Check catalogue
Every check, with its receipts
Each entry names the rule, quotes what the source requires, records when we last checked it, and declares the tier it was verified at. If a rule cannot show its source, it does not load.
- MED-PHI-AUTHEvery patient image has a live authorizationA separate written authorization is required for each use of a patient image in marketing.45 CFR §164.508 · checked 2026-10-06 · In build · phase onerequiredDeterministic
- MED-PHI-FACEFull-face photographs are treated as identifiersFull-face photographic images are a Safe Harbor identifier. Cropping does not de-identify them.45 CFR §164.514(b)(2)(i)(Q) · checked 2026-10-06 · In build · phase tworequiredAdvisory
- AD-RESULTS-DISCLAIMER“Results not typical” does not cure a misleading result claimThe regulator states, on the basis of its own consumer testing, that a “results not typical” style disclaimer is insufficient to cure an otherwise misleading depiction.16 CFR §255.2(b) · checked 2026-10-06 · In build · phase tworequiredDeterministic
- MED-FDA-CLEAREDDevices are described as cleared, not approvedMost aesthetic energy devices reach market through 510(k) clearance rather than approval, and registration and listing do not denote approval.21 CFR §807.97 · checked 2026-10-06 · In build · phase tworequiredBounded
- MED-BOARD-CERTA “board certified” claim names the certifying boardThe full name of the certifying board must appear at comparable prominence to the claim itself.Cal. B&P §651(h)(5)(C) · checked 2026-10-06 · In build · phase onerequiredDeterministic
- AD-DISCLOSURE-POSDisclosures are placed where they will actually be readDisclosures placed at the end of a post, in a bio only, behind a “more” link, or buried among hashtags do not satisfy the requirement.16 CFR Part 255 · checked 2026-10-06 · In build · phase onerequiredDeterministic
- MSG-SMS-STOPCampaign messaging honours opt-out keywordsRecipients must be able to revoke consent, and the statute carries a private right of action.47 CFR §64.1200(a)(10) · checked 2026-10-06 · In build · phase tworequiredDeterministic
- MSG-AUTHBulk email authenticates and unsubscribes correctlySPF, DKIM and DMARC alignment, plus a one-click unsubscribe whose headers are covered by the DKIM signature.RFC 7208; RFC 6376; RFC 9989; RFC 8058 · checked 2026-10-20 · In build · phase oneDeterministic
- A11Y-CONTRASTText meets minimum contrast against its backgroundText must meet a minimum contrast ratio against its background.Success Criterion 1.4.3 · checked 2026-10-06 · In build · phase oneDeterministic
- A11Y-ALTImages carry alternative textNon-text content has a text alternative.Success Criterion 1.1.1 · checked 2026-10-06 · In build · phase oneDeterministic
- GEO-CRAWLERAnswer-engine crawlers are not blockedAnswer engines use named user agents. If the origin refuses them, the site cannot be cited as a source.Operator-published user-agent documentation · checked 2026-09-07 · In build · phase oneDeterministic
- PROV-AI-MARKAI-generated content carries machine-readable markingTo the extent technically feasible, a covered provider must include a latent disclosure meeting the statute's criteria in any image, video or audio content its GenAI system creates or alters, except by minor modification. Applied from 2026-08-02.Cal. Bus. & Prof. Code §22757.3(a) · checked 2026-10-06 · In build · phase tworequiredDeterministic
- FL-ADV-FREEFlorida "free consultation" ads carry the 72-hour refusal statementAny advertisement for a free, discounted or reduced-fee service by a Florida-licensed health care practitioner must carry a fixed statement, "in capital letters clearly distinguishable from the rest of the text", telling the patient they may refuse to pay, cancel payment or be reimbursed for any service performed within 72 hours of responding to the advertisement.Fla. Stat. §456.062 · checked 2026-10-06 · In build · phase onerequiredDeterministic
- TX-ADV-ELIGIBLE"Board eligible" and "board qualified" are prohibited in TexasTexas deems it false, deceptive or misleading advertising to use "board eligible", "board qualified", "or any similar language calculated to convey the same meaning as ‘board certified’".22 TAC §164.3(b)(1) · checked 2026-10-06 · In build · phase onerequiredDeterministic
- TX-ADV-CERT-BODYA Texas "board certified" claim names an accepted certifying bodyIn Texas, "board certified" may be used only by a physician currently certified by a member board of the ABMS, the AOA Bureau of Osteopathic Specialists, the American Board of Oral and Maxillofacial Surgery, or a certifying organisation separately approved by the Board.22 TAC §164.4(a) · checked 2026-10-06 · In build · phase tworequiredBounded
- GEO-STRUCTURED-DATAPractice pages carry structured data a machine can readSchema.org markup describing the practice, its locations, its practitioners and its services lets search and answer engines read the page as data rather than inferring it from prose. Google is explicit that this earns no entitlement: "Google does not guarantee that your structured data will show up in search results, even if your page is marked up correctly according to the Rich Results Test."developers.google.com/search/docs/appearance/structured-data/sd-policies · checked 2026-09-09 · In build · phase twoAdvisory
- GEO-CWV-LABPage-experience measurements, reported as the lab signal they areCore Web Vitals are assessed on field data — "a good threshold to measure is the 75th percentile of page loads, segmented across mobile and desktop devices". A single measurement taken by us is a lab measurement, and web.dev is direct about the limit: "While lab measurement is an essential part of delivering great experiences, it is not a substitute for field measurement."web.dev/articles/vitals · checked 2026-09-09 · In build · phase threeAdvisory
- NY-ADV-GUARANTEENew York prohibits advertising that guarantees any serviceNew York defines it as unprofessional conduct for a licensed professional to advertise in a way that "guarantees any service", or that "makes claims relating to professional services or products or the cost or price therefor which cannot be substantiated by the licensee, who shall have the burden of proof", or that "makes claims of professional superiority which cannot be substantiated by the licensee, who shall have the burden of proof". The burden of proof sits with the licensee, not the regulator.8 NYCRR §29.1(b)(12)(i) · checked 2026-10-06 · In build · phase onerequiredDeterministic
- NY-ADV-TESTIMONIALNew York patient portrayals need written authorization and disclaimersNew York permits testimonials and portrayals of patients only where "the patient or client expressly authorizes the portrayal in writing", "appropriate disclosure is included to prevent any misleading information or imagery", and "reasonable disclaimers are included as to any statements made or results achieved in a particular matter". Fictional situations are permitted only where no testimonials are included, and "fictional client testimonials are not permitted".8 NYCRR §29.1(b)(12)(iv) · checked 2026-10-06 · In build · phase tworequiredBounded
- GEO-EXTRACTABLEContent is structured so an answer engine can extract and attribute itGoogle frames its content guidance as a self-assessment rather than a specification: "Evaluating your own content against these questions can help you gauge if the content you're making is helpful and reliable." The same page states that E-E-A-T "isn't a specific ranking factor". So the checkable question is structural — does a page state what it is about near the top, answer the question it poses, and name its sources where a reader or an engine can find them — not whether it earns a placement.developers.google.com/search/docs/fundamentals/creating-helpful-content · checked 2026-09-09 · In build · phase threeAdvisory
- KS-ADV-GUARANTEEKansas prohibits advertising a guaranteed or painless serviceKansas defines it as unprofessional conduct for a licensee to advertise "to guarantee any professional service or to perform any operation painlessly". The same section also names "[a]dvertising professional superiority or the performance of professional services in a superior manner" (b)(7), and solicitation "through the use of fraudulent or false advertisements" (b)(1).K.S.A. 65-2837(b)(8) · checked 2026-10-06 · In build · phase onerequiredDeterministic
- MO-ADV-SUBSTANTIATEMissouri prohibits unsubstantiated cure and superiority claimsMissouri makes advertising a ground for discipline where it is "false or misleading", or where it "claims without substantiation the positive cure of any disease, or professional superiority to or greater skill than that possessed by any other physician". A separate clause, §334.100.2(4)(e), names "[m]isrepresenting that any disease, ailment or infirmity can be cured by a method, procedure, treatment, medicine or device".RSMo §334.100.2(4)(r) · checked 2026-10-06 · In build · phase onerequiredBounded
- KS-ADV-FALSEKansas treats soliciting patients by false advertisement as misconductKansas defines unprofessional conduct to include "[s]olicitation of professional patronage through the use of fraudulent or false advertisements". The Act defines a false advertisement as "any advertisement that is false, misleading or deceptive in a material respect", and defines advertisement broadly as representations disseminated by any means for the purpose of inducing the purchase of professional services.K.S.A. 65-2837(b)(1) · checked 2026-10-06 · In build · phase onerequiredBounded
- KS-ADV-SUPERIORITYKansas prohibits advertising professional superiorityKansas names it as unprofessional conduct to advertise "professional superiority or the performance of professional services in a superior manner". Unlike Missouri, which permits a superiority claim that the licensee can substantiate, Kansas states the prohibition without a substantiation escape.K.S.A. 65-2837(b)(7) · checked 2026-10-06 · In build · phase onerequiredDeterministic
- MED-PHI-FILENAMEImage filenames can publish a name the page never showsNames are the first identifier Safe Harbor requires to be removed. An image URL is published HTML: a filename pairing a surname with a treatment discloses that name to anyone reading the source, whatever the picture itself shows.45 CFR §164.514(b)(2)(i)(A) · checked 2026-10-06 · In build · phase onerequiredDeterministic
- MED-IMG-PROVENANCEManufacturer before-and-after images need written permission, not patient consentA before-and-after image on a practice site is one of two different things, and they need different instruments. If the practice took it, it needs a HIPAA marketing authorization under §164.508 — a specific, revocable document, not a general consent form. If a device manufacturer supplied it, the practice instead needs the manufacturer's written permission naming the practice, and their warranty that they hold the subject's authorization.45 CFR §164.508; 16 CFR §255.2(b) · checked 2026-10-06 · In build · phase onerequiredBounded
- MSG-EMAIL-OPTOUTMarketing email carries a working opt-out that keeps workingEvery commercial email must carry a functioning opt-out mechanism, clearly and conspicuously displayed, and it must still work for at least thirty days after the message was sent.15 U.S.C. §7704(a)(3)(A) · checked 2026-10-06 · In build · phase tworequiredDeterministic
- MSG-EMAIL-DISCLOSEMarketing email says it is marketing, and says who sent itA commercial email must identify itself as an advertisement or solicitation, give clear notice of the opportunity to decline further mail, and carry a valid physical postal address of the sender.15 U.S.C. §7704(a)(5)(A) · checked 2026-10-06 · In build · phase tworequiredDeterministic
- FTC-REVIEW-INCENTIVEReview requests do not pay for a sentimentCompensation may not be offered in exchange for, or conditioned on, a review expressing a particular sentiment. Asking for a review is permitted; asking for a good one and paying for it is not.16 CFR §465.4 · checked 2026-10-06 · In build · phase tworequiredDeterministic
- FTC-REVIEW-INSIDERStaff testimonials disclose the relationshipA testimonial from an officer, manager, employee or agent must carry a clear and conspicuous disclosure of that relationship, unless it is already obvious to the reader.16 CFR §465.5(b)(1) · checked 2026-10-06 · In build · phase tworequiredBounded
- A11Y-LABELSForm fields tell you what to typeEvery consultation form, booking form and newsletter box needs a programmatic label, not just placeholder text that disappears the moment someone types.Success Criterion 3.3.2 · checked 2026-10-06 · In build · phase twoDeterministic
- A11Y-LINK-PURPOSELinks say where they goA link must be understandable from its own text or its immediate context.Success Criterion 2.4.4 · checked 2026-10-06 · In build · phase twoDeterministic
- A11Y-PAGE-TITLEEvery page is titledEach page carries a title describing what it is.Success Criterion 2.4.2 · checked 2026-10-06 · In build · phase twoDeterministic
- A11Y-LANGThe page declares its languageThe document carries a lang attribute.Success Criterion 3.1.1 · checked 2026-10-06 · In build · phase twoDeterministic
- A11Y-STRUCTUREHeadings and lists are real markupVisual structure must exist in the markup, not only in the styling.Success Criterion 1.3.1 · checked 2026-10-06 · In build · phase twoDeterministic
- A11Y-NAME-ROLEButtons and controls announce themselvesInteractive components expose a name, a role, and their state.Success Criterion 4.1.2 · checked 2026-10-06 · In build · phase twoDeterministic
- WA-MHMD-LINKA consumer health data privacy policy, linked from the homepageWashington requires a separate consumer health data privacy policy, and a link to it published prominently on the homepage. A general privacy policy does not satisfy this — the statute names a distinct document.RCW 19.373.020 · checked 2026-10-06 · In build · phase tworequiredDeterministic
- WA-MHMD-CONSENTConsent before health data is collected, not afterConsent must be obtained before any consumer health data is collected or shared, and the request must disclose the categories collected, the purpose, who it is shared with, and how to withdraw.RCW 19.373.030 · checked 2026-10-06 · In build · phase tworequiredBounded
- FTC5-PRIVACY-PROMISEA privacy policy that promises what the site does not doA privacy policy is a representation to consumers. Promising that information is never shared with third parties while running advertising tags that send visitor data to them is a deceptive practice under the FTC Act — the theory behind the FTC's GoodRx and BetterHelp actions.15 U.S.C. §45(a)(1) · checked 2026-10-19 · In build · phase tworequiredBounded
- HIPAA-TRACK-INTAKEThird-party trackers where patients type their detailsA covered entity may not disclose protected health information except as the Privacy Rule permits. A tracker that loads on an appointment or intake form can receive what a patient types there — name, contact details, reason for the visit — and HHS treats that as a disclosure of PHI to the tracker vendor.45 CFR §164.502(a) · checked 2026-10-19 · In build · phase tworequiredBounded
- WA-ADV-MISLEADINGAdvertising that is false, fraudulent or misleadingWashington defines unprofessional conduct for a licence holder to include all advertising which is false, fraudulent, or misleading — with no substantiation escape written into the clause.RCW 18.130.180(3) · checked 2026-10-06 · In build · phase tworequiredBounded
- CA-CALOPPA-POSTEDA California site that collects names, emails or phone numbers links its privacy policy from the homepageCalifornia requires the operator of a commercial website that collects personally identifiable information — a name, an email address, a telephone number — from California residents to post a privacy policy conspicuously: on the homepage, or through a link there containing the word "privacy". The policy must identify its effective date. There is no size or revenue threshold. A missing policy becomes a violation if it is still missing 30 days after the operator is notified.Cal. B&P §22575(a) and (b)(4) · checked 2026-10-20 · In build · phase onerequiredBounded
This catalogue is the published subset. Rules blocked pending confirmation of their verbatim source text are not listed and are not run — a rule without a quote and a date is not a rule.