A real report of a fictional shop
7 things to review. No third-party service was observed.
In short
- No advertising service was found on the home page, so Global Privacy Control (GPC) has nothing to switch off.
- A cookie banner was shown, but we found no reject or opt-out button on it.
- Whether you need an opt-out cannot be seen from outside: no advertising service loaded on the home page, and the privacy policy does not say whether you sell or share personal information (see D5). If you do, a "Do Not Sell or Share My Personal Information" link is required (see C1).
- The privacy policy is missing 6 of 11 required elements.
- Issues
- 7
- Risks
- 0
- Services
- 0
- Global Privacy Control
- Nothing to switch off
- Consent banner
- No reject option
Scanned from San Francisco, California on .
CCPA applies
For this example we assume the shop meets a CCPA threshold, so findings marked “CCPA” are shown as they would apply.
What to do
Sorted by urgency. Each item shows what we observed, what it means and the next step.
1.Are accept and reject equally easy?B2
Saying no must be as easy as saying yes: a reject button next to accept, with the same size and emphasis. Asymmetric cookie choices were part of the California Privacy Protection Agency's 2025 order against American Honda ($632,500).
- What we observed
- The banner shows "Accept all" but no equivalent reject option on the same layer.
- What it means
- Choices must be symmetrical: saying no may not take more steps than saying yes.
Next step: Add a reject or opt-out button next to accept, with the same size and style.Details
- Legal basis
- 11 CCR § 7004(a)(2)
2.Does it say what is sold or shared — or that nothing is?D5
Which kinds of information you sold or shared in the last 12 months — or a clear statement that you did not.
- What we observed
- We did not find this in the privacy policy.
- What it means
- California's privacy policy rules require it. Automated reading can miss unusual wording, so check the policy before you change it.
Next step: State which categories were sold or shared in the past 12 months, and to whom — or that none were.Details
- Legal basis
- 11 CCR § 7011(e)(1)(D)–(E)
3.Does it say how long each kind of information is kept?D7
How long you keep each kind of information. One sentence such as "as long as necessary" for everything is not enough.
- What we observed
- The policy mentions retention, but gives no period for each category of information. It says: “We keep personal information for as long as necessary for the purposes described in this policy, unless a longer period is required or permitted by law.”
- What it means
- California's privacy policy rules require it. Automated reading can miss unusual wording, so check the policy before you change it.
Next step: State how long each category is kept, or the criteria used to decide — per category, not one sentence for everything.Details
- Legal basis
- Cal. Civ. Code § 1798.100(a)(3); 11 CCR § 7011(e)(1)(H)
4.Does it explain the six consumer rights?D9
The policy must explain six rights: to know, to delete, to correct, to opt out of selling and sharing, to limit the use of sensitive information, and not to be treated differently for using these rights.
- What we observed
- We found none of the six rights: know or access their information, delete, correct, opt out of selling and sharing, equal treatment (non-discrimination).
- What it means
- California's privacy policy rules require it. Automated reading can miss unusual wording, so check the policy before you change it.
Next step: Explain the rights to know, delete, correct, opt out of sale/sharing, limit sensitive information, and non-discrimination.Details
- Legal basis
- 11 CCR § 7011(e)(2)
5.Does it offer at least two ways to send a request?D10
Visitors need at least two ways to send a privacy request, typically a toll-free number and a web form.
- What we observed
- We found fewer than two ways to send a privacy request (found: an e-mail address).
- What it means
- California's privacy policy rules require it. Automated reading can miss unusual wording, so check the policy before you change it.
Next step: Offer at least two methods, typically a toll-free number and a web form (online-only businesses: an e-mail address).Details
- Legal basis
- Cal. Civ. Code § 1798.130(a)(1); 11 CCR § 7011(e)(3)
6.Does it explain how GPC and similar signals are handled?D11
The policy must say whether and how you process opt-out signals such as Global Privacy Control.
- What we observed
- We did not find this in the privacy policy.
- What it means
- California's privacy policy rules require it. Automated reading can miss unusual wording, so check the policy before you change it.
Next step: Describe that and how you process GPC, and whether it applies to the browser or the account.Details
- Legal basis
- 11 CCR § 7011(e)(3)(F), § 7025
7.Does it address minors under 16?D8
Whether you sell or share information of consumers under 16.
- What we observed
- The policy only mentions children under 13 (the federal COPPA age). The CCPA asks about consumers under 16.
- What it means
- California's privacy policy rules require it. Automated reading can miss unusual wording, so check the policy before you change it.
Next step: State whether you have actual knowledge of selling or sharing personal information of consumers under 16.Details
- Legal basis
- Cal. Civ. Code § 1798.120(c); 11 CCR § 7011(e)(1)(I)
For information · 2
Worth a look, but not counted as issues — the scan cannot decide these alone.
C1Is there a "Do Not Sell or Share My Personal Information" link?CCPAFor information
Businesses that sell or share personal information — which includes most advertising pixels — must link "Do Not Sell or Share My Personal Information" (or "Your Privacy Choices" with the official icon) on every page.
What we observed: No opt-out link was found. No advertising service was observed either.
What it means: If you neither sell nor share personal information, the link is not required. Data sales that happen outside the website cannot be seen by this scan. The privacy policy does not say whether you sell or share personal information either (see D5), so this scan cannot tell whether you need one.
Details
- Legal basis
- Cal. Civ. Code § 1798.135(a); 11 CCR §§ 7013, 7015, 7025(g)
C2Is there a "Limit the Use of My Sensitive Personal Information" link?CCPAFor information
Required only if you use sensitive information (such as health data or precise location) beyond what is needed to provide your service.
What we observed: No "Limit the Use of My Sensitive Personal Information" link was found.
What it means: The link is required only if you use or disclose sensitive personal information beyond the purposes the regulations permit. That cannot be observed from outside.
Details
- Legal basis
- Cal. Civ. Code § 1798.135(a)(2); 11 CCR § 7014
Could not be tested · 1
These checks have no result either way. Each is listed with the reason the scan gave.
Other reasons · 1
The reason is given in each check.
B1Does rejecting the cookie banner stop tracking?Could not be tested
This is the core question: when a visitor clicks "reject" in your cookie banner, do advertising and tracking services actually stop? We reject, wait, reload the page and record everything that still loads once the stored choice applies. Requests that pass the refusal on to the vendor (for example Google's consent mode set to "denied") are listed, not counted against you.
What we observed: A consent banner was detected, but no reject or opt-out control could be found and clicked.
What it means: Either the banner offers no way to say no (see B2), or the control is built in a way the scanner cannot operate.
Next step: Check whether the banner offers a reject or opt-out option on the first layer.
Details
- Legal basis
- Cal. Civ. Code §§ 1798.120, 1798.135; 11 CCR § 7004; Cal. Penal Code § 631(a)
What our browser saw
Taken during the reject run of this scan, October 18, 2026, from San Francisco, California.
Screenshots record one visit. Banners and pages can look different for other visitors, locations and times.
14 checks without findings
No issue observed, or not applicable to this site. Open to see what was checked.
A · Opting out (GPC and opt-out link)
A1Does the site honor Global Privacy Control (GPC)?CCPANo issue observed
Global Privacy Control (GPC) is a browser setting that tells every website: do not sell or share my data. California and eleven other states require businesses to treat it like a click on "Do Not Sell". We load your site with and without the signal and compare which advertising services load. A request that tells the vendor the visitor opted out (for example Google's consent mode set to "denied" or Meta's Limited Data Use) counts as the signal being passed on, not as tracking. In 2022 Sephora paid $1.2 million in the first public CCPA settlement, which concerned GPC.
What we observed: No advertising service loaded without the signal, so there was nothing for GPC to stop (3 paired runs).
What it means: No issue observed. This changes the moment an advertising tag is added — that is what monitoring watches for.
Details
- Runs
- 3 paired runs, each in a fresh browser; the page read navigator.globalPrivacyControl = true
- Legal basis
- 11 CCR § 7025(b), (c)(1); Cal. Civ. Code § 1798.135(e)
A2Does the site confirm that it received the GPC signal?CCPANot applicable
When a business honors GPC, California's regulations ask it to show the visitor that the request was received, for example with a short "Opt-Out Request Honored" note.
What we observed: No advertising service loaded without the signal.
What it means: With nothing to opt out of on this page, there is no processing to display.
Details
- Legal basis
- 11 CCR § 7025(c)(6)
A3Are GPC users spared an extra pop-up?CCPANo issue observed
A visitor who sends GPC has already said no. The site may not interrupt them with a pop-up asking to confirm or to change their mind.
What we observed: With GPC, the page showed no additional banner or dialog.
What it means: No issue observed.
Details
- Legal basis
- 11 CCR § 7025(c)(2), (f)
A4Does the opt-out link work?CCPANot applicable
The opt-out link is the main way for visitors without GPC to say no. If it leads to a broken page, there is no working opt-out. An opt-out mechanism that did not work for 40 days was part of the California Privacy Protection Agency's 2025 order against Todd Snyder ($345,178).
What we observed: No opt-out link was found (see C1).
What it means: Nothing to follow.
Details
- Legal basis
- Cal. Civ. Code § 1798.135; 11 CCR § 7026
A5Can visitors opt out without an account or ID?CCPANot applicable
Opting out of selling or sharing must be easy: no login, no account, no ID document.
What we observed: There was no separate opt-out page to examine.
What it means: Nothing to evaluate.
Details
- Legal basis
- 11 CCR § 7026(d)
C · Required links
C3Is the privacy policy linked with the word "privacy"?CCPANo issue observed
The privacy policy must be linked from the home page, and the link text must contain the word "privacy".
What we observed: The home page links "Privacy Policy".
What it means: No issue observed.
Details
- Target
- https://demo.optoutlens.com/privacy.html
- Legal basis
- Cal. Civ. Code § 1798.130(a)(5); 11 CCR § 7011(d)
D · Privacy policy
D1Does the policy say when it was last updated?CCPANo issue observed
The policy must show when it was last updated; it has to be reviewed at least once a year.
What we observed: The privacy policy says: “Last updated: October 1, 2026”
What it means: No issue observed. We check that the topic is covered, not whether the statement is complete or true.
Details
- Legal basis
- Cal. Civ. Code § 1798.130(a)(5); 11 CCR § 7011(e)(4)
D2Does it list the kinds of personal information collected?CCPANo issue observed
Which kinds of personal information you collected in the last 12 months (identifiers, browsing activity, location, …).
What we observed: The privacy policy says: “We collect the following categories of personal information: Identifiers such as your name, email address, postal address, phone number and account login.”
What it means: No issue observed. We check that the topic is covered, not whether the statement is complete or true.
Details
- Legal basis
- 11 CCR § 7011(e)(1)(A)
D3Does it name where that information comes from?CCPANo issue observed
Where that information comes from: from visitors directly, from their devices, from partners or data brokers.
What we observed: The privacy policy says: “We collect information directly from you when you create an account, place an order, sign up for our newsletter or contact customer service.”
What it means: No issue observed. We check that the topic is covered, not whether the statement is complete or true.
Details
- Legal basis
- 11 CCR § 7011(e)(1)(B)
D4Does it explain why the information is collected?CCPANo issue observed
Why you collect each kind of information.
What we observed: The privacy policy says: “We use personal information for the following purposes: to process and ship your orders; to manage your account; to respond to your questions;”
What it means: No issue observed. We check that the topic is covered, not whether the statement is complete or true.
Details
- Legal basis
- 11 CCR § 7011(e)(1)(C)
D6Does it name the kinds of companies that receive information?CCPANo issue observed
Which kinds of companies receive personal information from you (ad networks, analytics providers, service providers, …).
What we observed: The privacy policy says: “We disclose personal information to the following categories of third parties: service providers that host our website, process payments, ship orders and send emails on our behalf;”
What it means: No issue observed. We check that the topic is covered, not whether the statement is complete or true.
Details
- Legal basis
- 11 CCR § 7011(e)(1)(F)
E · Wiretap lawsuit risk (CIPA)
E1Do form or search entries go to third parties?Not applicable
California's wiretap law (CIPA) lets visitors sue when a third party reads what they type. Forms and search fields whose entries go to an outside service are the most common target of such lawsuits.
What we observed: No form or search field was found on the home page, and no third-party form service loaded.
What it means: Other pages were not examined.
Details
- Legal basis
- Cal. Penal Code § 631(a)
E2Is a session recording tool running?No issue observed
Session recording tools replay what visitors do on the page, including clicks and typing. They are a frequent subject of wiretap lawsuits.
What we observed: No known session recording tool loaded.
What it means: No risk observed. Analytics tools with optional recording (for example PostHog) are listed under services.
Details
- Legal basis
- Cal. Penal Code § 631(a)
E3Is a third-party chat widget running?No issue observed
Chat widgets send visitors' messages through the chat provider's servers — another frequent subject of wiretap lawsuits.
What we observed: No known chat widget loaded.
What it means: No risk observed.
Details
- Legal basis
- Cal. Penal Code § 631(a)