isn't what decides the outcome. Six of these hosts refused it in exactly the same way before and after it started doing so, and two began serving it once it did. A refusal that turns on a TLS handshake or the absence of JavaScript isn't a decision we can see the reason for, only the effect of.

Nor does a single URL always mean a single document. Some hosts serve regional editions of one address, chosen by where the request comes from: Google's privacy policy carries a United States state-law section for American addresses and a European section for British ones. Our archiver reads from datacenters in the United States, so where a company does this, the edition on file is the one an American reader receives, and the verdict says so beside the clause. When a capture arrives in a different edition, as happened when one of our runs was routed through Latin America, the archiver rejects it instead of reporting that a policy changed overnight.

None of this feeds a grade. Grades come from the three axes and nothing else, and a company whose server is hostile to automated clients isn't thereby worse at handling refusal.

It's published because the alternative is a silent gap. 3 seeded companies have no entry on this site yet: 1 answering without the document, 2 not retrievable. Not one of them was served cleanly on every attempt. The corpus is thinnest exactly where the documents are hardest to get, which is a fact a reader is entitled to weigh against everything else here.