How Luminol measures.
A Luminol scan is a dated observation, made in a real browser, from a given country. Here is what it measures, and what it does not claim to measure.
The browser and the network exit
Scans run in a driven Chromium browser that presents itself as an ordinary visitor from the measured country: language, time zone, exit address.
In France, the exit is a residential line. In other countries, it is a VPN exit in that country: some websites are more suspicious there, so those countries' figures are floors.
The journeys
Each scan plays several journeys in a fresh context: arriving without a choice, refusing, accepting, browsing without answering the banner, closing the banner. The complete protocol adds partial refusal, consent withdrawal, identifier persistence, arriving from an ad and account creation.
The banner is found by its labels in half a dozen languages and by the signatures of the main CMPs.
What is recorded
Third-party requests, browser cookies and storage, persistent identifiers and how they travel between companies, server-side relays, the consent chain (TCF, Consent Mode), the privacy policy.
Each company is named from public registers and a hand-kept database, with sources.
What Luminol does not claim
These are heuristic results, not legal advice. A scan describes what was observed that day, from that country: a website protected against bots may slip away, and Luminol says so rather than conclude.
A point “to check” calls for a human look; only a point “to fix” rests on evidence Luminol deems sufficient.