Verify that a site has a Privacy Policy, Terms of Service, Cookie Policy, and Imprint. Detects missing legal pages — a hard requirement under GDPR, CCPA, and most jurisdictions.
Every commercial website needs a defined set of legal pages. Missing them is the easiest legal/operational risk to fix and the most commonly overlooked one. This tool finds the gaps in seconds.
## What legal pages every site actually needs
The exact list depends on jurisdiction and business model, but the universal baseline in 2026 is:
1. **Privacy Policy** — required EVERYWHERE if you collect any personal data (and you do: cookies, contact forms, analytics, support tickets all count). Required by GDPR (EU/UK), CCPA (California), LGPD (Brazil), POPIA (South Africa), PIPEDA (Canada), and the App Store/Play Store guidelines.
2. **Terms of Service / Terms & Conditions** — limits your liability, governs how users can use the site, makes IP ownership explicit. Without it, you have weak legal recourse against abusive users and unclear ownership of user-submitted content.
3. **Cookie Policy** — required by ePrivacy Directive (EU/UK) for any non-essential cookies. Usually separate from the Privacy Policy because cookies are a distinct legal regime.
4. **Imprint (Impressum)** — legally mandated in Germany, Austria, and Switzerland on every commercial website. Must include full company name, address, registration number, and managing director name. Failure to provide is a per-incident fine starting at €1,000.
5. **Refund / Return / Shipping policies** — required for ecommerce by Stripe, PayPal, Shopify, and your payment processor's acceptable-use policy. Missing them gets your merchant account suspended much faster than you'd expect.
## How we find them
For each page type, we probe a list of 8-12 conventional URL paths via HEAD/GET requests. For Privacy Policy that's: `/privacy`, `/privacy-policy`, `/legal/privacy`, `/privacy-notice`, `/data-policy`, `/policies/privacy`, `/about/privacy`, `/site/privacy`, and more. The first URL that returns 200 wins. We report what we found, what we couldn't find, and which paths we checked (so you can confirm we didn't miss a path with an unusual URL).
## What this tool doesn't do
We don't read the page content — we only confirm it exists at a discoverable URL. A page titled "Privacy Policy" that contains only "Coming soon" will pass this check but fail any legal review. For content quality, you need legal review.
We also don't check whether the page is linked from the footer (it should be). The combination "page exists but isn't linked" is legally equivalent to "page doesn't exist" in most jurisdictions — users must be able to find it.
## Why we don't just look at the footer
Footer-only crawling misses pages that exist but aren't linked, *and* finds pages that are linked but broken. URL probing finds what's reachable at a canonical path — closer to what a regulator, App Store reviewer, or payment processor will actually check. Both methods complement each other; we picked the more reliable one.
## Per-jurisdiction quick reference
- **EU + UK**: Privacy Policy + Cookie Policy + (Imprint if German-language site) - **Germany / Austria / Switzerland**: + Imprint (Impressum) - **California (CCPA)**: Privacy Policy with CCPA-specific "Do Not Sell My Personal Information" link - **Ecommerce anywhere**: + Refund/Return/Shipping policies - **SaaS B2B**: + Terms of Service, Data Processing Addendum (DPA) link - **App Store / Play Store apps**: + Privacy Policy with App-Store-specific disclosures (categories of data, third parties)
A missing Privacy Policy is one of the few things that can get an app rejected from the App Store / Play Store, get an ad account suspended on Meta/Google/TikTok, and trigger an automatic GDPR/CCPA violation finding. Most sites have these pages but don't link to them prominently — which is just as bad legally. This tool finds the gaps in five seconds without you having to crawl every footer link manually.
For each requested page type (Privacy Policy, Terms of Service, Cookie Policy, Imprint, Refund Policy, Shipping Policy, etc.), we maintain a list of 8-12 conventional URL paths. We probe each path with a HEAD request (falling back to GET if HEAD is not supported by the origin) and a 10-second timeout. A 200 status code means "found"; anything else means "keep trying." The first path that returns 200 is reported as the found URL. We check pages in parallel batches of 3 to balance speed against rate-limit risk on origin servers. The response includes, for each page type: whether it was found, the URL it was found at (if any), and the full list of paths we checked (so you can see we tried the conventions and didn't miss an unusual one). We do not fetch the page body or assess its content — that's a job for legal review, not automated tooling.
We probe conventional paths only. If your URL is unconventional, link it from your footer (and add a redirect from /privacy → /pp) so regulators and tools can find it.
No — only that a page exists at a canonical URL. For content quality (does it list third parties, retention periods, user rights, DPO contact?) you need legal review.
Imprint is legally required in Germany/Austria/Switzerland and best-practice elsewhere. If you don't serve German-language users, you can ignore this flag.
Yes — a contact form collects personal data. Under GDPR, CCPA, and almost every modern data law, any personal data collection requires a Privacy Policy.
Terms of Service is YOUR rules for users (how they can use the site, IP, liability limits). Privacy Policy is YOUR obligations to users (what data you collect, how you use it, their rights). Both are needed.