Legal pages linked from registration, checkout, and footer
Why it matters
GDPR Art. 13 requires that privacy information be provided at the time personal data is collected — which means the Privacy Policy must be linked at or before the registration form submit button, not discoverable only through the footer. CCPA §1798.130(a)(5)(A) requires a "conspicuous link" to the privacy policy on the homepage and at points of collection. eprivacy Art. 5(3) requires consent and disclosure at the point of tracking. A footer-only privacy link does not satisfy these requirements — regulators look for proximity of the link to the data collection action. Missing legal links at checkout also directly enable chargebacks: payment processors expect that users had access to refund terms before completing a transaction.
Severity rationale
Info because missing legal links at registration and checkout, while a compliance gap, is remediated by a single-line addition per surface rather than an architectural change.
Remediation
Add legal links to footer, registration form, and checkout page in a single pass. Each surface has a specific requirement.
// 1. Footer — legal nav group
// components/Footer.tsx
<div className="flex flex-wrap gap-4 text-sm text-muted-foreground">
<a href="/terms">Terms of Service</a>
<a href="/privacy">Privacy Policy</a>
{hasPayments && <a href="/refund-policy">Refund Policy</a>}
{hasUGC && <a href="/acceptable-use">Acceptable Use</a>}
</div>
// 2. Registration form — below the submit button
// app/register/page.tsx
<p className="text-xs text-muted-foreground text-center">
By creating an account, you agree to our{' '}
<a href="/terms" className="underline">Terms of Service</a>{' '}and{' '}
<a href="/privacy" className="underline">Privacy Policy</a>.
</p>
// 3. Checkout — near the payment button
// app/checkout/page.tsx
<p className="text-xs text-muted-foreground text-center">
By completing your purchase, you agree to our{' '}
<a href="/terms" className="underline">Terms of Service</a>{' '}and{' '}
<a href="/refund-policy" className="underline">Refund Policy</a>.
</p>
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Terms of Service & Legal Pages Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- gdpr · Art. 13 — Privacy information must be provided at time personal data is collected — requires link at point of data collection (registration, checkout)
- ccpa · §1798.130(a)(5)(A) — Privacy notice must be conspicuously posted including at or before the point of collection
- eprivacy · Art. 5(3) — ePrivacy Directive — clear and comprehensive information must be provided before cookies/tracking begins at registration
Taxons
History
- 2026-04-18·v1.0.0·Initial import from legal-pages-compliance·automated