In one paragraph
Privacy policy link missing means the scan did not recognise a privacy-information link among the pages it could read. Check whether accurate required information is actually provided at the appropriate time and remains accessible. A combined notice or different wording can be missed, while a third-party policy can create a false pass. Publishing a link does not establish GDPR compliance or turn notice acknowledgement into consent for every operation.
Why it matters
GDPR Articles 12-14 require appropriate transparent information according to how personal data are obtained. Article 13 addresses information at collection from the person; Article 14 has its own conditions and timing for data obtained elsewhere. A footer is not the whole transparency strategy.
Content can need controller identity, applicable contacts, purposes and legal bases, recipients, retention, transfer information, relevant rights, and other required particulars. The details depend on the actual processing. Do not promise every right is unconditional or copy a generic statement that contradicts the service.
A privacy notice informs people; it does not automatically supply a lawful basis. Not all processing relies on consent, and a mandatory I agree to the privacy policy checkbox is not a universal substitute for choosing and meeting the right basis.
How WebAuditOS evaluates this finding
The supplied site-wide rule matches link text and addresses against a multilingual privacy vocabulary, using captured rendered links for documented client cases. A match passes; no match on readable pages fails at medium severity; unavailable coverage can be ungraded.
It does not read the notice, verify its owner, assess accuracy or timing, or evaluate the processing. Links to Google or another provider's policy can pass, while useful notices under different labels or sources can be missed. A generic link result cannot certify legal information duties.
How to fix it
- Identify the actual controller, relevant processing activities, audience, and collection routes. Include forms, accounts, support, logs, integrations, and indirect data sources where relevant.
- Draft or review information against the applicable GDPR provisions and national requirements. Use the real operation, recipients, retention approach, and legal grounds instead of an unverified template.
- Publish a stable accessible resource. For example:
<a href="/privacy">Privacy notice</a>Make the actual destination work. The link is not the notice itself and should not lead only to a provider's generic policy.
- Provide appropriate contextual information at collection or within the applicable timing framework. A person using an embedded or separate-domain form should not have to guess which operator or notice applies.
- Keep language clear and structure usable. Layered explanations can help, but should not bury material facts behind an account requirement or an inaccessible document.
- Keep consent requests distinct from ordinary notice presentation. Where consent is actually relied on, test a freely given specific informed choice and withdrawal rather than treating reading a page as blanket permission.
- Review rights-contact functionality and changes over time. Update purposes, vendors, transfers, and retention when the real arrangements change, and assess whether additional information or a new choice is needed.
- Rescan link recognition and separately evaluate content, timing, and actual practices. A detector pass is not an approval to process or a guarantee of full GDPR compliance.
What the fix can break
A copied notice can name the wrong controller or make unsupported security, residency, or no-sharing claims. Verify facts with the responsible owners.
Changing processing while leaving the notice unchanged can mislead users even when every footer link works.
Do not automatically collect an extra consent checkbox for every disclosure without deciding what it means. Unnecessary bundling can obscure the actual lawful basis and user choice.
Questions
Does a privacy-policy link make all processing lawful?
No. Transparency and a lawful basis are separate obligations.
Must every processing purpose rely on consent?
No. Select and satisfy the actual applicable basis rather than using a blanket acknowledgement.
Why can a provider privacy link create a pass?
The supplied pattern recognises matching links without confirming whose notice or activities it describes.
Which related checks help?
Review privacy contacts, cookie information, and the cookie consent guide.