Support Library
Privacy Policy Requirements: What It Must Cover
A privacy policy tells visitors what personal data a website collects, why, who receives it, how long it is kept and what rights they have. Laws such as GDPR and the California Consumer Privacy Act require one, and regulators, customers and app stores check that it is complete and current.
The short answer
Link a privacy policy from the footer of every page. Make sure it covers the seven topics below, put a “Last updated” date at the top, and review it at least once a year or whenever you add a new tracker, service or use of data.
What the check looks for
How DNS Panopticon detects it
Security Posture follows the homepage’s privacy link and reads the policy’s text for seven topics: what personal data is collected, how it is used, who it is shared with, how long it is kept, visitors’ rights and how to use them, who to contact about privacy, and cookies and similar technologies. It also looks for a “last updated” date. Topics are matched by wording, so one described in unusual terms can be missed. The results appear on the Privacy card.
| Finding | Severity | When it appears |
|---|---|---|
| No privacy policy found / the link is broken | Medium | Nothing on the homepage links to a privacy policy, or the link fails. |
| The privacy policy doesn’t cover N expected topics | Low or medium | Medium when three or more topics are missing. |
| The privacy policy has no “last updated” date | Low | Readers cannot tell whether it is current. |
| The privacy policy was last updated … | Low | More than a year ago. |
| Privacy policy published / covers every topic / updated … | Pass | The expectations are met. |
| The privacy policy couldn’t be read | Not graded | It did not answer, is a PDF, or its text is added by a script. |
How to check it yourself
| Command | What to look for |
|---|---|
| curl -s https://example.com/ | grep -io "href=\"[^\"]*privacy[^\"]*\"" | The privacy link in the homepage HTML. |
| curl -sI https://example.com/privacy | That the policy answers with 200, not a redirect to an error. |
Then read the policy against the table below and compare its list of services and cookies with what the site actually loads (your browser’s developer tools, Network tab).
The seven topics
| Topic | What to say |
|---|---|
| What is collected | Categories of personal data: contact details, account data, payment data, device and usage data. |
| How it is used | The purposes, and under GDPR the legal basis for each (consent, contract, legitimate interests). |
| Who it is shared with | Categories of recipients, processors and any sale or sharing for advertising. |
| How long it is kept | Retention periods, or the criteria used to set them. |
| Visitors’ rights | Access, correction, deletion, objection, portability, opting out of sale or sharing, and how to make a request. |
| Who to contact | An email or form for privacy requests, and the data protection officer if you have one. |
| Cookies | Which cookies and similar technologies are used and how to control them, or a link to a separate cookie policy. |
Why it matters
- It is the law in most places. GDPR, UK GDPR, CCPA/CPRA and other state and national laws require a clear notice.
- Regulators start here. A missing or outdated policy is one of the easiest failings for a regulator to spot.
- Platforms require it. App stores, ad networks and payment providers require a working privacy policy link.
- CCPA requires a yearly update. Section 1798.130 asks businesses to update the privacy policy at least once every 12 months.
How to fix it
- Inventory first. List the data you collect, the tools that receive it (analytics, advertising, CRM, payment, support chat) and how long you keep it.
- Write or update the policy to cover all seven topics in plain language. Templates help, but the content must match what the site really does.
- Add a date such as “Last updated: March 3, 2026” at the top and change it with every revision.
- Publish it as a web page, not only a PDF, and link it from the footer of every page.
- Schedule a yearly review, and review it whenever a new tracker or service is added.
- Get legal advice for regulated data (health, children, finance) or if you operate in many jurisdictions.
FAQ
Our policy covers everything, but the finding says a topic is missing.
Topics are matched by common wording, such as “retain” or “how long” for retention. If yours uses different terms, consider adding a heading with the usual words; it helps readers too.
Can the privacy policy be a PDF?
It can, but a web page is easier to read on phones, easier for regulators and tools to check, and easier to keep current. DNS Panopticon cannot read PDFs, so it reports the policy as unread.
Do we need a separate cookie policy?
Not necessarily. Cookies can be covered in the privacy policy, as long as it says which are used and how to control them.