British Museum

https://www.britishmuseum.org · 32/92 checks passed · archives

Compliance report (framework 0.8)

Gate passed (every Core check must pass) · not counted towards the gate: paused 35, draft 48, ready for review 54.

Site level: 0 (no scored checks yet).

By level

Level	Result
Level 1 — Basic	21/37 (12 failed)
Level 2 — Enhanced	2/27 (4 failed)
Level 3 — Advanced	0/10 (1 failed)

By category

Category	Result
Accessibility	8/13
Accountability	0/5
AI & Automation	3/8
Interoperability	0/3
Privacy	6/16
Provenance	0/2
Security	6/11
Transparency	0/13
Responsibility to the Future	0/3

Level 1 — Basic

Accessibility

FAIL WCAG 2.1 Level A automated testing

5 WCAG 2.1 Level A violations reported by axe-core: aria-required-children, aria-required-parent, aria-valid-attr, list, listitem.

FAIL Valid semantic HTML structure

5 WCAG 2.1 Level A violations reported by axe-core: aria-required-children, aria-required-parent, aria-valid-attr, list, listitem.

FAIL No auto-playing media without controls

autoplay without controls: {'tag': 'video', 'src': '', 'autoplay': True, 'controls': False}

FAIL Media elements have controls

without controls: {'tag': 'video', 'src': '', 'autoplay': True, 'controls': False}

PASS Keyboard navigability

PASS Skip navigation link present

PASS Text alternatives for images

PASS Decorative images properly marked

PASS Proper heading hierarchy

PASS Sufficient colour contrast

AI & Automation

FAIL Dedicated AI policy page exists

Not found at any of: /ai-policy, /ai.

SKIPPED AI use policy in place

Skipped: Target page not found in captured content

PASS AI content disclosure in metadata

PASS robots.txt AI crawler rules

PASS No undisclosed AI-generated content

Privacy

FAIL No fingerprinting script patterns

1 inline script matched a tracker/ad pattern; first match: ' window.dataLayer = window.dataLayer || []; function gtag() { …'.

FAIL No hidden iframes or tracking beacons

1 hidden iframe found: https://consentcdn.cookiebot.com/sdk/bc-v4.min.html.

FAIL Data-leaking third-party services

Detected 2 data-leaking services across 1 category: cookie consent saas (consent.cookiebot.com, consentcdn.cookiebot.com).

PASS No third-party tracking scripts

PASS No third-party cookies

PASS No behavioural or targeted advertising scripts

PASS First-party cookies functional only

PASS Session cookies only

PASS No tracking pixels

Security

FAIL HTTP to HTTPS redirect

Redirect chain (1 hops): https://www.britishmuseum.org

FAIL Content Security Policy header

content-security-policy: header not set on the response.

PASS HTTPS enforced

PASS Security headers present

PASS Referrer-Policy header

PASS No mixed content

PASS Valid TLS certificate

PASS TLS certificate not expiring soon

Transparency

FAIL Contact email present

Not found at any of: /contact, /contact-us.

FAIL Contact form present

Not found at any of: /contact, /contact-us.

SKIPPED Contact information present

Skipped: Target page not found in captured content

SKIPPED Statement of purpose present

Skipped: Target page not found in captured content

SKIPPED Funding/sponsorship disclosure

Skipped: Target page not found in captured content

Level 2 — Enhanced

Accessibility

PASS Mobile responsive design

PASS Form labels accessible

Accountability

SKIPPED Named responsible person

Skipped: Target page not found in captured content

SKIPPED Published response timeframes

Skipped: Target page not found in captured content

SKIPPED Documented complaints process

Skipped: Target page not found in captured content

SKIPPED Clear appeals process

Skipped: Target page not found in captured content

AI & Automation

SKIPPED Published AI use policy (detailed)

Skipped: Target page not found in captured content

SKIPPED AI-assisted content clearly marked

Skipped: Target page not found in captured content

SKIPPED Human oversight of AI documented

Skipped: Target page not found in captured content

Interoperability

FAIL RSS/Atom feeds present

No RSS/Atom feeds discovered.

SKIPPED Content in open formats

Skipped: Target page not found in captured content

Privacy

FAIL Cookie banner partner disclosure

partner_count_specific: The banner refers generically to 'partners' without stating a specific numeric count of partners.
Fix: Display the exact number of third-party partners (e.g., 'We and our 123 partners...') in the consent banner copy.

SKIPPED Human-readable privacy policy

Skipped: Target page not found in captured content

SKIPPED Plain language data practices

Skipped: Target page not found in captured content

SKIPPED Data collection limited to necessity

Skipped: Target page not found in captured content

SKIPPED Published data retention periods

Skipped: Target page not found in captured content

SKIPPED No dark patterns in consent flows

Skipped: Target page not found in captured content

SKIPPED Advertising clearly labelled if present

Skipped: Target page not found in captured content

Provenance

FAIL Basic authorship metadata

No author or date metadata found on the page.

SKIPPED Authorship metadata assessment

Skipped: Target page not found in captured content

Security

FAIL security.txt published

security.txt not published.

Transparency

SKIPPED Named responsible person in contact

Skipped: Target page not found in captured content

SKIPPED Substantive statement of purpose

Skipped: Target page not found in captured content

SKIPPED Funding disclosed with detail

Skipped: Target page not found in captured content

SKIPPED Governance structure disclosed

Skipped: Target page not found in captured content

SKIPPED Algorithm explanation if applicable

Skipped: Target page not found in captured content

SKIPPED Annual data practices statement

Skipped: Target page not found in captured content

Level 3 — Advanced

Accessibility

SKIPPED Published accessibility statement

Skipped: Target page not found in captured content

Accountability

SKIPPED Published moderation policies

Skipped: Target page not found in captured content

Interoperability

FAIL Published uptime/status page

Not found at: /status

Security

SKIPPED Incident response plan published

Skipped: Target page not found in captured content

SKIPPED Responsible disclosure or bug bounty

Skipped: Target page not found in captured content

Transparency

SKIPPED Algorithmic decision criteria published

Skipped: Target page not found in captured content

SKIPPED Open source code or tech docs

Skipped: Target page not found in captured content

Responsibility to the Future

SKIPPED Environmental / sustainability disclosure

Skipped: Target page not found in captured content

SKIPPED Succession and continuity plan

Skipped: Target page not found in captured content

SKIPPED Worker wellbeing policy

Skipped: Target page not found in captured content