Skip to main content
sus.botdocs
  • SEO
  • AI
  • QA
  • Privacy
  • Accessibility
  • Security
  1. Docs
  2. Privacy

Module

Privacy

21 audits · 112 checks · 41 findings

Audits

  • Cookies and browser storage 7 checks
  • Trackers and third-party requests 8 checks
  • Consent banner behaviour 8 checks
  • Privacy and cookie policy 6 checks
  • Personal data on pages 7 checks
  • Personal data in documents 4 checks
  • Exposed contact details 3 checks
  • Data collection forms 5 checks
  • Device read or written before consent, beyond cookies 5 checks
  • What visitors type, say or do is captured 6 checks
  • Which regulations apply 2 checks
  • The cookie list says one thing, the browser shows another 5 checks
  • The banner promises a choice the site does not honour 5 checks
  • A tracker is filed under the wrong consent category 4 checks
  • The consent signal says denied, the tags behave as granted 7 checks
  • The privacy policy names other vendors than the site uses 5 checks
  • Visitors from different regions get the wrong regime 4 checks
  • Stated retention and real lifetimes differ 5 checks
  • Forms collect or send what the policy does not mention 6 checks
  • The organisation's own sites disagree on privacy 5 checks
  • Privacy claims on the page that the page itself disproves 5 checks

Findings

  • The site says IP addresses are anonymised and nobody has confirmed the vendor setting
  • Visitors from a region get the consent banner in a language not commonly read there
  • The consent banner has accessibility barriers
  • The banner offers a choice that the site does not honour
  • A cookie is filed under a consent category that does not fit its vendor
  • A privacy claim on the site is contradicted by what the pages do
  • A third party's service is served from the site's own subdomain
  • What the consent banner does when it is tested
  • The sites say one consent choice covers them all and the second site asks again
  • The consent choice is remembered longer than the site says
  • The banner and the tag manager hold different consent states after the same choice
  • The consent signal says denied and requests still carry identifiers
  • The consent string records no consent for a vendor and the page calls that vendor
  • Email addresses, phone numbers and lists of people that anyone can collect
  • Cookies and browser storage set without consent, unclassified, long-lived or third-party
  • A cookie's lifetime starts again on every visit
  • The published cookie list and the cookies the browser received differ
  • The cookie list gives a purpose that the tracker list contradicts
  • Scripts read the device or store data on it before consent, beyond cookies
  • A form that collects personal data sends it unsafely, elsewhere or without telling the visitor
  • Forms collect or send data in a way the policy and the form wording do not cover
  • What the visitor types, says or does on the page is sent to a third party without consent
  • The opt-out link was used and the same parties still receive an identifier
  • A published document carries personal data, tracked changes or hidden content
  • A page contains what looks like sensitive personal data
  • A new cookie appeared and the policy has not changed since
  • A vendor was first seen on the site after the privacy policy last changed
  • The privacy notice does not mention a technique the site uses
  • The privacy policy is missing, hard to reach, in another language or lists other cookies than the scan found
  • The privacy policy names other vendors than the site contacts
  • The Global Privacy Control signal is sent and advertising requests go on as before
  • Visitors from a region get a consent regime that does not fit that region
  • Signs on the site that rules on advertising and on selling or sharing data concern it
  • Servers on networks registered outside the EEA are contacted before consent
  • Cookies and stored identifiers live longer than the site says
  • A form asks for sensitive data that the privacy policy was read as not covering
  • The organisation's own sites disagree on privacy
  • Third parties the pages contact, when, through whom and where they are based
  • A third party is contacted before the visitor has made a choice
  • A vendor reads the device before it asks the consent tool, or while it knows EU law applies
  • Cookies and requests that came with consent stay after consent is withdrawn
  • All audits
  • About sus.bot
  • Open the app
  • Contact support