guide · privacy
Privacy Policy Audit Checklist
Updated October 1, 2026 · 7 min read
direct answer
Most privacy policies fail between 8 and 12 of 27 checks, and the failures cluster in the same four places: no concrete retention period, no named recipients, no transfer safeguards, no specific supervisory authority. Work through the 27 checks below in order — severity first — or paste the policy into the free Privacy Policy & Cookie Analyzer and let it run them for you.
Twenty-seven checks. Most policies fail between eight and twelve of them, and the failures cluster in the same four places every time. Here is the full list — severity, article, and the fix — in the order an auditor works.
The 27-point audit
Three groups: thirteen GDPR checks, six CCPA checks, eight cookie checks. Severity is C for critical (regulators ask for these first) and W for warning (expected where the situation applies).
Group A — GDPR Article 13 (13 checks)
| # | Check | Sev | Legal basis | Fix if failed |
|---|---|---|---|---|
| 1 | Controller named — legal entity, not "we" | C | Art. 13(1)(a) | Add legal name, registered address, company number |
| 2 | Contact details — email + postal address | C | Art. 13(1)(b) | Add a monitored privacy email and a physical address |
| 3 | Purposes listed per activity | C | Art. 13(1)(c) | Replace "improve services" with a per-activity list |
| 4 | Lawful basis per purpose | C | Art. 13(1)(c), Art. 6 | Map each purpose to Art. 6(1)(a)–(f) |
| 5 | Legitimate interests stated, where used | W | Art. 13(1)(d) | Name the interest: fraud prevention, service security |
| 6 | Categories of data listed | W | Art. 13(1)(e) | Name identifiers, usage data, payment data explicitly |
| 7 | Recipients named by category | C | Art. 13(1)(e) | Replace "partners" with hosting, payment, analytics providers |
| 8 | International transfers + safeguard | W | Art. 13(1)(f), Art. 46 | Name destination and mechanism (SCCs, adequacy) |
| 9 | Retention period per category | C | Art. 13(2)(a), Art. 5(1)(e) | Give a period and a trigger per data category |
| 10 | All six rights listed | C | Art. 13(2)(b) | Access, rectification, erasure, restriction, objection, portability |
| 11 | Consent withdrawal mechanism | W | Art. 13(2)(c), Art. 7(3) | Name the button or link; make it as easy as giving consent |
| 12 | Supervisory authority named | C | Art. 13(2)(d) | Replace "your local authority" with the actual regulator + contact |
| 13 | Automated decisions / profiling stated | W | Art. 13(2)(f), Art. 22 | Describe the logic — or state plainly that none occurs |
Group B — CCPA/CPRA (6 checks)
| # | Check | Sev | Fix if failed |
|---|---|---|---|
| 14 | Categories of PI collected (CPRA-enumerated) | C | List by the statutory category names |
| 15 | Business/commercial purposes per category | C | One purpose line per category |
| 16 | Right to know + right to delete, with channel | C | Name the request method (form, email) and response time |
| 17 | Opt-out: "Do Not Sell or Share" link | C | Visible footer link, not buried in the policy text |
| 18 | Non-discrimination promise | W | One sentence: exercising rights does not change price or service |
| 19 | 12-month lookback on categories | W | State that categories for the preceding 12 months are disclosed on request |
Group C — Cookie policy (8 checks)
| # | Check | Sev | Fix if failed |
|---|---|---|---|
| 20 | Cookie names listed individually | C | One row per cookie — no group labels |
| 21 | Provider / domain per cookie | C | Name the setting domain (e.g. google-analytics.com) |
| 22 | Purpose per cookie | C | State what the cookie actually does |
| 23 | Duration / expiry per cookie | C | Session, or expiry in days/months/years |
| 24 | Type / category per cookie | W | Strictly necessary, performance, functional, targeting |
| 25 | Legal basis per cookie | C | Consent — or legitimate interest for strictly necessary |
| 26 | Pre-consent rule stated and enforced | C | Block non-essential tags until consent is recorded |
| 27 | Consent withdrawal stated (reject parity) | W | Permanent footer link; reject as prominent as accept |
The four failures that show up in almost every policy
- Check 9 — retention. "As long as necessary" is the single most common failure, and the easiest to fix: pick a period per category, tie it to a trigger.
- Check 7 — recipients. "Trusted partners" is not a category. Name the processor types.
- Check 8 — transfers. A US cloud host with no SCC mention is an Article 46 gap, and it is now the first thing post-Schrems II audits look for.
- Check 12 — authority. Naming "your local authority" fails the requirement to identify the specific regulator with a contact point.
Scoring your audit
The score is deliberately arithmetic: checks passed ÷ checks applicable × 100, equal weight per check, no partial credit. Severity decides what you fix first, not how much the check is worth. If you skip the CCPA group (not applicable to your audience), those six simply leave the denominator — 19 checks remain.
| Band | Verdict | Action |
|---|---|---|
| 90–100 | Nothing obvious missing | Verify wording matches actual practices, then ship |
| 70–89 | Minority of checks failing | Fix critical gaps first — usually 1–3 clauses |
| 50–69 | Incomplete against Article 13 | Restructure the sections missing whole disclosures |
| Below 50 | Not a compliant notice | Rewrite rather than patch — the structure is wrong |
Reading ease — why lawyers write unreadable policies
Completeness and readability fail independently. The Flesch reading ease scale (0–100) is the standard measure:
| Flesch score | Difficulty | Typical source |
|---|---|---|
| 80–100 | Easy | Plain-language consumer notices |
| 60–79 | Fair — plain-English standard | Well-edited policies |
| 50–59 | Difficult | Typical legal prose |
| Below 50 | Very difficult | Boilerplate contracts — harder than most readers can follow |
Transparency is the stated purpose of the regulation. A policy that contains all twelve disclosures but scores 38 is transparent in the filing cabinet and opaque to the person it describes.
run all 27 automatically
Privacy Policy & Cookie Analyzer
The checks above are exactly what the analyzer runs: GDPR group, CCPA group, cookie group — scored, severity-ranked, with suggested wording for every gap. Paste, read the score, fix what is missing.
Open the analyzerRelated reading
- Privacy Policy Requirements: The 12-Point GDPR Checklist — Group A expanded with good-vs-bad wording.
- What Must a Cookie Policy Include? — Group C expanded, with the pre-consent sequencing problem.
- How to Use the Privacy Policy Analyzer — three walkthroughs using this checklist.
faq
Frequently Asked Questions
How to run the audit and what the score means.
How long does a privacy policy audit take?
About ten minutes by hand if you work through the 27 checks in order, or seconds with an automated checker. The bottleneck is never the reading — it is deciding, for the four or five checks you fail, whether to write the missing clause or restructure the section it belongs in.
How many checks does a typical policy fail?
Between eight and twelve out of 27, with the failures clustering in four places: no concrete retention period, no named recipients, no transfer safeguards, and no specific supervisory authority. A policy failing fewer than five checks is unusual; failing more than fifteen usually means it was written before 2018 and never revised.
How is the 0–100 audit score calculated?
Checks passed divided by checks applicable, multiplied by 100 — equal weight per check, no partial credit. Severity (critical vs warning) affects fix priority, not the arithmetic. Bands: 90–100 nothing obvious missing; 70–89 fix the critical gaps first; 50–69 incomplete against Article 13; below 50 the policy needs a rewrite rather than edits.
Is this audit legal advice?
No. It is a completeness check against published requirements — whether the expected disclosures are present and findable. It cannot verify that your wording matches your actual data practices. Use it to find gaps, then have a lawyer or DPO review the final text.