See what a site does, not just what it says.

The problem

A privacy policy describes what a company says it does. It is written by that company, in language it chose, and it is not evidence of anything in particular. Meanwhile the page you just opened may have contacted dozens of other companies before you finished reading the first sentence, and there is no ordinary way to see that.

Tools that try to close this gap usually hand you a letter grade or a score out of a hundred. That is worse than it looks. A score compresses hundreds of observations into one number using weights nobody published, so you cannot tell whether a bad grade means the site is hostile or just uses a common analytics tool. You cannot check it, argue with it, or cite it. You either trust the scorer or you do not.

Three things follow from that, and they are the problems this project is interested in:

• Invisibility. What a site loads is observable, but not by the person visiting it.
• Unfalsifiability. A score cannot be wrong in any useful sense, because there is nothing to check it against.
• Impermanence. Sites change. A claim about one made last year is worth little without a dated record of what was seen and how.

What this site is trying to do

The goal is to make site behavior checkable. Every design decision here follows from that, and each one addresses a specific problem above.

• Report observations, not verdicts. A report says a request was made to a particular domain, that a cookie was set, that a script called a particular browser API. Where the site interprets those facts, it says so and shows the facts underneath.
• State the conditions. Current Node reports record the browser and scanner versions, viewport, timezone, locale, privacy signals and tracker catalog used. Older reports may not contain every version field; the viewer labels those fields as not recorded instead of filling them in later.
• Say what was missed. If part of a visit failed, or a limit was hit, or a detector did not finish, the report says so rather than quietly reporting less. Silence about gaps is the easiest way for a measurement tool to mislead.
• Publish corrections. When a report turns out to be wrong, the correction is published against it in an append-only corrections ledger instead of being edited away.
• Be inspectable. The scanner, the catalogs, the detectors and this page are open source under AGPL-3.0-or-later, so anyone can check whether the code does what the site claims.

What is here

• A scanner. Enter any public URL on the home page and get a report. You can also compare two visits: with and without a privacy signal, with and without ad blocking, or accepting versus rejecting a cookie banner.
• Reports already run for you. The directory holds scans of well-known sites grouped by what they are for, from banking and health to news and shopping, so you can see real evidence without running anything yourself.
• A research corpus.Those reports form a dated, versioned collection that makes statements like “more third-party requests than most sites measured the same way” mean something specific.
• Reference material. A glossary in plain language, the tracker catalog behind the labels, and the full methodology.
• Accountability surfaces. The status page, corrections, privacy and security pages, plus a published transparency log recording every report this project has released.

How it works, briefly

The methodology has the precise version. This is the short one.

1. A real browser opens the page. Not a simulation and not a source-code reader: a controlled Chromium browser on our server loads the public page under the conditions recorded in the report, and waits for it to settle.
2. Bounded evidence is recorded. The scanner retains captured HTTP requests, cookies, top-frame storage keys and selected browser-feature calls within published limits. Reports disclose caps, unsupported surfaces and collection failures, so their counts are lower bounds rather than complete transcripts.
3. Requests are matched against public catalogs. That turns a raw domain name into something readable, and separates advertising and analytics services from ordinary content.
4. The comparison modes run the page twice. Once as a baseline, once with one thing changed. Reporting the difference between two visits of the same page is far more defensible than reporting one visit and guessing.
5. The result is written down and fingerprinted. Each saved report gets a link, a machine-readable copy and a cryptographic digest. Runtime share links can expire under the ordinary retention policy; selected reports committed to the research corpus are retained separately.

Two limits worth stating plainly. A scan is one visit, at one moment, from one place — sites behave differently by country, by device and by time. And the scanner observes what a page does, never why: it can record that a request was sent to an advertising company, not what that company did with it.

Who made this

Site Behavior Lab is an independent project built and maintained by iAnonymous3000. It is not affiliated with, sponsored by, or endorsed by any of the sites it scans, any browser vendor, or any company whose services appear in its catalogs. Work began in June 2026 and continues in the open at the source repository, where every change is public.

The motivation is the gap described at the top of this page. Privacy tooling asks people to trust a verdict, and that request is backwards: the entire point of measuring something is that others can check the measurement. So this project publishes evidence instead of conclusions, records the conditions that produced it, keeps its corrections where the mistakes were, and licenses itself under the AGPL so the code behind any claim can be read by whoever the claim is about. Those are not features added later. They are the reason it exists.

If a report is wrong, say so. The corrections page explains how, and corrections are published rather than quietly applied.

What a report is, and is not

Every report on this site carries the same boundary, and it is worth reading before you cite one:

This report is investigative evidence that requires independent corroboration. It is not a standalone legal determination and not the sole exhibit in a legal proceeding.