For compliance teams
Assess your website’s privacy risk and posture
For privacy officers, compliance leads, general counsel, and the marketing or web owner who has to fix what is found. A baseline of what your website actually does versus what your notices and consent tool say, ranked by what was observed, with remediation steps, re-testing, monitoring for drift and an evidence trail you can hand to counsel or an auditor.
Sasquatch Privacy provides technical privacy observations and is not legal advice.
01
How an assessment works
- 01
Baseline
Record what your website does in four states: before consent, after Accept All, after Reject All, and with a Global Privacy Control signal. Compare that with what your privacy notice and consent tool say it does.
- 02
Rank by observed exposure
Findings are ranked by severity and confidence under a published rubric. Examples: tracking requests recorded before any consent choice, requests that continue after Reject All, no observable response to Global Privacy Control, session replay vendors.
- 03
Fix, with owners
Each finding comes with remediation steps and the role best placed to make the change: web developer, tag manager owner, consent platform admin, or legal. The marketing or web owner gets steps they can act on without re-testing.
- 04
Re-test
Run the scan again after a change and compare. A finding that disappears from the After Reject All state is evidence the change worked, as observed on that date.
- 05
Watch for drift
Tag managers change and plugins update. Monitor scans re-check on a schedule and alert when the set of trackers changes.
- 06
Keep an evidence trail
Paid audits and monitor scans offer an evidence package: a record per finding, screenshots with hashes, collection details and a reading list of legal texts, to hand to counsel or an auditor.
02
What the posture summary looks at
Results for business readers include an executive posture summary. Each area gets a status based on what was observed:
- 01Consent before tracking
- 02Honoring opt-outs (Reject All)
- 03Opt-out signals (Global Privacy Control)
- 04Session recording
- 05Vendor inventory
03
Where this fits in a privacy program
This covers the externally observable website part of a program. It covers:
- Third-party requests, cookies and storage keys, by consent state and region.
- Whether the entry page links to a privacy policy, a “Do Not Sell or Share / Your Privacy Choices” link, and cookie settings. Reported, not scored.
- An executive posture summary on results, with an observation-based status for each area above.
A program also includes things this does not cover:
- The content of your privacy policy or notices
- Data mapping and records of processing
- Handling of access, deletion and opt-out requests
- Vendor contracts and data processing agreements
- Mobile apps, internal systems and offline data
- What a vendor did with the data it received (we record that a request went to a host, not what it carried)
- Whether any law applies to you, or what follows if it does
Each scan is one automated visit per page per state from one region at one point in time, and records the host and a hash of the path of each request, never the full URL or payload. The evidence and methodology page explains the method. If your counsel wants to review the results, see the page for law firms.
04
Pricing
Start with a free scan. A Full Privacy Audit gives a complete assessment of one site with the evidence attached; Monitor, Pro and Agency re-check on a schedule. Prices are in the pricing section. For multiple business units or a compliance program, talk to us.
05
Questions
- Does this tell us whether we meet our legal obligations?
- No. It tells you what your website was observed to do on a given date. Whether that is consistent with a legal obligation depends on facts and contracts a scan cannot see, and is a question for your counsel. Findings are written as observations and are not legal advice.
- What does a posture assessment cover?
- The externally observable website part of a privacy program: consent before tracking, what Reject All does, response to Global Privacy Control, session recording and the vendor inventory. It does not replace data mapping, policy review, request handling or vendor management.
- Who is the report for?
- Privacy officers, compliance leads and general counsel get the posture summary and the evidence. The marketing or web owner gets ranked findings with the hosts behind each one and the steps to fix them.
- Can I scan a site that is not mine?
- A free scan works on any publicly reachable site. A paid audit crawls much deeper, so ordering one means confirming that you own the site or are authorised to have it tested. Monitoring requires you to verify control of the domain.
- How often should we re-test?
- Re-test after any change to tags, plugins or your consent tool. Monitor scans check on a schedule so you also find changes nobody told you about.
- How long are results kept?
- Audits are retained for 365 days; monitor scans are retained according to the plan. Download the evidence package if you need it longer.
Sasquatch Privacy provides technical privacy observations and is not legal advice.