Scan a public website for DPDP signals.
Paste the public URL of a site you are responsible for, or one you are about to review. DPDP Bot fetches the homepage and one privacy notice if it can find the link. You get a score from 0 to 100, the gaps behind that number, and a page you can forward. The link looks like /s/ followed by an id. Anyone with it can open the report. There is no directory of scans.
The score is what those public pages showed. It is not a certificate under the Digital Personal Data Protection Act, 2023 or the DPDP Rules, 2025.
What the scan looks at
You submit a public http or https URL. The bot requests it, follows a few redirects, and reads the HTML. Private networks, localhost, link-local addresses, cloud metadata hosts, and ports other than 80 and 443 are refused. The same checks run again when the connection opens, and on every redirect. The user agent is DPDPBot/0.1.
If the homepage HTML looks too thin to trust, the scan tries one short headless render and reads links from that document. Too thin means no notice link, a script-drawn shell, or a block page. It then fetches one privacy notice as ordinary HTML, or a cookie page if that is all the homepage offers. It does not crawl the rest of the site and it does not log in.
On those pages it looks for a notice a visitor could actually find. It also looks for wording on purpose, the personal data involved, access, correction, erasure, nomination, withdrawal, retention, children, a grievance contact, and a complaint to the Data Protection Board. Third-party tags are noted, including common Indian hosts such as CleverTap, MoEngage, WebEngage, and Netcore, plus the usual payment widgets. A match is a host on the page, not a judgment about the contract behind it. Forms that ask for a name, email, or phone with no notice cue beside them are called out. So is a page that is not on HTTPS, along with a light look at common browser security headers.
A missing banner is not scored like a European reject-button test. Section 7 of the Act lists legitimate uses where consent is not the ground. The consent finding stays informational unless analytics, advertising, or marketing tags are present with no visible choice. Then it is raised to low. If the render does not finish, the report says the fetch was limited. A missing notice in that case is not treated as proof that the organisation publishes none.
What 0 to 100 means
Every report starts at 100. A high gap deducts 16, a medium gap deducts 9, and a low gap deducts 4. Info items stay on the report and do not move the number. The result stops at 0.
- 80 to 100. Strong public signals.
- 60 to 79. Partial public signals.
- 40 to 59. Thin public signals.
- 0 to 39. Few public signals.
If no privacy notice can be read, the scanner does not also deduct for every missing clause. It says the notice was not available, and it still looks at the homepage for a contact, a form, tags, and the connection. The band describes the pages we fetched, not the fiduciary's legal position.
Questions that come up
What does DPDP Bot check?
Public pages only. It fetches the homepage you submit and, if one is linked, a privacy notice or a cookie page. It looks for a notice a visitor can find; wording on purpose, personal data, access, correction, erasure, nomination, withdrawal, retention, children, and a complaint to the Data Protection Board; a grievance contact; third-party tags, including Indian products such as CleverTap, MoEngage, WebEngage, and Netcore; forms that ask for a name, email, or phone; and whether the page is on HTTPS with a light set of browser headers. It does not see databases, contracts, or anything behind a login.
What does the score mean?
The score runs from 0 to 100 and starts at 100. A high gap deducts 16 points, a medium gap 9, and a low gap 4. Items marked info are shown and do not change the number. 80 to 100 is strong public signals, 60 to 79 is partial public signals, 40 to 59 is thin public signals, and below 40 is few public signals. The band describes the pages that were fetched. It is not a legal conclusion about the Data Fiduciary.
Is this legal advice or a compliance certificate?
No. DPDP Bot does not give legal advice, does not certify compliance, and does not declare that anyone has breached the Act. A banner on the page can still be the wrong kind of consent. A missing banner can be fine where a legitimate use under Section 7 applies. Use the findings as a list of public signals, then review what the organisation actually does with personal data.
How does this relate to the DPDP Act, 2023 and the Rules, 2025?
The scanner is framed around the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. Those are the Indian rules on notice, consent, withdrawal, children's data, grievance redress, and the Data Protection Board. DPDP Bot reads a public website for signals that line up with that frame. It does not decide whether a Data Fiduciary meets the Act.
What are the limits of a scan?
The fetch is static HTML, plus at most one short headless render when the homepage looks too thin: a script shell, a block page, or no notice link. If that render does not finish, the report is marked fetch-limited and a missing notice means not seen, not proof that none exists. Keyword matches miss unusual phrasing and can hit a sentence that is not doing the legal work. An unknown tag host is not treated as clean. Security headers are not an audit of reasonable security safeguards. Reports are unlisted. Anyone with the link can open one, and this demo stores them in a local SQLite file.
A fictional report
Mehfil & Co is not a real shop. The sample report scores 42, which is thin public signals: a short notice, a checkout form with no cue beside it, and CleverTap on the homepage. It is there so you can see the shape of a result before you scan anything of your own.
Monitoring is not built yet
The free scan is one fetch. What is not here yet is a schedule: rescan, diff the notice, flag a new tag. Leave a work email if you want a note when that opens. This form writes the address into the local database. It does not send mail, and it does not bill anyone.