Privacy finding
A new cookie appeared and the policy has not changed since
Privacy Warning Severity: Medium
Part of the audit Privacy and cookie policy. Finding id: privacy.policyNotUpdatedAfterNewCookie.
What it costs you
Someone added a tracker and nobody told the person who keeps the policy. The policy now describes the site as it was.
What to do
Add the new cookie and its vendor to the policy and the cookie list, or remove the script that sets it.
What it checks
- Policy not updated after tracker change
How to fix it
Update the policy or remove the cookie
- Find out who added the script named under 'set by' and why.
- If it stays: add the cookie, its purpose, vendor and lifetime to the policy and the cookie list, and give it a category in the consent tool.
- If not: remove the script.
How to check: Run this rule again after the next crawl.
A real case
An audit of the data flows on one million websites and of over 200,000 of their privacy policies found that fewer than 15% of the flows to third parties were disclosed in the policy.
Thresholds
| Name | Default | Meaning |
|---|---|---|
policy_grace_days | 30 | A policy that last changed longer ago than this is taken as not updated for a cookie that is new since the previous crawl. Set it to the crawl interval. |