Find out what your website actually loads, stores, and sends to third parties. Start with an automated tracking scan, or request human-reviewed network and consent-state evidence for counsel-directed CIPA questions, technical remediation, or internal privacy review.
Choose the right depth: Automated scanning offers initial observable signals; custom journeys, Accept/Reject testing, HAR analysis, and evidence preservation require a separately scoped manual review. Auditzo does not provide legal advice or CIPA compliance certification.
Want to understand which privacy frameworks may be relevant to your website? Use the compliance framework finder .
Understand observable browser requests, third-party destinations, stored identifiers, and when manually scoped, specific interaction and consent-state behavior.
Scope-aware findings that distinguish screening from human-reviewed evidence
Request timing, endpoint, and visible parameters where captured in the agreed scope
SB 690 was signed September 30, 2026, and is scheduled to take effect January 1, 2027. It amends California Penal Code §637.2: for an alleged §638.51 violation arising from conduct on an internet website, online application, or mobile application, an action under that section against a private actor may be brought only by the California Attorney General. The law also includes a retroactivity provision addressing certain pending claims.
SB 690 does not amend §631. Its effect on an individual demand letter, pending matter, asserted theory, or defense is for qualified California counsel, not a website scanner, to determine.
Auditzo's technical role remains useful when the question is what actually happened in the browser? We can document scoped script execution, requests, visible transmitted values, consent-state behavior, and reproducibility without characterizing them as legal violations. Read our SB 690 and CIPA website tracking update or the chaptered bill text.
Different teams need different answers: a quick visibility check, a specific user-journey investigation, or a reproducible technical record for counsel and remediation planning.
Need repeat client audits? View website privacy audits for law firms.
Allegations involving §638.51 pen-register/trap-and-trace theories and those invoking §631 should not be treated as legally interchangeable. Across both contexts, counsel may need a reliable record of observable requests, user actions, timing, and third-party destinations before evaluating the asserted theory.
Technical behavior matters because risk review depends on how tracking actually operates, not only which tools are installed.
These are factual investigation topics, not proof that a tracking technology violates §631, §638.51, or another law. Legal significance is for qualified counsel.
For broader tracking-risk context, see Auditzo's website tracking compliance review and guide to CIPA trap-and-trace litigation evidence.
Coverage depends on the service selected. Automated scanning offers an initial view of public-page cookies, scripts, storage, and requests. The following interaction-specific checks are available through defined manual reviews, subject to access, test conditions, and agreed scope.
Identifies observed analytics, ad pixels, tag managers, session replay, chat widgets, and embedded services; manual review can investigate selected runtime behavior.
Manually reproduces agreed searches, forms, signup, checkout, chat, or other selected actions and connects them to observable network activity.
Within manual scope, compares clean initial sessions with Accept, Reject/Decline, or other relevant preference states and observed request/storage differences.
Documents observed request hosts, destinations, timing, and available initiator information in the captured session; server-side processing may remain outside browser visibility.
Inspects visible request URLs, parameters, headers, and payload fields where the capture supports it; values that cannot be observed are identified as limitations.
Links selected findings to test conditions, timestamps, screenshots, HAR/network artifacts, and limitations where those deliverables are part of the manual scope.
A fast scan and a counsel-directed technical investigation are different services. Choose based on the evidence you actually need. For initial screening, start with our free CIPA website scanner.
Best for initial screening of public-page signals and deciding what warrants closer review.
Not included by default: Human verification, custom journeys, Accept/Reject comparisons, or raw forensic evidence handoff.
Start Free CIPA ScanBest when counsel or a website team needs request-level investigation of defined allegations or behaviors.
Scope is agreed first: Not unlimited pages, historical reconstruction, legal opinion, or expert-witness engagement.
Request Manual Evidence ReviewWhen a matter requires more than initial screening, Auditzo agrees the technical questions and test scope, then documents selected browser behavior under recorded conditions.
Agree the URLs, behaviors, browser and region setup, consent choices, available access, and evidence questions with the client or counsel.
Test agreed page loads, user journeys, and consent states; capture visible requests and associated session conditions.
Organize scoped HAR/network evidence, timestamps, screenshots, storage observations, and test notes where applicable.
Connect observations to reviewed interactions and evidence references. Counsel determines their relevance under any asserted CIPA provision.
An evidence-focused review connects the observed behavior to the test session, request destination, timeline, and supporting artifacts. Availability depends on the agreed scope, access, and what the browser can actually observe.
| Evidence area | What is reviewed | Why it matters |
|---|---|---|
| Network requests | Observed request URLs, destination domains, timing, and triggered events | Helps show whether data was sent to third-party endpoints during website use |
| Tracking tools | Pixels, analytics scripts, session replay tools, chat widgets, and tag managers | Helps identify technologies that may need legal or compliance review |
| User interactions | Form use, search actions, navigation, checkout, signup, and content views | Shows whether transmissions occur during meaningful website activity |
| Consent state | Behavior before consent, after consent, or after rejection where applicable | Helps teams understand timing and whether tracking behavior changes after choices |
| Screenshots and notes | Visual evidence, affected pages, observed flows, and plain-English summaries | Supports internal review, compliance triage, and communication with legal teams |
HAR files and browser-side captures describe observed sessions, not necessarily historical behavior or a vendor's downstream server-side processing. These are technical records, not legal opinions or compliance certifications.
Output depends on the selected product and scope. Automated reports summarize what the scanner observed. A separately scoped manual review can add deeper verification, defined consent/user journeys, and linked technical artifacts for business, compliance, developer, or counsel review.
Clear sections, practical summaries, and prioritized observations to support review and decision-making.
Findings organized around observed website behavior, third-party transmissions, consent timing, and user interactions.
Focused on request behavior, third-party activity, affected pages, and supporting screenshots or network evidence where available.
Designed to be understandable for founders, ecommerce teams, agencies, compliance teams, and legal reviewers.
Want to understand the format before starting? View a sample website privacy compliance audit report.
Need allegations investigated? For consent-journey screenshots, HAR review, selected user-action reproduction, or technical evidence organized for counsel, choose a Manual Evidence Audit.
If your audit identifies tracking issues that need implementation support, see Website Tracking Remediation or Website Privacy Monitoring.
Reports are designed to support internal assessments, legal review, and informed decision-making. Auditzo does not provide legal advice or guarantee compliance with CIPA or any privacy law.
Initial scans are useful for triage. When the questions involve specific user actions, consent choices, or visible data transmissions, a human-reviewed investigation can provide additional evidence within an agreed scope.
| Basic cookie scan | Auditzo scoped manual evidence review |
|---|---|
| Lists cookies or scripts found on the website | Reviews what tracking tools do during page visits and user interactions |
| May not show when data is transmitted | Documents request timing, destinations, and triggered actions |
| May not compare consent states | Reviews behavior before and after consent choices where applicable |
| Usually provides limited tracking-risk context | Organizes findings around CIPA-related technical considerations for review |
| Often produces tool output only | Provides an evidence-oriented report with plain-English explanations |
The right trigger is an unanswered technical question, not merely the presence of a pixel. Start with a scan for visibility or scope a manual review if a demand, consent concern, or specific transmission needs investigation.
For a related California pixel-tracking example, see this California Meta Pixel audit example.
If your review was triggered by a demand letter, see our CIPA demand letter website tracking evidence guide for a practical approach to preserving the current website state, translating allegations into technical questions, and preparing traceable evidence for counsel review. For a Shopify-specific matter, use our Shopify Demand Letter Technical Evidence Review.
A technical report is most useful when counsel can trace an observation back to a defined test session and supporting artifacts, not merely a cookie or pixel name.
In a completed law-firm engagement, Auditzo organized consent-state observations, request-level details, third-party destinations, and technical artifacts into a report for counsel's review. The case study describes the investigation and its limitations; it does not establish legal liability or a case outcome.
Read CIPA Evidence Case StudyIdentify which technical questions should be scoped, what present-state evidence is available, and what may be impossible to reconstruct historically.
Read Demand Letter GuideStart with automated visibility into observed tracking. For a demand, consent-state question, or defined user journey, request a scoped manual evidence review.
Practical answers about SB 690, §638.51 and §631, automated scanning, manual evidence reviews, and Auditzo's scope.
Start with an automated scan for observable signals, or scope a manual evidence review for specified user journeys, consent states, third-party requests, and questions raised by counsel.
Auditzo provides technical evidence and website behavior analysis to support review. It does not provide legal advice, legal certification, or guarantee compliance with CIPA or any privacy law.