How the Index makes money, and what that doesn’t buy

Last updated 7 August 2026

Scores come from public evidence only

Every score on this site, and every score in a sector report, comes from what any visitor can observe from the outside: a homepage, a privacy policy, a consent banner, a settings page, a support page. No access agreement, no NDA, no cooperation from the company, and nothing shared with me privately.

That’s a methodological choice first, because it’s what makes a score reproducible by a stranger. But it’s also the structural answer to the question below, because a company has nothing to give me that could move a number.

Paying doesn’t change a score

Not the number, not the evidence, not the timing, and not whether a brand appears at all. There’s no arrangement under which a company can pay to be scored, to be scored again, to be left out, or to have a score removed. Rescoring after you’ve changed your site is free and open to anyone, which is a different thing, and it’s set out below.

If you’re wondering whether this is the issuer-pays problem that damaged the credit rating agencies, it’s a fair question and it’s the right one to ask. The difference is what the money buys. A rating agency was paid by the issuer to produce the rating itself. I’m paid to teach a method or to help a company act on a result, and never to produce or revise the result.

What a company can actually get by paying

A walkthrough of a scorecard already published, a workshop that teaches the method, or an audit that goes deeper than the public Index does. In every case they’re buying my time on the application, not the finding. The recommendations in every sector report are written to be usable by a company that never contacts me, on purpose.

What a company gets for free

The right of reply. If a brand thinks a score is wrong, they can tell me what I got wrong and point at the evidence. If they’re right, I correct it and say so in public, dated. That costs nothing and it isn’t a service. It’s how the index stays accurate.

Disagreement isn’t enough on its own. A score changes when the evidence changes, which means either the site changed or I read it wrong.

Scores can improve, including for companies I’ve worked with

A score measures a website on a date. If the website gets better, the score should get better, and the record should show both. That includes a company that paid for an audit, acted on it, and changed things.

What keeps that from being a score you can buy:

• The trigger is a change to the site, not a payment. Anyone can ask to be rescored after making changes, client or not, and asking costs nothing.
• The evidence is still public. A rescore uses the same rubric and the same publicly observable evidence, so anyone can repeat it and get the same answer. If a number moves, you can go and see what moved it.
• The old score stays on the page. A rescore is published beside what it replaced, both dated. An improvement is a record over time, not a number that quietly changed.
• A rescore can go nowhere, or down. If a company acts on advice and the score doesn’t move, that gets published in the same words as a rise would.
• Sector reports rescore everyone. An annual report re-measures its whole list on one date, so companies that never contacted me get measured exactly as often as the ones that did.

Where I publish an improvement for a company I’ve worked with, the page says so and says what changed on their site. The claim is that the site got better and here’s the evidence. It isn’t that hiring me raises scores.

Corrections are dated, not quiet

When a score moves, the page says what it was, what it is now, and why. When a change to the method moves several scores at once, that’s stated too, including which brands moved and which didn’t. Scores have already been revised this way, and the revisions are still on the pages.

Arguments published before a correction stay as they were written, with the correction dated alongside them. Rewriting an argument after the fact is worse than dating it.

Clients get disclosed

If a company I’ve done paid work for appears in a report or on the scores page, that relationship is stated on the page where their score appears, for as long as the score is published. Being a client doesn’t exempt a brand from being scored, and it doesn’t protect the score from being a bad one.

Who does the scoring

Me. Every score published so far was produced by one person using the same rubric, which is a limitation as much as a guarantee. Where a judgment is mine rather than a measurement, the evidence note says so. Access on the Clarity dimension is the clearest example: no formula can tell you whether a policy is one document or four, so I decide, and I show you what I decided.

What the Index doesn’t measure

Server-side data practices, internal governance, regulatory compliance, or what a company does with data once it has it. The Index measures the experience a person has when they try to understand, agree to, or control their data. A high score is not a clean bill of health, and I’d rather say that here than have someone discover it later.

Dr. Andrew Ko, The Data Human. Questions about any of this, a score you think is wrong, or a brand the Index should be looking at: get in touch.