Privacy finding
The organisation's own sites disagree on privacy
Privacy Warning Severity: Medium
Part of the audit The organisation's own sites disagree on privacy. Finding id: privacy.sitesDisagreeOnPrivacy.
What it costs you
The main site gets the attention and the shop, blog, careers and campaign sites are where the banner or the current policy is missing. A visitor does not tell them apart.
What to do
Decide whether the site belongs under the main site's privacy setup. If yes, give it the same banner, policy and accounts.
What it checks
- Subdomain without cookie banner
- Different policy versions across sites
- Vendor present on one site only
- Microsite with its own tracking account
How to fix it
Deploy the main site's consent tool
- Ask who owns the site and whether it belongs to the same legal entity as the main site.
- Deploy the consent tool of the main site on it.
How to check: Scan the sites again. The site no longer appears in this rule.
Publish the current policy
- Link to the current policy, or publish the current text.
- If the site belongs to another legal entity with its own policy, dismiss the finding.
How to check: Scan the sites again. The site no longer appears in this rule.
Move the vendor or account into the shared setup
- Ask who added the vendor or the tracking account and why.
- Move it into the shared setup, or remove it.
How to check: Scan the sites again. The site no longer appears in this rule.
Thresholds
| Name | Default | Meaning |
|---|---|---|
min_sites | 3 | A vendor on one site only is reported when the account has at least this many sites. |
How to verify by hand
A person; separate legal entities are the exception.
What this relies on
The main site is the standard.