Privacy Policy & Cookie Analyzer

field notes

What must a privacy policy include?

A GDPR privacy policy must contain twelve disclosures, set out in Articles 13 and 14 of the regulation. Article 13 applies when data comes from the person directly — a signup form, a contact box, an app onboarding. Article 14 applies when you obtain it elsewhere, such as a purchased list, and adds two more: where the data came from, and whether it came from public sources. The checker below runs the Article 13 set, because that is what almost every website actually needs.

The failure pattern is consistent. Policies are strong on boilerplate — "we value your privacy" — and weak on specifics: no retention period, no named recipients, no lawful basis per purpose, no complaint authority. Regulators do not fine the prose. They fine the absence.

The 12 required GDPR disclosures, clause by clause

What CCPA/CPRA adds

For businesses serving California residents, nine more requirements apply on top of the GDPR set. They overlap heavily but not completely — the CPRA-specific ones that GDPR policies routinely lack are the right to correct inaccurate information, the explicit non-discrimination guarantee, and the 12-month lookback on categories disclosed.

What must a cookie policy include?

A cookie policy is judged column by column. For every cookie the policy must state six things, and most policies published today state three at best:

Two rules sit above the table. Under the ePrivacy Directive's Article 5(3), no non-essential cookie may be set before consent — analytics and advertising pixels firing on first paint is itself a violation, whatever the policy says. And consent must be as easy to withdraw as to give: a Reject option as prominent as Accept, no layered menus, no dark patterns.

How the score is calculated

The analyzer runs named keyword bundles — regular expressions per clause — against your text, exactly the way a reviewer skims for evidence. Each check either finds its evidence or it does not; there is no partial credit. The score is simply checks passed ÷ checks applicable × 100 across the laws you selected and, when cookie text is provided, the eight cookie checks. Critical checks (identity, contact, purposes, lawful basis, rights, retention, complaint authority) are ranked above warnings in the findings list, because those are the ones regulators look for first.

Reading ease is scored separately

Completeness and readability are different failures. A policy can contain all twelve disclosures and still be unreadable — legal boilerplate routinely scores below 50 on the Flesch reading ease scale, which puts it harder than most university-level text. The tool reports Flesch beside the compliance score, because a policy nobody can read is a transparency policy on paper only.

Related guides

• Privacy Policy Requirements: The 12-Point GDPR Checklist — every clause with good-vs-bad examples and the failure pattern regulators actually fine.
• What Must a Cookie Policy Include? — the six required fields per cookie, the pre-consent rule and the banner mistakes that draw fines.
• Privacy Policy Audit Checklist — 27 checks, severity-ranked, with the exact article behind each one.
• How to Use the Privacy Policy Analyzer — every field and score explained, with three walkthroughs.
• How to Remove Metadata from a PDF — the other side of document privacy: what files say about you before anyone reads them.
• Privacy tools category — every browser-side utility on Daily Utility Lab that keeps data on your device.