Legal compliance audit rules: privacy and cookie consent
Audit rules for legal pages and consent: a cookie consent mechanism, a privacy policy, terms of service and a sub-processor disclosure.
Legal Compliance rules check for the pages and mechanisms that privacy law and commercial practice expect: a consent gate before non-essential cookies, a privacy policy, terms of service, and a sub-processor disclosure for businesses that handle customer data. They confirm the thing exists and is reachable, not that its contents satisfy any particular regulator. Two of them escalate when the audit’s site metadata places the audience under a stricter regime.
Run only these rules
squirrel audit https://example.com --rule-include legalWhere to start
These carry the highest severity and weight in the category.
- Privacy policy link: finding one anywhere on the site: A missing privacy policy is a legal exposure where the GDPR or CCPA applies. squirrel accepts a policy page or a link to one from any crawled page.
- Cookie consent banner: detecting a consent mechanism: Setting non-essential cookies without consent is unlawful for an EU audience. squirrel looks for a consent platform or a consent-keyed banner.
- Sub-processor disclosure: what a security review asks: A processor has to name the sub-processors it engages. squirrel looks for a subprocessors page or a DPA link anywhere on the site.
- Terms of service link: finding it in the page’s links: Terms of service belong in the footer of every page. squirrel checks each page’s links by both href and anchor text, in five languages.
Rules
| Rule | What it flags | Severity | Scope |
|---|---|---|---|
| Cookie consent banner: detecting a consent mechanism | Setting non-essential cookies without consent is unlawful for an EU audience. squirrel looks for a consent platform or a consent-keyed banner. | info | Per-page |
| Privacy policy link: finding one anywhere on the site | A missing privacy policy is a legal exposure where the GDPR or CCPA applies. squirrel accepts a policy page or a link to one from any crawled page. | warning | Site-wide |
| Sub-processor disclosure: what a security review asks | A processor has to name the sub-processors it engages. squirrel looks for a subprocessors page or a DPA link anywhere on the site. | info | Site-wide |
| Terms of service link: finding it in the page’s links | Terms of service belong in the footer of every page. squirrel checks each page’s links by both href and anchor text, in five languages. | info | Per-page |
Key terms
- Cookie consent: The banner and mechanism that asks visitors before setting non-essential cookies, as GDPR and ePrivacy require in the EU.
- Privacy policy: The page explaining what personal data a site collects and why; required by law in many places and a trust signal for search.
Related categories
Analytics checks for Google Consent Mode v2. E-E-A-T has its own privacy policy and terms of service rules, which treat the pages as trust signals.
Learn more
- Website security scan with AI, the hygiene an AI-assisted security audit finds and how an agent patches it
- Website audit tool
- Sample report, with the Legal Compliance section on a real site
Disable all Legal Compliance rules
[rules]
disable = ["legal/*"]