Dedicated cookie policy page exists and is linked from consent banner
Why it matters
GDPR Art. 13 requires controllers to provide data subjects with information about cookies and tracking 'at the time when personal data are obtained' — meaning before or at the moment of consent, not buried in a terms document. ePrivacy Art. 5(3) ties the validity of consent to the user being 'provided with clear and comprehensive information.' A consent banner with no link to a cookie policy asks users to consent without knowing what they are consenting to. CCPA §1798.135 separately requires a 'Do Not Sell or Share' notice that must reference the categories of data and how to opt out, typically in a dedicated policy document.
Severity rationale
Low because the absence of a linked cookie policy impairs informed consent but does not itself cause unlawful data collection — it reduces the quality and defensibility of consent obtained rather than making the act of collection per se unlawful.
Remediation
Create app/cookies/page.tsx (or an equivalent static MDX page) and link it directly from the consent banner's introductory text. The page must be publicly accessible without authentication.
// In CookieBanner.tsx — add the link before the action buttons
<p className="text-sm text-gray-600">
We use cookies to improve your experience.{' '}
<a href="/cookies" className="underline" target="_blank" rel="noopener noreferrer">
Read our Cookie Policy
</a>{' '}
to see exactly what we collect and why.
</p>
Generate the page content from COOKIE_REGISTRY (see all-cookies-documented remediation) so it stays in sync with actual cookie usage automatically. The route should appear in the site's sitemap.xml and should not require a robots: { index: false } directive.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Cookie & Consent Compliance Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- gdpr · Art. 13 — GDPR — information must be provided in an easily accessible form
- eprivacy · Art. 5(3) — ePrivacy Directive — clear and comprehensive information required prior to consent
- ccpa · §1798.135 — CCPA — privacy notice must be accessible from the homepage
Taxons
History
- 2026-04-18·v1.0.0·Initial import from cookie-consent-compliance·automated