Module
Privacy
Audits
- Cookies and browser storage
- Trackers and third-party requests
- Consent banner behaviour
- Privacy and cookie policy
- Personal data on pages
- Personal data in documents
- Exposed contact details
- Data collection forms
- Device read or written before consent, beyond cookies
- What visitors type, say or do is captured
- Which regulations apply
- The cookie list says one thing, the browser shows another
- The banner promises a choice the site does not honour
- A tracker is filed under the wrong consent category
- The consent signal says denied, the tags behave as granted
- The privacy policy names other vendors than the site uses
- Visitors from different regions get the wrong regime
- Stated retention and real lifetimes differ
- Forms collect or send what the policy does not mention
- The organisation's own sites disagree on privacy
- Privacy claims on the page that the page itself disproves
Findings
- The site says IP addresses are anonymised and nobody has confirmed the vendor setting
- Visitors from a region get the consent banner in a language not commonly read there
- The consent banner has accessibility barriers
- The banner offers a choice that the site does not honour
- A cookie is filed under a consent category that does not fit its vendor
- A privacy claim on the site is contradicted by what the pages do
- A third party's service is served from the site's own subdomain
- What the consent banner does when it is tested
- The sites say one consent choice covers them all and the second site asks again
- The consent choice is remembered longer than the site says
- The banner and the tag manager hold different consent states after the same choice
- The consent signal says denied and requests still carry identifiers
- The consent string records no consent for a vendor and the page calls that vendor
- Email addresses, phone numbers and lists of people that anyone can collect
- Cookies and browser storage set without consent, unclassified, long-lived or third-party
- A cookie's lifetime starts again on every visit
- The published cookie list and the cookies the browser received differ
- The cookie list gives a purpose that the tracker list contradicts
- Scripts read the device or store data on it before consent, beyond cookies
- A form that collects personal data sends it unsafely, elsewhere or without telling the visitor
- Forms collect or send data in a way the policy and the form wording do not cover
- What the visitor types, says or does on the page is sent to a third party without consent
- The opt-out link was used and the same parties still receive an identifier
- A published document carries personal data, tracked changes or hidden content
- A page contains what looks like sensitive personal data
- A new cookie appeared and the policy has not changed since
- A vendor was first seen on the site after the privacy policy last changed
- The privacy notice does not mention a technique the site uses
- The privacy policy is missing, hard to reach, in another language or lists other cookies than the scan found
- The privacy policy names other vendors than the site contacts
- The Global Privacy Control signal is sent and advertising requests go on as before
- Visitors from a region get a consent regime that does not fit that region
- Signs on the site that rules on advertising and on selling or sharing data concern it
- Servers on networks registered outside the EEA are contacted before consent
- Cookies and stored identifiers live longer than the site says
- A form asks for sensitive data that the privacy policy was read as not covering
- The organisation's own sites disagree on privacy
- Third parties the pages contact, when, through whom and where they are based
- A third party is contacted before the visitor has made a choice
- A vendor reads the device before it asks the consent tool, or while it knows EU law applies
- Cookies and requests that came with consent stay after consent is withdrawn