Third-party analytics and ad scripts disclosed in privacy policy
Why it matters
GDPR Art. 13 requires that users be informed at collection time which third parties receive their data and for what purpose. A privacy policy that says 'we use analytics partners' without naming Google Analytics, Amplitude, or Stripe does not meet this standard. GDPR Art. 28 requires a data processing agreement with each processor — you cannot have a DPA with a vendor you haven't disclosed. CCPA §1798.100(a) requires disclosure of data categories and recipients. A gap between disclosed and actually-integrated services is the most common finding in regulatory audits.
Severity rationale
Medium because the harm is indirect — undisclosed sharing doesn't cause immediate data loss — but a single regulator request for the third-party list turns the omission into a documented compliance failure.
Remediation
Add a named third-party processor table to your privacy policy that lists every integrated vendor, the data categories they receive, and the processing purpose. Keep it synchronized with your actual integrations — a stale list is worse than no list. Example table for src/app/privacy/page.mdx or equivalent:
## Third-Party Data Processors
| Service | Data Received | Purpose | DPA |
|---------|---------------|---------|-----|
| Google Analytics | Page views, events, user ID | Usage analytics | [Link] |
| Stripe | Payment details, billing address | Payment processing | [Link] |
| SendGrid | Email address, engagement events | Transactional email | [Link] |
| AWS S3 | User-uploaded media | File storage | [Link] |
| Cloudflare | IP address, request headers | CDN, DDoS protection | [Link] |
Add a review step to your deployment checklist: 'Are all new third-party integrations reflected in the privacy policy processor table?'
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Community Privacy & Controls Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- gdpr · Art. 13 — Information to be provided — third-party processors must be disclosed
- gdpr · Art. 28 — Processor — data processing agreements with third parties
- ccpa · §1798.100(a) — Right to know — categories of third parties with whom data is shared
Taxons
History
- 2026-04-18·v1.0.0·Initial import from community-privacy-controls·automated