Methodology

What we examine. How we examine it. What you receive.

Verimont does not run a passive scan. A live browser loads your domain, intercepts what it transmits, interacts with your consent interface, and tests whether your site honors a user who says no. Every finding is documented with observed evidence before any analysis is written.

How the Scan Works

The scan runs in three phases before any report is generated. Each phase produces structured evidence. The report is written from that evidence, not from assumptions.

01

Live Browser Intercept

A live browser loads your domain from a clean state, no cookies, no prior consent signals, no browser history. Every network request is captured from the first byte. We record which scripts fire, when they fire, what third-party domains they contact, and whether any of that activity precedes a consent signal from the user.

This is not a simulated scan. It is a live intercept of your site as it actually behaves for a new visitor.

What We Capture

  • Pre-consent script firing, confirmed by timestamped network intercept
  • Cookie classification, typed by function and consent timing
  • Third-party data transmission, identified by domain and jurisdiction
02

Interactive Consent Testing

We interact with your consent interface the way a real user would. Three tests run in sequence.

First, we click Reject All and observe whether your site honors the rejection. Tracking scripts that continue transmitting data after a rejection signal are not a configuration gap. They are an active violation of Quebec Law 25 under the Act respecting the protection of personal information in the private sector, P-39.1, s.8.1.

Second, we measure how many clicks it takes to accept cookies, then how many clicks it takes to withdraw that consent. Quebec Law 25 (P-39.1) requires withdrawal to be as easy as consent. If acceptance takes one click and withdrawal takes four navigation steps, that disparity is a citable finding with a specific click count as evidence.

Third, we test for visual dark patterns in the rendered consent interface: whether reject options are visually deemphasized, whether consent is implied by continued use, whether the purpose of data collection is stated or absent.

What We Test

  • Rejection signal compliance, tested by live browser interaction
  • Consent withdrawal parity, measured by click count comparison
  • Dark pattern detection, assessed from rendered screenshot and HTML
  • Data transmission after rejection signal, captured with timestamp
03

Document Analysis

We crawl every publicly accessible legal document on your domain. Privacy policy, cookie policy, cookie declaration, terms of service, contact page, help center pages related to data requests, and French versions of all of the above.

Each document is analyzed against a structured statutory checklist. Every pass, fail, and partial result is documented with a verbatim quote from your own document as evidence. Nothing is inferred. If it is not in your published documents, it is not credited.

What We Analyze

  • Privacy policy (English and French, if both exist)
  • Cookie policy and cookie declaration
  • Terms of service
  • Data subject access request pathways
  • Breach notification procedures
  • Cross-border transfer disclosures

The Four Diagnostic Vectors

Every finding maps to one of four vectors. No overlap between categories. No gaps in coverage. The result is a liability map that holds under regulatory scrutiny.

I

Ingestion and Consent Architecture

The front door. Every commercial website is a data collection machine. The question Quebec Law 25 (P-39.1) asks is simple: did you ask first, and did you honor it when someone said no?

This vector documents what your site transmits before consent, how your consent interface behaves under interaction, whether a rejection signal is honored, and whether withdrawal is operationally equivalent to acceptance.

  • Pre-consent script firing, confirmed by timestamped network intercept
  • Rejection signal compliance, tested by live browser interaction
  • Consent withdrawal parity, measured by click count comparison
  • Dark pattern detection, assessed from rendered screenshot and HTML
  • Cookie classification, typed by function and consent timing
  • Third-party data transmission, identified by domain and jurisdiction
Quebec Law 25 under the Act respecting the protection of personal information in the private sector, P-39.1, s.8.1: "Any person who collects personal information must, before doing so, take reasonable steps to inform the person concerned of the purpose for which the information is collected and obtain their consent."
II

Governance and Personnel Accountability

The paperwork. Regulatory frameworks do not just mandate behavior. They mandate accountability structures and public disclosure of who is responsible.

This vector checks whether your organization has publicly designated a named Privacy Officer with a functional contact route, whether your privacy policy is available in French for Quebec-located subjects, whether it references the applicable legislation explicitly, and whether it has been updated since Quebec Law 25 (P-39.1) came into full force in September 2023.

  • Named Privacy Officer with public contact route
  • French-language privacy policy, checked for existence and substantive equivalence
  • Explicit Quebec Law 25 (P-39.1) reference in published policy
  • Data retention schedules defined and published
  • Cross-border transfer disclosure present
  • Policy updated post-September 2023
Quebec Law 25 under the Act respecting the protection of personal information in the private sector, P-39.1, s.3.1: "Every person carrying on an enterprise must designate a person in charge of the protection of personal information." PIPEDA, the Personal Information Protection and Electronic Documents Act, Schedule 1, Principle 1: "An organization is responsible for personal information under its control."
III

Sovereign Infrastructure and Cross-Border Transits

The back end. Where data physically lives determines which government can compel its disclosure.

This vector traces your DNS records, resolves your server IP to a jurisdiction and datacenter operator, identifies your CDN provider via CNAME chain analysis, and enumerates subdomains through certificate transparency logs. If any component of your infrastructure runs on a US-headquartered provider, including AWS, Google Cloud, Azure, Cloudflare, or Fastly, your data may be reachable by US federal authorities under the CLOUD Act, regardless of where the data physically sits.

  • Primary server jurisdiction, resolved by IP geolocation and WHOIS
  • CDN provider identification via CNAME chain and response headers
  • Subdomain enumeration via certificate transparency logs
  • CLOUD Act exposure assessment by provider
  • Cross-border transfer disclosure in published documents
  • PIA publication check
Quebec Law 25 under the Act respecting the protection of personal information in the private sector, P-39.1, s.17: "Before communicating personal information outside Quebec, a person carrying on an enterprise must conduct a privacy impact assessment." US CLOUD Act, 18 U.S.C. 2713 applies regardless of where data physically resides.
IV

Subject Rights and Remediation Mechanics

The exit. Knowing what data you hold is the minimum. Having operational infrastructure to delete it, export it, and respond to subject access requests within mandated timelines is the requirement.

This vector checks whether a functional subject access request pathway exists beyond a policy statement, whether a deletion mechanism is documented and reachable, whether data portability is supported, and whether breach notification procedures are published.

  • Subject access request pathway, tested for functional existence beyond policy language
  • Deletion mechanism, assessed for operational reachability
  • Data portability, checked for format and availability
  • Breach notification procedures, checked for publication
  • Response timelines, checked against statutory requirements
Quebec Law 25 under the Act respecting the protection of personal information in the private sector, P-39.1, s.28: "A person carrying on an enterprise must, at the request of the person concerned, communicate to the person, in a structured, commonly used technological format, the personal information collected from the person."

Jurisdictions Covered

Quebec Law 25 (P-39.1)

Bill 64, now Quebec Law 25 under the Act respecting the protection of personal information in the private sector, P-39.1, is in full force. The most demanding provincial privacy legislation in Canada. Applies to any organization processing personal information of Quebec residents, regardless of where the organization is based. Full enforcement has been active since September 2023.

PIPEDA / Bill C-27 (proposed)

PIPEDA, the Personal Information Protection and Electronic Documents Act, governs commercial organizations under federal jurisdiction. Bill C-27, the proposed Consumer Privacy Protection Act, is currently before Parliament and not yet in force — it would propose significant reforms including a statutory tort of privacy violation and fines up to $10M or 3% of global turnover. Verimont audits against current PIPEDA requirements and flags exposure that would constitute a violation under the proposed CPPA framework, clearly marked as proposed, not in force.

US CLOUD Act

Not Canadian law, but directly relevant to Canadian data sovereignty. The CLOUD Act allows US federal agencies to compel US-domiciled cloud providers to disclose data stored anywhere in the world. If your infrastructure runs on a US-headquartered provider, your data may be reachable by US authorities without your knowledge or consent. Verimont identifies every component of your infrastructure subject to this exposure.

What the Dossier Contains

The full report is delivered to a secure page on the Verimont site and can be downloaded as a PDF. Every finding includes the observed evidence, the applicable statute cited by section number, and a direct link to the legislation. Nothing is asserted without documentation.

From Submission to Dossier

T + 0
Domain Submitted
Scan queued. Live browser loads your domain immediately.
~15 min
Preliminary Findings
Preliminary findings disclosed. Risk classification and first two diagnostic vectors with observed evidence.
T + 2-4 hrs
Full Dossier Ready
Complete four-vector report available on your report page. Download as PDF at any time.
T + 60 days
Refund Window
If you choose not to act on the findings, request a full refund. No questions asked.

Start with a free preliminary scan.

No credit card. No account. Confidential.

Confidential. No credit card. No account.