Which services belong in the privacy policy?

Every embedded third-party service that processes personal data — analytics, advertising, fonts, maps, chat, CDN, hosting — must appear in the privacy policy.

The privacy policy and the consent banner answer two different questions. The banner governs whether a service may load at all (consent under Section 25 TDDDG). The privacy policy fulfils the information obligation under Article 13 GDPR — it must also name the services that run on a basis other than consent: hosting, CDN, a server-side spam filter, font delivery. A service that needs no banner can still belong in the privacy policy.

The details for each service follow a fixed pattern: name and address of the provider, purpose of the processing, legal basis (consent, contract, legitimate interest), categories of data processed, storage period, whether and where data is transferred to a third country and on what basis, and the data subject rights including withdrawal. If one of these points is missing, the policy is incomplete to that extent — and that is a separate breach subject to fines, regardless of whether the integration itself was permitted.

The most common mistake is an outdated list. Services are added via plugins, the tag manager or a theme update without the privacy policy being updated. Conversely, tools that were removed long ago are often still listed. A pragmatic check: load the page in a private window, note all third-party hosts in the network tab and compare them against the privacy policy — at least after every major website change.

Is this a risk?

Art. 13 GDPR requires details on purpose, legal basis, recipients, retention period and third-country transfer. An incomplete privacy policy is a separate infringement — regardless of whether the embedding itself is lawful.

What you can do

• Create a complete list of all embedded services (including those that come via a plugin or tag manager).
• For each service: add provider, purpose, legal basis, retention period, recipient country.
• Maintain the privacy policy with every change to the website.
• Regularly reconcile whether the services actually loaded match the privacy policy.

Häufige Fragen

Do I have to include hosting and CDN in the privacy policy too?

Yes. Hosts and CDNs process visitors' IP addresses and are recipients within the meaning of Article 13 GDPR. They do not need a consent banner, but they do belong in the policy with their purpose, legal basis and any third-country transfer.

Is a privacy policy generator enough?

As a starting point, yes. The generated texts cover standard services but have to be adapted to the tools actually in use and kept up to date. A generator replaces neither the inventory nor the legal review.

What happens with an incomplete privacy policy?

It is a separate GDPR breach under Article 13 that supervisory authorities can fine — even if the data processing itself is lawful. In practice, warnings and requests come first.

How often do I have to review the privacy policy?

After every change that adds or removes services, and additionally on a fixed schedule (e.g. every six months). A quick comparison of the third-party hosts loaded in the network tab against the policy is enough for the routine check.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.