Your files never leave your device. All processing happens locally in your browser.
How do I check a privacy policy for GDPR and CCPA gaps for free without uploading it?
Open the Privacy Policy Analyzer, paste the policy text, and a pure in-browser engine runs a 24-item disclosure checklist for what GDPR (Art. 13/14/6), CCPA/CPRA and COPPA expect — marking each element Present, Unclear or Missing with the matched snippet — then flags vague / red-flag phrasing, computes Flesch readability and a coverage score, and exports a Markdown or CSV report. Everything runs locally; the pasted text is never uploaded. It is a heuristic gap-checker, not legal advice.
24 disclosures across 6 groups: identity/contact, data & purposes, sharing/transfers, retention/security, rights, and cookies/children/change
Each item marked Present / Unclear / Missing with the exact matched snippet as evidence
Red-flag scan for phrases like “we may share with third parties”, change-without-notice and “by using the site you consent”
Flesch reading-ease + grade level, length, a weighted coverage score, and Markdown / CSV export
100% client-side — the policy text never leaves your browser
What is
Privacy policy gap analysis
Privacy policy gap analysis is the process of checking a privacy notice for the disclosures data-protection law expects it to contain — the controller’s identity and contact, categories of data, purposes, legal basis, sharing and international transfers, retention, security, and the data-subject / consumer rights — and identifying which are present, vague or missing. This tool performs that check heuristically in the browser using keyword and phrase detection against a checklist derived from GDPR Articles 13, 14 and 6, the CCPA/CPRA and COPPA, and additionally flags common vague or misleading wording. It reports gaps and readability; it does not judge legality and is not a substitute for legal review.
Security & Privacy
Related terms
GDPRCCPACPRACOPPAdata controllerlegal basisdata-subject rightsdata retentioninternational transfersDo Not Sell or ShareFlesch reading easedark patterns
Frequently Asked Questions
No. The text is analysed entirely in your browser and is never uploaded, logged or stored on a server.
The analysis runs in a pure JavaScript engine on your device — there is no network request, no upload, no logging and no CDN anywhere in the analysis path. The pasted policy lives only in the browser tab’s memory and is discarded when you close the tab. The tool works offline once cached, keeps no history, and the only optional network use anywhere on the site is consent-gated ads, which never see your text.
No. The score measures whether expected disclosures appear, not whether they are accurate, lawful or followed.
The coverage score reflects how many of the 24 tracked disclosures the tool can find, weighting “unclear” items at half. It is a presence check, not a compliance verdict: a policy can score 100% and still be unlawful (for example if a stated legal basis is invalid, or a disclosed practice is not actually followed), and a genuinely compliant policy that uses unusual wording can be marked “missing” as a false negative. Use the score to prioritise obvious gaps, then have a qualified privacy professional or lawyer review. This tool is not legal advice.
A 24-item checklist from GDPR Art. 13/14/6, CCPA/CPRA and COPPA, plus about a dozen vague / red-flag phrases.
The checklist covers controller identity and privacy contact, DPO / EU representative, categories of personal data, purposes, legal basis, automated decision-making, third-party sharing / processors, sale & opt-out (Do Not Sell or Share), international transfers, retention, security measures, breach handling, the rights set (access, deletion, rectification, portability, opt-out / object / restrict, non-discrimination, complaint to a supervisory authority), cookies and tracking, children’s data, the effective date and the change process. The red-flag scan surfaces open-ended sharing, change-without-notice, implied “by using the site you consent”, “for various purposes”, “as long as necessary”, “sole discretion”, third-party liability disclaimers and vague “reasonable / industry-standard” security.
Yes — copy or download a Markdown report, or download a per-check CSV, all generated locally.
The tool builds a full Markdown report (score, grouped checklist with evidence snippets, the red-flag findings with fixes, and readability) that you can copy to the clipboard or download as a .md file, and a per-check CSV (group, disclosure, regulations, status, matched term, evidence) for spreadsheets or audits. Both are assembled in the browser from the local analysis — nothing is sent to a server.
Detailed Explanation
📖How It Works
What This Tool Does
The Privacy Policy Analyzer is a 100% client-side gap-checker. A user pastes a privacy policy and a pure engine (privacyPolicyEngine.ts) runs a 24-item disclosure checklist for the elements GDPR (Articles 13, 14 and 6), the CCPA/CPRA and COPPA expect, marking each Present, Unclear or Missing with the exact matched snippet. It additionally flags roughly a dozen vague or misleading phrases, computes Flesch readability and length, and produces a weighted coverage score. It is a heuristic aid, not legal advice.
24 disclosures grouped into six sections: identity/contact, data & purposes, sharing/transfers, retention/security, rights, cookies/children/change
Each item Present / Unclear / Missing with the matched evidence snippet
Red-flag scan for ~12 vague or misleading phrases with fixes
Analysis runs locally; the pasted policy text is never uploaded
⚙️Methodology
How the Analysis Works
For each checklist item the engine holds a set of strong and weak signals (case-insensitive phrases and regular expressions). A strong match marks the disclosure Present; only a weak match marks it Unclear; no match marks it Missing. The earliest match supplies a short surrounding snippet as evidence. The red-flag detector runs a separate set of regular expressions for problematic wording. Readability uses the standard Flesch Reading Ease and Flesch–Kincaid grade formulas with a heuristic syllable counter. The coverage score is 100 × (present + 0.5 × unclear) / total, and a report is assembled as Markdown or CSV.
Strong signal → Present; weak signal → Unclear; none → Missing
Evidence snippet extracted around the earliest match
Deterministic and pure — no AI/LLM and no network call
🔧Technical Details
The Checklist and the Standards Behind It
The checklist maps to real disclosure duties: controller identity and a privacy contact, DPO / EU representative (GDPR Art. 13/14), categories of data, purposes and legal basis (Art. 6), automated decision-making (Art. 22), third-party sharing and processors, sale & opt-out and the Do Not Sell or Share right (CCPA/CPRA), international transfers and safeguards, retention, security, breach handling, the data-subject / consumer rights (access, deletion, rectification, portability, opt-out / object / restrict, non-discrimination, complaint to a supervisory authority), cookies and tracking, children’s data (COPPA), the effective date and the change process.
GDPR Articles 13 & 14 — information to provide when collecting data
GDPR Article 6 — lawful basis for processing
CCPA / CPRA — categories, sale/share, and the Do Not Sell or Share right
COPPA — children’s data and age thresholds
Data-subject / consumer rights and supervisory-authority complaints
⚠️Limitations
Honest Limitations
This is a presence-and-wording checker, not a compliance verdict. It cannot tell whether a disclosure is accurate, lawful, complete or actually followed: a policy can score 100% and still be non-compliant, and a compliant policy phrased unusually can be marked Missing (a false negative). The red-flag scan surfaces commonly problematic language, but some flagged phrases are acceptable in context. It cannot read scanned images or PDF layout, follow links, judge a specific jurisdiction, or assess whether a stated legal basis is valid. Treat the output as a starting checklist and have a qualified privacy professional or lawyer review before relying on it. It is not legal advice.
Checks presence and wording, not accuracy, legality or actual practice
False positives and false negatives are possible with unusual wording
Cannot read images/PDF layout or follow links
Red-flag phrases can be acceptable in context
Not legal advice — have a professional review
🔒Privacy & Security
Private by Design
The pasted policy is analysed entirely on the user’s device by a pure JavaScript engine. There is no network request, no upload, no logging, no server and no CDN anywhere in the analysis path; the text lives only in the browser tab’s memory and is erased when the tab closes. The Markdown and CSV reports are built locally from the in-memory analysis. The tool works offline once cached, supports dark mode and a mobile-first layout, and has no analytics or telemetry — the only optional network use anywhere on the site is consent-gated ads, which never see the text.
Analysis runs locally — nothing uploaded, logged or stored on a server
No server, no CDN, no telemetry in the analysis path
Policy text lives only in tab memory and is erased on close
Markdown/CSV reports generated locally in the browser
Works offline once cached; dark-mode and mobile-first
Disclosure status meanings
Status
Meaning
How it is decided
What to do
Present
The disclosure is clearly there
A strong signal phrase/regex matched
Verify it is accurate and complete
Unclear
The topic is touched but vague
Only a weak signal matched
Tighten the wording and add specifics
Missing
Not found in the text
No signal matched
Add the disclosure (or check for unusual wording)
Red flag
Commonly problematic phrasing
A red-flag regex matched
Rewrite per the suggested fix
Status reflects the presence and wording of expected disclosures, not their legality or accuracy. Heuristic only — not legal advice. As of July 2026.
