ICO privacy notice: who your site shares data with

The rule

The text on legislation.gov.uk is the revised version, which includes the changes made since the end of 2020, most recently by the Data (Use and Access) Act 2025. Point (e) of both articles reads as it does in the EU text, so the same two words, “named” and “categories”, are the ones in play. The EU version of this check, EU-04, covers the GDPR and the EU authorities.

The ICO’s guidance says what it expects to see.

Article 12(1) adds that the controller “shall take appropriate measures to provide any information referred to in Articles 13 and 14”, in a form that is concise, transparent, intelligible and easy to reach, so the way the list is presented counts as well as its content.

On penalties, Article 83(5)(b) of the UK GDPR places “the data subjects’ rights pursuant to Articles 12 to 21” in the upper tier, which carries a maximum of GBP 17.5 million or 4% of worldwide annual turnover, whichever is higher, for an undertaking. Section 157 of the Data Protection Act 2018 sets out the same two tiers. The check’s citation lists Art. 13(1)(e) and 14; the tier is point (b).

What PeekWell checks and how

UK-06 asks one question: does the privacy notice say who the site actually talks to? It compares two lists, one built from what the browser did and one built from what the notice says.

The method is the same as EU-04, and the limits are the same. The scan opens a public page as an ordinary visitor’s browser would and records every distinct third-party domain the page contacts and every cookie it sets. A maintained mapping table turns domains into companies, so a request to connect.facebook.net is recorded as Meta. The scan then fetches the privacy notice the site links to, using the UK wording and sections. A language model reads it and writes out a structured list of the recipients it names and the categories of recipient it mentions.

The comparison is code, not judgement. The model reads and lists; it never decides that a company is missing. Each company on the observed list is put in one of three groups: named in the notice, covered only by a general category, or not mentioned. A category such as “analytics providers” is reported as generic cover, which is a different observation from silence.

The scan has limits, and the report says so. It sees the public pages it visited and nothing behind a sign-in. It does not submit forms, test passwords or open addresses nobody linked to. A request to a domain shows that the page contacted that company, not what data was sent or whether the company is a processor or a controller in its own right. Sharing that happens on a server, in an app, or after a step the scan did not take is outside what a browser visit can see. The mapping table only knows the companies on it. A Passed means the expected behaviour was observed on the pages scanned. It does not say the site complies.

Why it matters for a company

The clearest published example of how the ICO reads point (e) is the TikTok penalty notice of 4 April 2023, a penalty of GBP 12.7 million that also covers the way TikTok handled children’s data. On 24 September 2026 the ICO announced that TikTok had withdrawn two appeals and accepted the penalty, so the notice is final.

Annex 3 of the notice goes through the three privacy policies TikTok had in force from August 2018 to 28 July 2020. The first named two recipients, Google as its analytics provider and Facebook as its advertising tool, with their addresses. The second and third named none themselves, though the cookie policies they linked to named Google and Facebook. All three relied on descriptors such as “business partners”, “advertising and advertising networks”, “cloud storage providers”, “IT service providers” and “analytics and search engine providers”. The Commissioner’s view was that these categories were “too broad and not adequately explained”, and that “it is unreasonable to assume that a data subject would have had knowledge of all of the various entities with whom TikTok does business”. TikTok argued that Article 13(1)(e) allows either recipients or categories. The ICO’s answer was that TikTok had to give either the named recipients or categories with enough detail that people could “know exactly who held their personal data”.

The notice leaned on the Working Party’s transparency guidelines for its reading, quoting the annex passage that EU-04 sets out, including the sentence that in practice this “will generally be the named recipients”.

Three things follow for a company. The finding was drawn from the text of the policies, which a regulator can read from outside. Naming two companies did not settle it: the ICO looked at the descriptors that sat beside them. And the findings on recipients sat inside a larger notice, so a gap here travels with other findings rather than standing alone.

Smaller companies and larger companies

The rule and the penalty tiers apply to any controller. Section 157 gives the higher maximum as GBP 17.5 million or 4% of turnover for an undertaking, and the fixed sum for others. What differs is how the gap arises. No published ICO penalty against a smaller company on this point could be confirmed, so the smaller-company picture below is a description of how the problem tends to form, not a statement about enforcement.

In a small company the notice usually comes from a template or a generator, written once when the site launched. Afterwards someone adds a chat widget, a booking tool, a review plugin or an ad pixel, and the notice is never reopened. Nobody decides to leave a company out. The notice simply dates from before the tool arrived.

In a larger company the pattern is the one the TikTok annex shows. Several teams add tools, the policy is rewritten for new products, and the notice reaches for umbrella terms such as “partners” and “service providers” to stay accurate as the list changes. The ICO’s answer was that umbrella terms were not enough. A company with an analytics provider, an ad network and a consent platform on every page can have a recipient list that is long and changing, and the notice has to keep up with it.

How to fix it

The steps below fit most sites. Whether a tool counts as a processor or a controller is a question for your legal adviser.

1. Make the observed list yourself. Open the site in a private window with the browser’s network tab open, load the main pages without touching the cookie banner, and write down every third-party domain that appears. Add any company that sets a cookie. A spreadsheet is enough.
2. Name the company behind each domain. Use the vendor’s own site, not a guess. Note what it does for you and what visitor data it receives.
3. Choose names or specific categories. The ICO’s wording is to be “as specific as possible” if you give only categories. “Analytics provider” says more than “partner”. “Business partners” on its own is the kind of descriptor the TikTok notice criticised.
4. Put the list in the notice itself. Add a section such as “Who we share data with”, in plain language, giving the company or category and what it does for you. Do not leave visitors to find it in a long vendor list or in a separate document.
5. Keep the cookie notice and privacy notice in step. The TikTok notice records that two of the privacy policies pointed to cookie policies that named some companies. If the two documents disagree, readers cannot tell which one is current.
6. Tie the notice to your release process. Add one line to the checklist for any new tag, plugin or SDK: “Is this company in the privacy notice?” Put a review date on the notice.
7. Re-scan. Run a scan again once the notice is live. Companies that were on the observed list only should now show as named.