Skip to content

Date of the privacy policy

Is the privacy policy dated, and is it newer than the privacy law of the market and recently reviewed?

What we check

We open the privacy policy that the home page links to and look for a date near terms such as "last updated", "effective", "version" or "as of", also in German and French.

  • No date found: note.
  • Date before the privacy law of the market: warning. That is 25 May 2018 in the EU and the UK (GDPR) and 1 September 2023 in Switzerland (revised FADP).
  • Date older than the review period: note. In the United States after 12 months, on the international version after 24 months.
  • Otherwise: fine.

If no privacy policy is linked, this check does not apply. The check "Privacy policy and imprint" then reports that. This is an automatic preliminary check, not legal advice.

Why it matters

Privacy laws have extended the duties to inform. A current policy names among other things:

  • the identity and contact details of the controller,
  • the purposes and, in the EU and UK, the legal basis of the processing,
  • the recipients, such as hosting, analytics or newsletter services,
  • the countries to which data goes, and the safeguards for this,
  • the rights of the persons concerned.

Many policies are older than the law that applies to them. They name services that are long since no longer used and leave out new ones. A visible date shows visitors and authorities that the policy is maintained.

How to fix it

  1. Take stock: which services does the website use today? The report on third parties helps with this.
  2. Revise: compare the policy with the law of your market. If in doubt, a professional helps.
  3. Note the date: at the beginning or end of the policy, e.g. "Last updated: October 2026". Use an unambiguous format with month and year.
  4. Review regularly: set yourself a yearly reminder.

Typical gaps in older policies

  • No indication of the countries to which data goes, such as the USA for Google services.
  • No mention of the hosting provider and server location.
  • Embedded services such as Google Maps, YouTube or Google Fonts are missing.
  • No way to opt out of the sale or sharing of data for visitors from US states with such a right.

How to check it yourself

Open the privacy policy and use Ctrl+F to search for "updated" or the current year. If the date is old or missing, a review is due.

Frequently asked questions

Is it enough to simply write in a new date?

No. The date should reflect the state of the content. A policy from 2017 with a new date still does not cover what the GDPR requires. Have the content revised.

How often should the privacy policy be reviewed?

At least once a year, and whenever a new service is added, such as a booking tool, a newsletter or new analytics. In California the CCPA requires an update at least every 12 months.

Check a website now

We check "Date of the privacy policy" and all other points in a few minutes, free and without sign-up.