Privacy policy link: finding one anywhere on the site
A missing privacy policy is a legal exposure where the GDPR or CCPA applies. squirrel accepts a policy page or a link to one from any crawled page.
What this rule looks for
A privacy policy explains what personal data a site collects, why, who receives it and what a visitor can do about it. The GDPR and the CCPA both require one for the audiences they cover, and most analytics and advertising vendors require one in their own terms.
This rule asks the narrow question of whether the site has one at all, by page or by link. eeat/privacy-policy asks the related question of how widely it is linked.
What squirrel checks
The rule is site-wide. It accepts a privacy policy in two ways: a crawled page that is one, found by a known multilingual slug or by a title or h1 reading as a privacy policy, or a link to one from any crawled page. The link test reads both the href and the anchor text, which is what makes it wider than the eeat rule’s href-only test. It emits a single check named privacy-policy:
- Skipped when no pages were crawled. Message:
No pages available for analysis. - Pass when either is found. Message:
Privacy policy link found, with the URL as the value. - Fail when none is found and the site metadata places the site under a stricter privacy regime. Message:
No privacy policy link found across site — required under GDPR, naming the regime, withAdd a privacy policy — legally required for your audience (GDPR)as the value. - Warn when none is found otherwise. Message:
No privacy policy link found across site, withAdd a link to your privacy policyas the value.
Severity for the rule is warning, weight 5. The escalation to a failure depends on site metadata; an offline run or one with no metadata warns instead.
How to fix it
<a href="/privacy-policy">Privacy policy</a>Publish the policy and link it from the footer component so every page carries it. Cover what you collect, why, who you share it with, how long you keep it and how someone exercises their rights.
Keep it in step with the vendors you actually use. A policy naming an analytics tool you removed is inaccurate in both directions.
| Rule ID | legal/privacy-policy |
| Category | Legal Compliance |
| Scope | Site-wide |
| Severity | warning |
| Weight | 5/10 |
Enable / disable
Disable this rule
[rules]
disable = ["legal/privacy-policy"]Disable all Legal Compliance rules
[rules]
disable = ["legal/*"]Enable only this rule
[rules]
enable = ["legal/privacy-policy"]enable replaces the default ["*"], so this is the only rule selected. Leave disable out: a rule that matches any disable pattern is skipped even when enable names it. Only an enabled setting under a rule’s own [rule_options] table overrides both lists.
Related rules
- eeat/privacy-policy: the same page, measured for link coverage.
- legal/cookie-consent: the banner that should link to it.
- legal/terms-of-service: the other legal page in the footer.
- security/third-party-cookies: the vendors the policy has to name.
Legal Compliance findings ship in every audit next to the SEO, performance and agent experience rules. See Website security scan with AI for how an agent works through a report.
References
Check your site
Run squirrel audit https://example.com and open the Legal Compliance section of the report. The site is reported with the privacy policy URL it found, or that it found none. Signed-out local audits need no account and cost nothing. Signed-in audits spend credits.