How to Use the Privacy Policy Analyzer

Before you start: what you need

One thing — the text of the policy you want to check. Copy it from your site (select-all works), or if you are drafting from scratch, load the built-in samples first to see what a passing and a failing policy look like. No account, no email, no upload: the analysis happens in your browser as you type.

Step by step

Step 1 — Paste your privacy policy

The first textarea is the privacy policy itself. Paste the full text; the word counter beneath it updates live, and analysis re-runs 300 ms after you stop typing. Nothing here is sent anywhere — the zero-upload banner at the top of the tool is literal: there is no endpoint in the code to send it to.

Step 2 — Add the cookie policy (optional)

The second, smaller textarea is for your cookie policy or cookie table. If you skip it, the cookie checks still run against any cookie mentions inside the privacy policy text — but you get a sharper audit by pasting the real table. The eight checks are the six required columns (name, provider, purpose, duration, type, legal basis) plus the pre-consent rule and consent withdrawal.

Step 3 — Select the applicable laws

Three toggles sit under the textareas:

• GDPR (Art. 13) — on by default. Twelve disclosure checks for any site with EU/UK visitors.
• CCPA/CPRA — adds nine checks if you serve California residents. Selecting it grows the denominator; a policy that is complete for GDPR can still drop points here.
• ePrivacy — forces the cookie checks on even if you paste no cookie text, which is the honest result: no cookie disclosures means zero of eight.

The selected laws are echoed in the terminal log and in the score tile's note, so the denominator is always visible — a score out of what, is the question people ask first.

Step 4 — Read the verdict and the four tiles

The verdict line above the terminal is the quotable sentence: how many checks you cover, what is missing, your score, and your reading ease. Under the terminal, four tiles break it down:

Step 5 — Watch the log, then work the findings

The terminal prints every check as check: <label> FOUND or MISSING, ending with the score and a byte count of uploads (always 0). Below the tool, the Missing clauses & suggested wording section turns that log into a task list: each gap is a row, critical rows carry a red edge, warnings an accent edge, and expanding a row shows the fix — a template sentence with bracketed placeholders to replace.

Step 6 — Fix, re-run, repeat

Paste the suggested wording into your policy, and the analyzer re-runs on the next keystroke. The loop ends when two things hold: the critical list is empty, and the score stops moving when you add more text. Then read the prose once as a human — a score of 95 on an unreadable policy is a job half done.

Three walkthroughs

Walkthrough 1 — The two-minute self-audit

You already have a policy published. Open the tool, paste it, keep GDPR selected only, and read the verdict line. Expect a first-pass score in the 50–80 range if the policy was written without a checklist. Expand each critical row, paste the suggested sentence into your site's policy page, and watch the score climb. Typical result: four to six fixes, two minutes, score up 20–30 points.

Walkthrough 2 — Pre-launch check for a new site

Draft policy, no visitors yet. Load the good sample first to see what 12/12 looks like — then paste your own draft over it. Select GDPR plus CCPA if California traffic is likely (analytics will tell you), and paste your cookie table into the second box. Fix everything critical before launch: an incomplete notice on day one is how small sites collect their first complaints. Re-run after every edit; the tool re-checks on each pause in typing.

Walkthrough 3 — Full three-law compliance pass

Select all three laws: GDPR, CCPA/CPRA and ePrivacy. Paste the privacy policy and the cookie table. The denominator grows to 29 checks (12 + 9 + 8), and the cookie audit tile becomes active. Work the findings list strictly in order — critical rows first, then warnings — because the critical ones are the disclosures regulators cite: retention, recipients, transfer safeguards, supervisory authority, opt-out of sale. When the critical list is empty and the cookie audit reads 8/8, print the page or screenshot the tiles as evidence of the review date, and re-run the audit whenever the policy changes.

Troubleshooting

• Score says "n/a" for cookies. No cookie text was found and no cookie mentions exist in the policy. Paste the cookie table, or select the ePrivacy toggle to treat the absence as eight failing checks.
• A clause you know is there reads MISSING. The check looks for evidence phrasing, not vibes — a retention clause saying "as long as necessary" will not match the retention pattern, deliberately. Use the suggested wording to write a checkable sentence.
• Readability says "too short to score." Under 20 words of prose — paste the actual policy, not a heading.
• Nothing happens as I type. Analysis is debounced 300 ms; give it a beat. If the log never updates, check that JavaScript is enabled — the tool is entirely client-side.

Related reading

• Privacy Policy Requirements: The 12-Point GDPR Checklist — what each GDPR check is actually looking for.
• What Must a Cookie Policy Include? — the six cookie columns explained in depth.
• Privacy Policy Audit Checklist — all 27 checks on one page if you prefer paper.