Methodology
How Suitcast scores a website and counts lawsuits
The exposure score
- Low
- 0 to 20
- Elevated
- 21 to 50
- High
- 51 to 80
- Critical
- 81 to 100
01What the scanner loads
A real Chromium browser opens the address you enter, then follows links on the same hostname breadth-first: 5 pages on a free scan, up to 100 on a monitored site. It identifies itself as SuitcastBot, respects robots.txt, loads at most one page per second, and never submits forms or logs in. The scanner policy has the details and the lines that block it.
02Tracking before consent
From the moment a page starts loading until the network goes quiet or 8 seconds pass, every outgoing request is checked, and each one that belongs to a known tracking script is recorded with its timing. Nothing is clicked. Requests are matched against a catalog of 43 tracking scripts, each with a risk level based on what it collects and how often it is named in California Invasion of Privacy Act complaints: 12 critical (session replay, chat that records keystrokes, the Meta and TikTok pixels), 18 high (other ad pixels, chat widgets, call tracking) and 13 medium (analytics, testing and email scripts).
The scanner then looks for a consent banner and, if it has a reject or decline control, clicks it and waits three seconds to see which trackers keep firing. A site with a banner whose reject button does nothing scores as if it had no banner.
- No tracker fires before consent
- Points
- 0, and the tracking score is 0
- Each distinct critical tracker before consent
- Points
- 25
- Each distinct high tracker before consent
- Points
- 15
- Each distinct medium tracker before consent
- Points
- 8
- No consent banner found
- Points
- +15
- Any tracker keeps firing after reject
- Points
- +15
- Maximum
- Points
- 100
03Accessibility failures
Each page is tested with axe-core against the WCAG 2.0 and 2.1 A and AA rules, capped at 50 violations per page. Suitcast reports 37 of those rules, the ones that appear in Americans with Disabilities Act website complaints, each with a weight from 1 to 5 reflecting how often complaints cite it. Images without alt text, unlabeled form fields, empty links and empty buttons carry weight 5.
- Each distinct failing rule
- Points
- Its weight multiplied by 5
- Each additional page where the same rule fails
- Points
- +1
- Maximum
- Points
- 100
04The exposure score and its label
The exposure score is the higher of the two component scores. Labels: 0 to 20 Low, 21 to 50 Elevated, 51 to 80 High, 81 to 100 Critical.
What the label means
05Where the lawsuit counts come from
Federal filings are pulled every day from CourtListener, the Free Law Project's public archive of court records, with two searches: one for ADA cases that mention web terms, one for CIPA cases that mention tracking terms. Criminal pen-register warrants that the CIPA search also returns are excluded by case name, and appellate dockets are excluded by court. The counts, verification and matching are Suitcast's own work, not produced, reviewed or endorsed by the Free Law Project.
A federal ADA case is counted as a website case when the plaintiff firm is on the list of known website filers, when the plaintiff is a repeat website plaintiff, or when the complaint text contains two or more web terms (website, screen reader, WCAG, visually impaired, alt text, keyboard navigation). CIPA cases are counted once the complaint names the statute and tracking terms. Everything else stays in a review queue and never appears on a public page.
State-court filings, mainly California CIPA cases, are added weekly from public sources with the source shown on every row. When a complaint is available, its text is used to find the defendant's home state, the defendant's website and the scripts or issues named, which is what makes the who-got-sued box match your findings. An accessibility issue counts as named only when the complaint alleges it against the defendant, not when its opening pages describe accessibility barriers in general.
06How counts are attributed to a state
ADA website cases are attributed to the court's state, or to the defendant's state when the complaint names it. CIPA cases are attributed to the defendant's state, because about three in four are filed in California courts, against companies located anywhere. When a state has fewer than five verified cases in 12 months, the page says so and shows national numbers next to the local ones. Windows are always stated, and where a theory's records start inside a window the page says since when.
07What the scan does not check
- Pages behind a login, forms, carts and checkouts.
- Scripts served from unknown hosts, first-party proxies, or server-side integrations.
- Manual accessibility review: screen-reader reading order, meaningful link context, the accuracy of video captions, PDFs.
- Privacy policy wording, consent-log storage, and whether a banner is legally sufficient.
- State-court filings that are not published in a public source Suitcast reads.
Suitcast identifies risk indicators. It is not legal advice and does not determine compliance.
Questions about the method
- Why is the score higher than the number of problems suggests?
- Because the weights follow what complaints cite, not how many things are wrong. One session-replay script that fires before consent adds 25 points on its own; five low-weight accessibility rules together may add less. A high score means the site has the specific things plaintiff firms look for.
- Why does my score change between scans when I changed nothing?
- Third-party scripts change without notice: a tag manager can start loading a new pixel, a theme update can drop alt text. The weekly re-scan exists to catch exactly that, and the alert email lists what appeared and what disappeared.
- Can the scanner miss a tracker?
- Yes. It matches request hosts against a catalog of 43 known trackers. A script served from an unknown host, a first-party proxy, or a server-side integration will not be matched. The catalog grows as new names appear in complaints.
- How is a case verified as a website case?
- A federal ADA case counts when the plaintiff firm or the plaintiff is on the list of known website filers, or when the complaint text names web terms such as screen reader or WCAG at least twice. CIPA cases count when the complaint names the statute and web tracking terms. Everything else waits in a review queue and is never shown publicly.
Keep going
See your own score in about a minute
Suitcast identifies risk indicators. It is not legal advice and does not determine compliance.