GDPR privacy policy: a page visitors can find

The rule

Article 14 covers data that came from somewhere else, and Article 5(1)(a) makes transparency a principle of processing. None of them uses the phrase “privacy policy” or says where a notice sits on a website. The guidance does that work. This check is about the form of the duty, whether the information can be found, and leaves its content to EU-08.

Penalties follow the rights chapter. Article 83(5)(b) places “the data subjects’ rights pursuant to Articles 12 to 22” in the upper tier, with a ceiling of EUR 20 million or 4% of worldwide annual turnover, whichever is higher. The check’s own citation lists Articles 12(1) and 13; the penalty tier and Article 14 are added here.

The enforcement record shows two different failures. In the CNIL’s Google decision, the information existed but was spread across layers. France’s Council of State, upholding the decision, recorded that “a user must first of all carry out three actions starting from the first level of information before returning to the initial document and carrying out two more actions, a total of five actions altogether, while six actions are required to obtain exhaustive information on geolocation” (para. 18). It concluded that the Restricted Committee “was right in characterising a breach of the obligations of information and transparency defined by the aforementioned Articles 12 and 13” (para. 20). In Italy’s D’Anna decision, by contrast, the notice for a web form was missing altogether.

What PeekWell checks and how

EU-09 asks one question: can a visitor reach a privacy policy from any page without hunting? The scan answers it from the pages it opened, not from what the site says about itself.

The scan crawls the footer and navigation of the public pages it visits and collects links that look like a privacy policy. It follows each one to confirm it opens, counts how many clicks it takes to reach it from each page, and compares the language of the policy with the site’s main language. It flags three things: no policy link found, a link that does not open, and a policy in a different language from the site. A policy that sits more than two clicks from a page is flagged too. Two clicks is the scan’s working measure. It is not a figure from the GDPR, and the guidance asks for a link on each page.

The decision is made by code. Whether a link exists, opens, how many clicks it took and which language the text is in are matters of record, and a language model plays no part. The method is the same as UK-10 and the first half of US-13; only the rules the findings are read against differ.

The scan has limits, and the report says so. It sees the public pages it visited and nothing behind a sign-in. It does not submit forms, test passwords or open addresses nobody linked to. It checks that a policy can be found and opens, and does not judge whether it is complete or accurate; that is EU-08 and EU-05. A link that appears only inside an app or after a sign-in is outside what a browser visit can see. A Passed means the expected behaviour was observed on the pages scanned. It does not say the site complies.

Why it matters for a company

A missing or hidden policy is one of the easiest facts for an authority to establish, because anyone can check it from a browser. The Garante did exactly that in the D’Anna case. Its notice of the allegations said no information text for the quote form could be found on the page, in other sections or in the footer. On 8 August 2024 its office checked the form and found it still took a name, contact details and an email address. The company argued that the form never worked in practice. The Garante noted that it was still live and that notice text had been inserted only recently, and said a notice has to match what the company actually does with the data.

The Google decision shows the other pattern. The company had a policy, but the information a person needed sat behind a chain of clicks and a long document. The court treated that structure as the problem, given how intrusive the processing was.

For a company the practical consequences are of three kinds. The check is visible from outside, so a complaint about something else, such as marketing emails in the Italian case, can lead an authority to look at the website too. The information has to be there when the data is collected (Art. 13(1)), so adding it later does not undo the earlier period. And the guidelines treat a link that is hard to find as not easily accessible, whatever the text says.

Smaller companies and larger companies

The rule has no size threshold. It applies to a one-person consultancy with a contact form in the same way as to a platform with millions of accounts. What differs is how the gap appears.

In a small company the website is usually a template or a hosted builder. A privacy page is written once, often from a generator, and linked from the footer of the home page only. A later redesign drops the footer, a landing page is built on a separate tool without one, or a quote or contact form is added months after the policy was written and nobody links the two. The Italian insurance intermediary is that pattern: a form that collected names and contact details, with no notice attached. Smaller companies are within reach of authorities. The Garante’s decision there ended in one fine of 5,000 euros covering this and a separate failure to act on an opt-out, and an order to provide a suitable notice.

In a larger company the difficulty is spread. There are many domains, campaign microsites, regional versions and apps, owned by different teams and agencies. One site links the policy; another, launched for a promotion, does not. A French page may link an English policy written for another market, which raises the language point in the guidelines. A group policy may grow into a long document with the key points deep inside it, the situation the Google decision describes. Scale changes the stakes as well, since Article 83(5) ties the ceiling to turnover.

How to fix it

1. List every public page type and domain. Home, product pages, blog, landing pages, checkout, regional versions and any microsite. Anything with its own template needs its own check.
2. Put one link in the shared footer. Add a link labelled “Privacy policy” or “Privacy” to the footer template, so it is inherited by every page type. Do not hide it in a menu that opens only on small screens. Keep it at normal size and contrast.
3. Point every form at the notice. Next to each contact form, newsletter box or quote request, add a short line with a link to the policy, so the information is available at the point where the data is entered.
4. Match the language. If a page is in French, link a French policy. If you run several language versions, give each its own link to the right translation.
5. Check that the link opens. Open it from a private window on a phone and on a computer. A policy that returns an error, redirects to the home page or needs a sign-in does not count.
6. Re-scan. Run a scan again. The finding should disappear once each page type shows a working link within two clicks, in the site’s language.

<footer>
  <a href="/privacy/">Privacy policy</a>
</footer>

What goes inside the policy is a separate question, and EU-08 covers the Article 13 list. Whether a setup meets an authority’s view is for your legal adviser, and Peeky reports only what it sees.