← All checks
Compliance & Privacylowprivacy-policy-omits-named-recipient

Privacy policy does not appear to name a data-collection service the site uses

A crawled privacy policy did not name one or more recognized data-collection services observed on the crawled site.

Why it matters

Privacy information should reflect services that receive visitors' data. A policy written before a tracker or session-recording tool was added can become inaccurate.

How ShipReady detects it

What it inspects

ShipReady finds a successfully fetched, non-truncated privacy-policy page among crawled pages, extracts visible text, and looks for recognized analytics, advertising, session-replay, and fingerprinting services in evidence regions of crawled page HTML.

What triggers a finding

The rule triggers when a recognized service is observed and neither its name nor known parent company appears in the selected policy text.

What the evidence shows

The scan observed the listed service pattern in crawled page evidence and did not find its recognized name or parent-company name in the selected policy text.

Limits of this check

This is a medium-confidence text comparison, not a legal assessment. It does not decide whether general wording adequately discloses a recipient, inspect services outside crawled pages, render a client-side policy shell, or report content embeds such as video, map, and CAPTCHA providers.

How to fix it

Review the observed service against your actual stack

Confirm whether the listed service is intentionally deployed and what visitor data it receives. Remove an unused integration or update the policy to describe the service accurately.

Make the disclosure easy to find

Name the provider or its company where appropriate, describe its role, and keep the policy linked from a stable public URL. Have qualified counsel review legal sufficiency for your jurisdiction and practices.

How to verify the change

Check the published policy

Open the public policy and compare it with the deployed services on the site.

Expected: The policy accurately describes the services that receive visitor data, or the service is no longer deployed.