Privacy finding
The privacy policy names other vendors than the site contacts
Privacy Warning Severity: High
Part of the audit The privacy policy names other vendors than the site uses. Finding id: privacy.policyVsVendors.
What it costs you
The policy is your statement of who receives visitor data. A vendor the browser contacts and the policy leaves out is a gap anyone can show with a network log.
What to do
Compare the list with the processing register and bring the policy up to date, or remove the tool.
What it checks
- Vendor in use but not named
- Vendor named but no longer used
- Transfer country not mentioned
- Policy says no third parties
How to fix it
Bring the policy and the site in line
- Give the list of hosts and vendors to the person who keeps the processing register.
- Vendor in use and not named: add it to the policy with its country, or remove the tool from the site.
- Vendor named and not in use: confirm with the team that owned it, then take it out of the policy.
- A policy that says no third parties are involved needs rewording as long as the pages contact any.
How to check: Crawl the site again after the policy changed. The vendor no longer appears in this rule.
A real case
An audit of the data flows on one million websites and of over 200,000 of their privacy policies found that fewer than 15% of the flows to third parties were disclosed in the policy.
How to verify by hand
The data protection officer's processing register.
What this relies on
The observed vendors are real; the policy was not updated when marketing added a tool.