Technical Documentation
Scanner Methodology
How TDARI calculates your website's legal risk score — transparently.
Composite Scoring Formula
Score = (WCAG x 0.40) + (Security x 0.15) + (Privacy x 0.25) + (TCPA x 0.20)
Each module produces a 0-100 risk score. The composite score weights ADA/WCAG compliance most heavily (40%) because it represents the largest volume of federal lawsuits. Privacy receives 25% due to the rising tide of CIPA wiretapping litigation. TCPA gets 20% for statutory damages exposure. Security headers contribute 15% as an emerging but still developing litigation area.
The 4 Modules
Module 1: ADA / WCAG Accessibility
Weight: 40% | Engine: axe-core v4.x
Scans up to 10 pages using Puppeteer + axe-core to identify WCAG 2.2 Level AA violations. Checks include:
- Missing alt text on images
- Insufficient color contrast ratios
- Missing form labels and ARIA attributes
- Keyboard navigation failures
- Missing skip links and heading hierarchy
- Dynamic content (ARIA live regions, focus management)
Legal basis: ADA Title III (42 U.S.C. 12182). Over 4,000 digital accessibility lawsuits filed in federal courts in 2025.
Module 2: Security Headers
Weight: 15% | Engine: HTTP HEAD check
Performs a single HTTP HEAD request to analyze response headers. Checks:
- HSTS (Strict-Transport-Security) for forced HTTPS
- Content-Security-Policy (CSP) to prevent XSS
- X-Frame-Options to prevent clickjacking
- X-Content-Type-Options for MIME sniffing prevention
- Referrer-Policy for data leakage control
- Permissions-Policy for feature access control
Legal basis: CCPA (Cal. Civ. Code 1798.150) - $100-$750 per consumer for data breaches enabled by missing security controls.
Module 3: Privacy and Tracking
Weight: 25% | Engine: HTML source analysis
Fetches page source and analyzes for undisclosed tracking technologies:
- Meta Pixel (Facebook) without cookie consent
- Google Analytics without cookie consent banner
- Session replay tools (Hotjar, FullStory, Microsoft Clarity)
- Missing cookie consent mechanism
- Third-party advertising pixels
Legal basis: CIPA (Cal. Penal Code 631) - wiretapping lawsuits targeting websites with undisclosed tracking. $5K-$50K+ per plaintiff.
Module 4: TCPA / Phone Forms
Weight: 20% | Engine: Form analysis
Scans HTML forms that collect phone numbers and checks for:
- Explicit TCPA consent language
- Required consent checkbox (not pre-checked)
- Opt-out mechanism disclosure
- Clear identification of who will be calling/texting
Legal basis: TCPA (47 U.S.C. 227) - $500-$1,500 per violation in statutory damages. Class action exposure can reach millions.
The "+1" - Real Lawsuit Cross-Reference
Fear Capsules
25,000+ federal court filings indexed
What makes TDARI unique is our cross-reference with real federal court data. For each failed module, TDARI searches our database of 25,000+ ADA, CIPA, and TCPA filings from CourtListener/PACER to find relevant lawsuit precedents. This is the "4+1" moat - no competitor has litigation data beside scan results.
Data source: CourtListener (Free Law Project) - federal PACER records. All case data is publicly available and verified.
Limitations and Disclaimer
- info TDARI is an informational tool, not a law firm. Reports are not legal advice.
- info Automated scans cannot catch every issue. Manual expert audits provide deeper coverage.
- info Scores reflect a point-in-time snapshot. Websites change; compliance requirements evolve.
- info Lawsuit data reflects public federal filings and may not include state court or settled cases.
- info Settlement averages are category-level estimates, not per-case predictions.