Legal & Trust guide
Website legal requirements checklist: the 3 checks a scan runs
Privacy policy, legal pages, and tracking consent: the things that get sites fined or sued.
Last updated:
Privacy and consent rules apply to small sites too, and the most common gaps are a missing policy page or analytics that load before the visitor agrees. These checks look for the pages that should be there and for trackers that start too early. They find gaps; they are not legal advice.
2 of these 3 checks run on the free scan, with no account. The other 1 run on Pro.
- 1
Privacy policy
FreeChecks you have a privacy policy and that it discloses what regulators require (data collected, rights, AI use, third parties).
- 2
Legal & policy pages
FreeChecks for Terms, Cookie Policy, an Accessibility statement, and a clear agreement at signup.
WCAG accessibility: The international guidelines for making websites usable by people with disabilities.
Why it matters: Meeting them widens your audience and reduces legal risk.
- 3
Trackers & cookie consent
ProFinds your cookie banner, then checks whether analytics, ad and session-replay trackers run before the visitor clicks Accept, and whether they stop after Reject.
Cookie consent: The visitor’s opt-in, usually through a cookie banner, before a site sets non-essential cookies or loads analytics and ad trackers.
Why it matters: Under GDPR and the ePrivacy rules, trackers that run before the visitor clicks Accept, or after Reject, are unlawful for EU and UK visitors.
Common fixes
What the report most often tells you to do when one of these checks fails.
- Publish a privacy policy and link it from your footer. GDPR, CalOPPA and CCPA require one for almost any site that collects personal data, including through analytics.
- Replace a placeholder policy with a real one. Regulators treat a stub policy as no policy.
- Use clickwrap at signup: an explicit checkbox or statement that links your Terms and Privacy Policy.
- Hold back non-essential trackers until the visitor opts in, with a consent banner that actually blocks the tags first.
- If you use session replay, disclose it, mask sensitive fields, and only start it after consent.
Run these 3 Legal & Trust checks on your site
One scan covers this list and the other categories, and the report says what to fix first.