Privacy finding
A vendor was first seen on the site after the privacy policy last changed
Privacy Warning Severity: Medium
Part of the audit The privacy policy names other vendors than the site uses. Finding id: privacy.policyOlderThanNewestVendor.
What it costs you
A tool was added and the policy still describes the site as it was before.
What to do
Check whether the policy covers the vendor. Add it, or remove the tool.
What it checks
- Policy older than newest vendor
How to fix it
Add the vendor to the policy or remove the tool
- Find out who added [vendor] and why.
- If it stays: add it to the policy with what it receives and where it is based, and to the processing register.
- If not: remove the tool.
How to check: Run this rule again after the next crawl.
A real case
An audit of the data flows on one million websites and of over 200,000 of their privacy policies found that fewer than 15% of the flows to third parties were disclosed in the policy.
Thresholds
| Name | Default | Meaning |
|---|---|---|
grace_days | 30 | A vendor is reported when it was first seen at least this many days after the policy last changed. |
How to verify by hand
The data protection officer's processing register.
What this relies on
The observed vendors are real; the policy was not updated when a tool was added.