Legal & Compliance

GDPR Privacy Notice Requirements for Websites

A privacy-policy link is not enough by itself. GDPR transparency concerns whether the person can understand the actual processing at the time their data is collected.

Article 13 information

Depending on the facts, a notice should explain the controller and contact details, data-protection officer, purposes and legal bases, legitimate interests, recipients, international transfers and safeguards, retention periods, data-subject rights, consent withdrawal, supervisory-authority complaints, whether data is required, and automated decision-making.

Article 12 requires this information to be concise, transparent, intelligible, easily accessible, and in clear and plain language. That is why AllyProof searches semantically across languages rather than requiring a link literally named “Privacy Policy” or “Datenschutzerklärung.”

What AllyProof checks

The Germany and EU/EEA profiles use the same GDPR evidence engine in both the free preview and authenticated site scan. It:

• checks whether a privacy notice is reachable from each reviewed page;
• locates wording for seven selected Article 13 topics: controller/contact, purposes and legal bases, recipients or recipient categories (if any), retention, applicable data-subject rights, complaint rights, and whether providing data is required and the consequences of not providing it;
• separately locates processing signals and disclosure details for consent, legitimate interests, international transfers, and Article 22 automated decisions with legal or similarly significant effects; ordinary profiling alone does not establish that last condition;
• compares third-party providers observed by the browser with recipients described in the notice;
• checks whether an observed consent choice can later be withdrawn; and
• records HTTPS, mixed-content, and selected pre-consent third-party behaviour as separate evidence.

English and German wording has a deterministic fast path. A bounded semantic extractor can read other languages; its excerpts must match the source verbatim. Notice-content findings remain Needs review, even when all topic patterns match: locating a phrase cannot verify its completeness, accuracy or applicability to each processing purpose. If the model is unavailable or its input is truncated, the result identifies that limitation. An unobserved processing condition means unknown, not inapplicable.

A missing provider name is useful evidence of a possible notice/runtime mismatch, but a domain may belong to a processor described under another brand or category and therefore needs review.

What the scan cannot establish

A public browser cannot verify records of processing, processor contracts, DPIAs, breach response, actual deletion schedules, rights-request handling, backend security, or processing that happens only in internal systems. It also cannot determine from the public site alone whether a data-protection officer or EU representative is legally required, or whether Article 14 applies because data was obtained from somewhere other than the visitor.

Layered notices, information already provided to the person (Article 13(4)), and additional Article 14 information require context. A field not located in one fetched page is not proof of a legal omission. These limits are why the product reports named observations rather than a “GDPR compliant” score.

How to improve the notice

Build the notice from a current data inventory, not a template alone. Map each form, cookie, SDK, embed, payment flow, and server log to its purpose, legal basis, recipients, retention, and transfer mechanism. Use layered headings, concrete names, and the language your audience can reasonably understand. Recheck the notice whenever tags or vendors change.

Official sources

• GDPR, Articles 12 and 13
• EDPB transparency guidelines under Regulation 2016/679

Common questions

Must an EU privacy notice be in English?

No universal GDPR rule requires English. Information must be concise, transparent, intelligible, easily accessible, and written in clear language for the people addressed. The appropriate language follows the actual audience and context.

Does naming Google Analytics make a privacy notice complete?

No. A notice must describe the relevant processing, purposes, legal bases, recipients, retention, transfers, and rights as applicable. Naming a tool is only one part of transparency.