generated: '2026-08-13'
method: probed
source: >-
  live probes of https://www.usatoday.com/.well-known/security.txt,
  https://www.usatoday.com/.well-known/gpc.json, https://www.usatoday.com/robots.txt,
  https://localiq.com/llms.txt
note: >-
  Gannett (now trading its corporate identity as USA TODAY Co.) publishes no developer API,
  so none of the API-contract standards below can be asserted. What it does conform to are
  web-scale publisher conventions: RFC 9116 security.txt, Global Privacy Control, RFC 9309
  robots.txt (with explicit AI-crawler directives) and an llms.txt on the LocaliQ property.
  Every `conforms: false` here is an observed absence, not an unchecked box.
standards:
  - id: rfc9116-security-txt
    conforms: true
    evidence: https://www.usatoday.com/.well-known/security.txt returned 200 text/plain with Contact, Policy, Hiring, Preferred-Languages and Expires fields
    note: >-
      Uses a non-registered "Responsible Disclosure Program:" field alongside the registered
      ones, and the Expires value (2026-08-30T00:00:00Z) is inside the RFC 9116 one-year
      ceiling but close to lapsing.
  - id: global-privacy-control
    conforms: true
    evidence: 'https://www.usatoday.com/.well-known/gpc.json returned 200 with {"gpc": true, "lastUpdate": "2024-12-09"}'
  - id: rfc9309-robots
    conforms: true
    evidence: https://www.usatoday.com/robots.txt returned 200 with per-agent Disallow/Allow groups and a Sitemap directive
    note: >-
      USA TODAY denies the major AI crawlers site-wide (anthropic-ai, ClaudeBot, Claude-Web,
      GPTBot, ChatGPT-User, cohere-ai, AmazonBot, CCBot, AndiBot) and then re-Allows a
      commercial subset — /shopping/, /story/shopping/, /money/money-management/,
      /contributor-content/ and named sponsor-story paths. This is a deliberate
      agent-differential posture, not a blanket block.
  - id: llms-txt
    conforms: true
    evidence: https://localiq.com/llms.txt returned 200 (682 KB, ~5,000 entries) — saved verbatim to llms/gannett-llms.txt
    note: >-
      Machine-generated from the LocaliQ WordPress blog index; it enumerates posts, not APIs.
      No llms.txt is served on gannett.com, usatodayco.com or usatoday.com.
  - id: openapi
    conforms: false
    evidence: no OpenAPI/Swagger document found on any Gannett host — /openapi.json, /swagger.json, /api-docs, /docs and /redoc all 403 or 404
  - id: asyncapi
    conforms: false
    evidence: no event, streaming or webhook surface is documented on any public Gannett property
  - id: oauth2
    conforms: false
    evidence: /.well-known/oauth-authorization-server returned 301/404 on every host; no public OAuth documentation
  - id: oidc
    conforms: false
    evidence: /.well-known/openid-configuration returned 301/404 on every host
  - id: rfc9457-problem-details
    conforms: false
    evidence: no public API surface to observe error responses on
  - id: a2a-agent-card
    conforms: false
    evidence: /.well-known/agent-card.json and /.well-known/agent.json returned 404 (or a 303 to an HTML 404) on www.usatoday.com, localiq.com and www.usatodayco.com
  - id: mcp
    conforms: false
    evidence: no hosted MCP endpoint and no first-party MCP package found for any Gannett brand
compliance_program:
  published: false
  note: >-
    No trust center, no SOC 2 / ISO 27001 / PCI DSS attestation page, and no compliance
    portal was found on gannett.com, usatodayco.com or localiq.com. trust.gannett.com and
    trust.localiq.com do not resolve. No `Compliance` pointer is emitted.