What the privacy policy must say about services

How it works

Under Article 13 GDPR you inform visitors when you collect their data: who is responsible, for what purpose and on which legal basis data is processed, who receives it, whether it is transferred to a third country and how long it is kept. Visitors' rights belong there too, including the right to withdraw consent. On a website, all this goes in the privacy policy. Under Article 12 GDPR it must be easily accessible, which in practice means a link from every page, usually in the footer.

If you don't give its address, bytereport looks for the privacy policy in the sitemap, among the links on the start page and at common addresses such as /privacy, and checks that every checked page links to it. It then compares its text with everything loaded in the three passes, including after “Accept”. A service counts as named if its name, one of its cookies (as in a cookie table) or one of its hosts appears in the text. bytereport does not check whether the details given are right.

What matters

• Linked from every page. A link with a clear name such as “Privacy” or “Privacy policy” on every page, landing pages and the shop included.
• Every service with its details. For each service that receives data: provider, purpose, legal basis (usually consent for statistics and marketing), any transfer to a third country and its basis, the storage period and the cookies it sets.
• External content too. Fonts, videos, maps or captchas from other servers belong in it just as much as analytics and advertising (see external content).
• Keep it current. If the privacy policy names services that no longer load anywhere, it is probably out of date. Some services only load on pages that were not checked, such as the checkout, so bytereport only adds a note about this.

How to set it up

You write the text yourself, with a privacy policy generator or with your data protection officer; it goes into the CMS. Use the list of services and cookies from the report as a starting point and add what is missing. Many consent tools offer an embeddable cookie list that updates from their scan; it does not replace the other details, but keeps the cookie table current. Review the privacy policy whenever a service is added or dropped, and check the link in the footer template so that it appears on every page.

This is not legal advice; your data protection officer or a lawyer decides the individual case.