Cookie/tracking declaration is present in privacy policy or cookie policy
Why it matters
GDPR Art. 13 and CCPA §1798.100 require disclosure of what data is collected, why, and by whom — at the point of collection. A missing or unlinked privacy or cookie policy leaves users unable to exercise their rights (access, deletion, opt-out) and exposes operators to regulatory complaints. Under GDPR, the absence of a privacy notice is itself a violation independent of whether any data was misused. Consent management platforms auto-generate cookie declarations, but only if a policy page is present and linked where users can find it.
Severity rationale
Medium because the absence of a privacy or cookie policy is a standalone GDPR Art. 13 disclosure violation, but does not by itself cause data exfiltration or immediate user harm.
Remediation
Create a privacy policy page at app/privacy/page.tsx listing the analytics tools you use and how users can opt out. Then link it from your footer component:
// components/Footer.tsx
<Link href="/privacy">Privacy Policy</Link>
<Link href="/cookies">Cookie Policy</Link>
Services like GetTerms, Termly, or iubenda generate GDPR-conformant policy text — a generated baseline beats no policy. If you use a CMP (CookieYes, OneTrust), embed its auto-generated cookie declaration table on the policy page so the tool list stays current as you add or remove analytics vendors.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Analytics & Tracking Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- gdpr · Art. 13 — Information to be provided where personal data are collected from the data subject
- eprivacy · Art. 5(3) — Confidentiality of communications / cookie consent
- ccpa · §1798.100 — Consumer right to know about personal information collected
Taxons
History
- 2026-04-18·v1.0.0·Initial import from marketing-analytics·automated