A regulator opening a complaint about your website does not read it the way you do. They load the homepage with the developer console open, watch which requests fire before anyone clicks anything, and check whether the pages you are legally required to publish actually exist. That first pass takes a few minutes, and it is where most cases are effectively decided.
The same five gaps come up again and again. None of them is exotic, all of them are visible from the outside, and every one is fixable without a lawyer. Here is what they look like from the regulator’s side of the screen.
Gap 1 — Analytics that fires before consent
This is the one that gets found first, because it is the easiest thing in the world to observe: open the page, look at the network tab, see whether a request went out to Google Analytics or Meta before the banner was touched.
Under Article 5(3) of the ePrivacy Directive, storing or reading anything on a visitor’s device requires prior consent, with a narrow exemption for what is strictly necessary to deliver the service. Analytics does not qualify. Neither does a retargeting pixel.
Why it is the first thing found: it needs no interpretation. Either the request fired before consent or it did not. There is no argument to be had about legal basis, no document to weigh. It is a binary observation, and it is the one that turns a vague complaint into a substantiated one.
How to close it: load tracking scripts only after an explicit accept, not on page load. Most tag managers support consent gating natively; Google Consent Mode v2 is the mechanism if you use Google’s stack — our Consent Mode v2 guide covers the configuration.
Gap 2 — A privacy policy that describes no one in particular
A privacy policy assembled from a template says that “we may collect certain information” and “we may share it with third parties.” It names no tool, no retention period, no legal basis, and no actual recipient.
Articles 13 and 14 of the GDPR set out what a notice has to contain, and the list is specific: the identity of the controller, the purposes and the legal basis for each processing activity, the recipients, the retention period or the criteria used to set it, and the rights available to the person reading it.
- Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:
— GDPR, Article 13
Why it is the first thing found: a template is recognisable at a glance. When a policy mentions “cookies” but the site loads six trackers by name, the mismatch between the document and the observable reality is itself the finding.
How to close it: list your actual tools. If you use Stripe, say Stripe. If data goes to a CRM in the United States, say so and name the transfer mechanism. Specificity is not a stylistic preference here — it is the requirement.
Gap 3 — A banner where refusing is harder than accepting
“Accept all” is one green button. “Reject” is three clicks down a settings panel, or it does not exist at all. This pattern was tolerated for years and no longer is.
Consent has to be freely given, and the European Data Protection Board has been explicit that an interface making refusal materially harder than acceptance does not obtain it. Several supervisory authorities have issued decisions on exactly this asymmetry.
Why it is the first thing found: it is visible in one screenshot. A regulator does not need your server logs or your processing records — the homepage is the evidence.
How to close it: refusing must cost the same number of clicks as accepting, on the same screen, with buttons of comparable prominence. If your banner cannot do that, it needs replacing rather than tuning.
Gap 4 — No identifiable company behind the site
In much of the European Union, a website must state who operates it. Germany calls it the Impressum and enforces it strictly; France requires mentions légales; the obligation exists in some form nearly everywhere in the EEA.
The required content is mundane — legal name, registered address, company registration number, contact details, and the publication director for editorial sites — which is precisely why its absence stands out.
Why it is the first thing found: it takes ten seconds to check, and unlike the other gaps it is not a matter of degree. Either the page exists with the required details, or it does not.
How to close it: publish the page and link it from the footer of every page, not only the homepage. In Germany it must be reachable in no more than two clicks from anywhere on the site.
Gap 5 — Third parties nobody declared
Payment processors, hosting providers, CRMs, email platforms, chat widgets, ad networks. Every one of them receives personal data. Most privacy policies mention none of them.
Article 13(1)(e) requires the recipients or categories of recipients to be disclosed, and Chapter V requires transfers outside the EEA to be identified along with the safeguard relied on.
Why it is the first thing found: the network tab lists them. When a site loads a chat widget from a US provider and the privacy policy says data stays in Europe, the contradiction is documented before anyone has asked a question.
How to close it: inventory what actually loads on your pages, then declare each recipient and the reason it receives data. Anything hosted outside the EEA needs its transfer mechanism named.
Which rules apply to you
The five gaps are near-universal, but the framework that governs them depends on where your visitors are:
| Framework | Region | What changes |
|---|---|---|
| GDPR | European Union / EEA | Prior consent required, fines up to €20M or 4% of turnover |
| UK GDPR | United Kingdom | Post-Brexit version, supervised by the ICO |
| CCPA/CPRA | California | No consent banner required, but a mandatory opt-out |
| PIPEDA | Canada | Meaningful consent and transparency |
| LGPD | Brazil | GDPR-inspired, with its own legal bases |
A site serving several regions is held to the strictest applicable rule for each visitor, not to an average.
Checking your own site
Everything above is observable from outside, which means you can check it yourself the same way a regulator would: load your homepage with the network tab open, click nothing, and read the list of requests.
If you would rather not do that by hand, our free GDPR compliance checker performs the same five checks automatically and returns a score with the specific findings for your site. It takes about thirty seconds and needs no signup.
FAQ
How would I know a regulator is looking?
Usually you would not, until a letter arrives. Most cases start with a complaint from a visitor or a competitor rather than a proactive audit, which is why the gaps visible from the outside are the ones that matter most.
Do these five apply to a small site with no shop?
Four of them do. If you publish a website in the EU, use any analytics, and are identifiable as a business, gaps 1 through 4 apply regardless of size. Only the third-party disclosure gap scales with how many tools you run.
I already have a cookie banner. Is that enough?
Often not. A large share of banners either load trackers before consent is given or make refusal harder than acceptance, which are gaps 1 and 3. Having a banner and having valid consent are different things.
Can I fix these without a lawyer?
The five above, yes — they are technical and documentary rather than a matter of legal judgment. An unusual processing activity, a data protection impact assessment or a genuinely novel question still warrants professional advice. Our 10-step action plan covers the full sequence.
What does it cost to close them?
The banner and the disclosure work cost time rather than money. For the documents themselves, our comparison of lawyer versus AI-generator pricing sets out the trade-off; WebLegal’s packs start at €19.90.
