Methodology

The base grade

The starting letter comes from one question: what does refusing cost you? Everything else adjusts it.

The seven values of that axis, as recorded: free_toggle (one switch), self_serve_stated (a setting, depth unverified), buried_toggle (a buried switch), contact_required (you have to ask), paid_tier (you have to pay), account_deletion_only (leave, or nothing), none_offered (no way out), not_stated (not stated).

The modifiers

Applied in this order after the base grade, then clamped: nothing falls below F and nothing rises above A. Each verdict page lists which of these fired on it.

Those examples are computed by the grader itself when this page is built, not written out by hand — so if a rule changes, the example changes with it, and the build fails if an example stops demonstrating the rule it is filed under.

You may notice three of them start from B rather than A. That is not a typo: a gap in what the refusal covers both drops afree_toggle from A to B and fires its own modifier, so it is counted twice. A buried_toggle with the same gap pays only the modifier. That asymmetry is in the rule as written and is recorded here rather than smoothed over.

There is deliberately no modifier for the number of recipients a company names. Publishing a long list honestly should not score worse than publishing nothing, and a rule that punished the count would reward silence.

Why silence is unrated, not an F

Where a document says nothing about what refusing costs you, the verdict is Unrated. It is sorted last on the scoreboard and rendered in a neutral treatment, not as a worse-than-F.

This is not generosity. An F on this site means we read a document and it said there is no way out. If silence were also an F, then every F would mean one of two quite different things, and none of them would be worth much. Unrated is what makes the F's credible.

The one number that is not a quotation

Click counts are observations, not quotations. Somebody sat down with a device and counted. Every click count on this site is published with who counted it, when, and on what — because the path differs by device, by operating system and by app version, and a count without those three facts is not checkable by anybody.

They are rendered inside a dashed rule rather than the solid one used for quotations, so the difference is visible before it is read.

Staleness

Evidence more than 180 days old is marked stale and excluded from the site's headline counts. It still renders. Hiding an ageing verdict would make the corpus look fresher than it is, which is the opposite of the point.

Each of the three axes carries its own date, because each is established separately and they are rarely read on the same day. An entity can be current on one axis and eighteen months stale on another, and the page says so per axis rather than averaging it into one badge.

What documents cannot establish

Everything here is graded from what a company published. That is a real limit, not a disclaimer, and it means several things a reader might reasonably want to know are outside what any grade on this site can say.

A grade cannot tell you:

• What actually happens inside the business. A policy describes permissions the company has given itself. Whether the data is used that way, more narrowly, or more widely, is not visible from outside — only a regulator with audit powers or a subject access request can reach it.
• Whether a refusal works. We can establish that a control exists, where it is, and what the document says it covers. We cannot establish that pressing it stops anything.
• Who the recipients really are. A named-partner list is a claim about a moment. Lists go stale, are published per-user, and routinely name categories that resolve to hundreds of companies.
• Whether the company is breaking the law. This is not a compliance assessment and no grade should be read as one. A document can be candid and unlawful, or evasive and perfectly legal.
• Intent. An F means a document is silent or absolute about refusing. It does not mean anyone decided to be hostile; it may be a drafting decision nobody revisited.

Two things narrow the gap, and both are slow. A subject access request is the only route to covers_inferences andretroactive that does not rely on the company's own summary of itself. A hand count of the refusal path establishes what a document never states — and is published as an observation rather than a quotation, for exactly that reason.

Where a document does not permit a determination, the verdict is Unrated and says so. Guessing would be more useful to a reader and less true, which is the wrong trade for this site to make.

Documents we could not obtain

Of the 64 documents this site tracks, 42 are served to an ordinary HTTP client. The rest are not, and the pattern is worth publishing because it shapes what the site can cover.

Measured across 20 archive runs between 2026-08-27 and 2026-09-04.

Served only to a browser

A plain request is refused; the same URL fetched with a headless browser returns the document.

• Acxiom UK — advertising preferences: refused on all 12 attempts (HTTP 403), retrieved with a browser.
• Acxiom UK — privacy policy: refused on all 14 attempts (HTTP 403), retrieved with a browser.
• Criteo — privacy policy: refused on all 13 attempts (HTTP 403), retrieved with a browser.
• Experian Marketing Services (US) — advertising preferences: refused on all 1 attempts (HTTP 403), retrieved with a browser.
• Experian Marketing Services (US) — policy-c22965c6: refused on all 1 attempts (HTTP 403), retrieved with a browser.
• TransUnion UK — privacy policy: refused on all 15 attempts (HTTP 403), retrieved with a browser.
• TransUnion (US) / TruAudience — advertising preferences: refused on all 1 attempts (HTTP 403), retrieved with a browser.
• TransUnion (US) / TruAudience — privacy policy: refused on all 4 attempts (HTTP 403), retrieved with a browser.
• TransUnion (US) / TruAudience — policy-46b32946: refused on all 1 attempts (HTTP 403), retrieved with a browser.

Not retrievable by anything we have

• Amazon (US) — privacy policy: 3 attempts, none successful by plain request or browser (403).
• Asda / Asda Rewards — privacy policy: 15 attempts, none successful by plain request or browser (403).
• Experian Marketing Services (US) — privacy policy: 4 attempts, none successful by plain request or browser (403).
• Experian Marketing Services (US) — policy-0b6c990d: 4 attempts, none successful by plain request or browser (403).
• Kroger / Kroger Precision Marketing — policy-93ba1eb6: 4 attempts, none successful by plain request or browser (403). The only copy we hold of it came from the Internet Archive.
• Tesco / Clubcard — loyalty scheme terms: 18 attempts, none successful by plain request or browser (403, 503).
• Tesco / Clubcard — privacy policy: 18 attempts, none successful by plain request or browser (403). The only copy we hold of it came from the Internet Archive.
• Waitrose / myWaitrose — privacy policy: 15 attempts, none successful by plain request or browser (no response).

A further 5 are served sometimes and refused others, which is its own kind of answer.

What this does and does not say

It reports what our client observed, counted and dated. It does not say why, and in particular it is not a finding that these companies block crawlers. Our archiver identifies itself by name, and identifying itself is not what decides the outcome: six of these hosts refused it in exactly the same way before and after it started doing so, and two began serving it once it did. A refusal that turns on a TLS handshake or the absence of JavaScript is not a decision we can see the reason for, only the effect of.

Nor does a single URL always mean a single document. Some hosts serve regional editions of one address, chosen by where the request comes from: Google's privacy policy carries a United States state-law section for American addresses and a European section for British ones. Our archiver reads from datacenters in the United States, so where a company does this, the edition on file is the one an American reader receives, and the verdict says so beside the clause. When a capture arrives in a different edition — as happened when one of our runs was routed through Latin America — the archiver rejects it rather than reporting that a policy changed overnight.

None of this feeds a grade. Grades come from the three axes and nothing else, and a company whose server is hostile to automated clients is not thereby worse at handling refusal.

It is published because the alternative is a silent gap. 4 seeded companies have no entry on this site yet: 3 are in the second list above and the rest are among the intermittent. Not one of them was served cleanly on every attempt. The corpus is thinnest exactly where the documents are hardest to get, which is a fact a reader is entitled to weigh against everything else here.