Privacy policy published in footer with OMB M-17-06 reference
Why it matters
Every federal agency that operates a website must publish a privacy policy — it is a statutory requirement under the E-Government Act of 2002 (Section 208) and OMB M-17-06. Without one, citizens have no basis to understand how their PII is collected, stored, shared, or protected. Failure to reference OMB M-17-06 specifically signals the policy was written without awareness of federal obligations, leaving gaps around cookie disclosure, third-party analytics (DAP), and user rights that create compliance exposure and erode public trust. A generic or placeholder privacy page does not satisfy this requirement.
Severity rationale
Critical because absent or federally non-compliant privacy policies violate the E-Government Act of 2002 and OMB M-17-06, exposing the agency to compliance findings and leaving citizens without legally required disclosures about their data.
Remediation
Create a /privacy route and link it in your footer. The policy must explicitly reference OMB M-17-06 and address PII handling, cookies, third-party analytics, and user rights. Add the footer link in app/layout.tsx:
// app/layout.tsx — footer section
<footer>
<nav aria-label="Footer">
<a href="/privacy">Privacy Policy</a>
<a href="/accessibility">Accessibility</a>
</nav>
</footer>
In app/privacy/page.tsx, include an explicit statement like: "This privacy policy is maintained in accordance with OMB M-17-06 and Section 208 of the E-Government Act of 2002." Cover all five required topics: information collection, PII use, third-party analytics (DAP), cookie usage and opt-out, and how to contact the agency with privacy questions.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Government Web Standards Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- external · omb-m-17-06 — OMB M-17-06 — Policies for Federal Agency Public Websites and Digital Services (privacy policy requirement)
- external · e-gov-act-2002-sec-208 — E-Government Act of 2002 § 208 — Privacy impact assessments and privacy policy disclosure
Taxons
History
- 2026-04-18·v1.0.0·Initial import from gov-web-standards·automated