Which services belong in the privacy policy?

Every embedded third-party service that processes personal data — analytics, advertising, fonts, maps, chat, CDN, hosting — must appear in the privacy policy.

Is this a risk?

Art. 13 GDPR requires details on purpose, legal basis, recipients, retention period and third-country transfer. An incomplete privacy policy is a separate infringement — regardless of whether the embedding itself is lawful.

What you can do

• Create a complete list of all embedded services (including those that come via a plugin or tag manager).
• For each service: add provider, purpose, legal basis, retention period, recipient country.
• Maintain the privacy policy with every change to the website.
• Regularly reconcile whether the services actually loaded match the privacy policy.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.