Introduction
Check whether a website privacy policy is discoverable, reachable, current, and consistent with observable cookies, trackers, forms, and third-party services.
This guide is written for website owners, privacy teams, and developers reviewing published policies.
What it means
A live-site checker should first confirm that the privacy policy exists, returns successfully, and is reachable from common entry points on desktop and mobile.
Technical review should compare observable trackers, cookies, forms, embeds, and vendors with the policy's claims instead of grading text in isolation.
Use the Privacy Policy Checker for a live technical scan; use this guide to assign owners, review disclosures, and document the audit trail.
The policy should identify who controls the data, purposes and lawful bases, recipients, transfers, retention logic, rights, and a usable contact route where applicable.
Automation can flag missing links, stale dates, unclear sections, and implementation mismatches, but it cannot determine every lawful basis or certify legal compliance.
Policy checking should recur after vendor, analytics, advertising, form, product, or retention changes.
Why it matters
A polished policy can still be misleading when the live site sends data to services it never mentions. That gap creates both transparency and accountability risk.
Checking the policy and website together gives legal, marketing, and engineering teams a concrete remediation list rather than a generic completeness score.
Common mistakes
- Treating the presence of a privacy policy link as proof that its contents match the website.
- Using a template without replacing generic vendors, purposes, retention periods, and contact information.
- Reviewing cookies only while ignoring forms, pixels, API calls, embedded media, chat, and server-side integrations.
- Letting the policy update date change without recording the operational changes behind it.
- Presenting an automated score as legal certification.
Practical checklist
- Confirm the policy URL loads, is indexable where intended, and is linked from the footer, forms, account flows, and consent interface where relevant.
- Identify the controller, contact details, data categories, purposes, lawful bases, recipients, transfers, retention, and rights process.
- Scan the website for cookies, trackers, pixels, embeds, forms, and third-party requests.
- Compare observed vendors and purposes with the privacy and cookie policy disclosures.
- Check that consent choices, withdrawal, and policy language describe the same live behavior.
- Record findings, owners, due dates, policy version, and evidence of each correction.
- Repeat the check after material releases and on a scheduled cadence.
How GDPRChecker helps
GDPRChecker can verify policy-link discoverability and compare observable website behavior with published privacy and cookie disclosures.
The report is a technical review and remediation aid, not legal advice or a compliance certificate; use qualified review for legal conclusions.