In one paragraph
Cookie policy link missing means the scan did not find a link whose address or text includes its cookie keyword. Information may already exist in a combined privacy notice, while an unrelated vendor or settings link can pass. Provide clear accessible information appropriate to the actual technologies and applicable rules. A separate page named Cookie policy is not universally required simply because the detector expects that word.
Why it matters
The ePrivacy consent framework requires clear comprehensive information about relevant storage or access and its purposes. GDPR transparency obligations may also apply to resulting personal-data processing. Neither is met merely by placing a legal-sounding title in a footer.
A useful notice reflects the real deployment. Purposes, responsible parties, relevant lifetimes, and ways to control optional operations should be understandable and consistent with observed behaviour. A copied generic list can misdescribe a site after its providers change.
Consent and information are distinct. An accurate policy does not authorise collection that needs an unprovided choice, and having no consent-dependent storage does not automatically settle every other information obligation. Review national rules and the actual data practices rather than a universal banner template.
How WebAuditOS evaluates this finding
The supplied site-wide rule accepts an observed link whose address or visible text contains cookie, case-insensitively, using its documented rendered-link fallback. A match passes; no match on readable coverage warns at low severity; unavailable rendered coverage can be ungraded.
It does not retrieve the notice, classify technologies, assess completeness, or determine whether consent is needed. Combined privacy information with different wording can be missed, while a vendor policy or settings-only link can pass. The detector is link recognition, not legal content validation.
How to fix it
- Inventory current cookies and similar storage or access technologies, including scripts and embedded services. Review the real purposes rather than relying solely on a vendor's category label.
- Decide where the appropriate information belongs. A separate notice or an easy-to-reach section of a broader privacy resource can work when it supplies the required information clearly.
- Provide a meaningful route. For example:
<a href="/privacy#cookies">Cookies and similar technologies</a>Create the actual matching section and keep it readable without first requiring optional consent. This fragment alone does not provide the substantive information.
- Explain the relevant purposes, parties, durations, and controls at an appropriate level of specificity. Distinguish browser retention from any separate server-side processing rather than implying one cookie age describes all data retention.
- Link the information from the consent mechanism where needed and from a sensible persistent location. A user should be able to understand the choice before making it and revisit relevant information later.
- Make the control route distinct from the explanation. Cookie settings can reopen a choice mechanism, but it does not automatically replace the notice or validate withdrawal handling.
- Assign ownership and review the notice when integrations or purposes change. Automated inventories can help discovery but cannot determine every purpose or legal exemption on their own.
- Rescan recognition and separately review actual accuracy and consent behaviour. Do not add a misleading keyword-only link solely to make a report pass.
What the fix can break
A generated inventory can include temporary or irrelevant entries and miss server-side processing. Review it before presenting it as a complete factual account.
A policy that claims no optional technologies while the site sends them can mislead users. Fix deployment and documentation together.
Do not create an unnecessary separate document that contradicts a maintained combined notice. Information architecture should support clarity, not a detector's naming preference.
Questions
Must the information always be a separate cookie page?
Not universally. Review the applicable requirements and make the necessary information clear and easy to find.
Does a settings link prove the policy exists?
No. The supplied word match may accept it without verifying any explanatory content.
Can a provider's notice describe all our responsibilities?
Not automatically. Explain your actual operation and relevant parties rather than linking away from your own practices.
Which related checks help?
Review privacy information, banner detection, and the cookie consent guide.