GDPR Article 13: privacy policy missing processors

The rule

The Article 29 Working Party’s transparency guidelines say how to choose between naming recipients and giving categories.

Article 12(1) adds that the information be given “in a concise, transparent, intelligible and easily accessible form, using clear and plain language”, so where the list sits and how it reads count as well as what it says.

On penalties, Article 83(5)(b) places “the data subjects’ rights pursuant to Articles 12 to 22” in the upper tier, with a ceiling of EUR 20 million or 4% of worldwide annual turnover, whichever is higher. Articles 13 and 14 sit inside that range. The check’s citation lists Art. 83(5) generally; the applicable point is (b), and the AEPD applied it to an Article 13 finding in the decision listed below. It set EUR 2,000 and noted that Spanish law classes a failure to give all the Article 13 and 14 information as minor for limitation purposes. The Garante’s EUR 120,000 covers several findings together, so the share for the notice is not stated.

What PeekWell checks and how

EU-04 asks one question: does the privacy policy say who the site actually talks to? It answers by comparing two lists, one from what the browser did and one from what the policy says.

The observed list comes from the same clean visit the other checks use. The scan opens a public page as an ordinary visitor’s browser would and records every distinct third-party domain the page contacts and every cookie it sets. A maintained mapping table turns domains into companies, so that a request to connect.facebook.net is recorded as Meta.

The disclosed list comes from your privacy policy. The scan fetches the policy the site links to, and a language model reads the text and writes out a structured list of the recipients it names and the categories of recipient it mentions. The model only reads and lists. Code then takes the observed list and subtracts the disclosed list, and each company ends up in one of three groups: named in the policy, covered only by a general category, or not mentioned. A company in the second group is reported as covered generically, because generic wording is a different observation from silence.

The decision is made by code from that evidence. The language model reads the policy and may help word the report, but it never decides that a company is missing, and the report gives no legal conclusion.

The scan has limits, and the report says so. It sees the public pages it visited and nothing behind a sign-in. It does not submit forms, test passwords or open addresses nobody linked to. A request to a domain shows that the page contacted that company, not what data was sent or whether the company acts as a processor or as a controller in its own right; that is for you and your legal adviser. Sharing that happens on a server, in an app, or after a step the scan did not take is outside what a browser visit can see. The mapping table only knows the companies on it. A Passed means the expected behaviour was observed on the pages scanned. It does not say the site complies.

The browser method is the one EU-01 describes. The UK version of this check, UK-06, runs the same comparison against UK GDPR and the ICO’s guidance.

Why it matters for a company

Both decisions began with a complaint to the regulator, one in Italy and one in Spain. From there the regulator could read the notice and set it against what the company actually did.

In the AEPD’s procedure PS/00080/2023, the agency visited the website on 8 February 2023 and checked its privacy and cookie policies. The complaint describes a consent banner that spoke of “us and our partners” and led to a list of 1,522 vendors. The policy did name tools, among them Google Analytics and Google AdSense. The AEPD’s concern was that the interests of the third parties behind the banner were not set out, so a reader had to open the vendor policies one by one, and that no transfer outside the EU was mentioned. It found an infringement of Article 13 and ordered the company to adapt its policy within a month.

The Garante’s decision of 18 December 2025 shows the same article at group scale. The company’s notice came from a template prepared for every affiliate in the group, some outside the EU. The Garante found that it did not clearly identify the controller, the processors or the recipients, and that the phrase “those who need to know” did not say who could in fact reach the data.

In practice a complaint can start the process, and the notice is the first document read. A notice that is right on the day it is written can fall behind the site within weeks, because the site changes more often than the policy.

Smaller companies and larger companies

The rule has no size threshold. What differs is how the gap appears.

In a small company the privacy policy usually comes from a generator or a template, written once when the site launched. Afterwards someone adds a chat widget, a review plugin, a booking tool or an ad pixel, and the policy is never reopened. The notice is simply older than the site. The Spanish decision shows a limited company with a website was within the AEPD’s reach on Article 13 transparency; its findings concerned purposes, legal basis, third-party interests and transfers, not a recipient list.

In a larger company the problem is the number of owners. Marketing runs the tag manager, product adds an SDK, and a consent platform brings in a vendor list that runs to the thousands. One notice is written for many sites and countries, so it stays general. The Italian decision describes this pattern: a document drafted for the whole group and applied to one company. The guidelines ask for the specific recipients, or for categories that are specific.

How to fix it

The steps below fit most sites. Whether a given tool counts as a processor or a controller is a question for your legal adviser.

1. Make the observed list yourself. Open the site in a private window with the browser’s network tab open, load the main pages and write down every third-party domain that appears. Then open the cookie list in your consent tool or in the browser’s storage panel and add any company that sets a cookie. A spreadsheet is enough.
2. Name the company behind each domain. Use the vendor’s own site, not a guess. Note what it does for you and what visitor data it receives.
3. Choose names or specific categories for each. The Working Party’s default is the name. If you use a category, make it specific: “analytics provider based in the United States” says more than “partners” or “service providers”.
4. Put the list in the policy itself. Add a section headed “Who we share data with”, in plain language, with the company or category, what it does and where it is based. Do not rely on a link to a vendor list that runs to thousands of entries as the only place visitors can find out.
5. Check the policy matches the transfer and legal basis sections. If a recipient sits outside the EU, Article 13(1)(f) asks the policy to say so.
6. Tie the policy to your release process. Add one line to the checklist for adding any tag, plugin or SDK: “Is this company in the privacy policy?” Put a review date on the policy.
7. Re-scan. Run a scan again once the policy is live. Companies that were on the observed list only should now show as named.