Sample Report

Sample CCPA Compliance Report: See What You Get

This is a real Privisy audit report structure, run against a fictional storefront so you can see exactly what you'd get. No signup required.

shop.example.com

A mid-size e-commerce storefront with strong policy fundamentals but critical gaps in opt-out mechanics and GPC signal handling.

63D
Scanned
5 pages
Scan Date
2026-07-28
01

UI & page compliance

Surface-level disclosures and opt-out mechanisms a regulator reviews first

Do Not Sell or Share Link

Ref: § 7013
Finding: No 'Do Not Sell or Share My Personal Information' link was found on the homepage or footer.
Evidence: Footer scan of shop.example.com found no anchor text matching 'do not sell' or 'do not share'.
How to Fix: Add a persistent 'Do Not Sell or Share My Personal Information' link to the site footer.
Severity: critical

Privacy Policy Link

Ref: § 7011
Finding: A visible link to the full privacy policy is present in the site footer.
Evidence: Footer anchor '/privacy-policy' found on all 5 crawled pages.
How to Fix: No action needed; keep the footer link present on every page.
Severity: critical

Notice at Collection

Ref: § 7012
Finding: The checkout form collects email and shipping address with no notice at collection displayed.
Evidence: Checkout form at /checkout has no notice element within 200px of the email/address inputs.
How to Fix: Display a notice at collection summarizing categories collected and purposes before or at the point of data entry.
Severity: high

Symmetry of Choice

Ref: § 7004(a)(2)
Finding: Accepting cookies takes one click, but opting out requires navigating two nested settings screens.
Evidence: Consent banner: 'Accept All' is a single top-level button; 'Reject All' is nested under 'Manage Preferences' → 'Advanced'.
How to Fix: Give the reject/opt-out control the same visual prominence and click depth as the accept control.
Severity: high

Alternative Opt-Out Link

Ref: § 7015
Finding: No combined opt-out link is used, so this check does not apply and is recorded as informational.
Evidence: No 'Your Privacy Choices' combined link detected in the footer.
How to Fix: No action needed unless you adopt a combined opt-out link in the future.
Severity: info

Limit Use of Sensitive PI Link

Ref: § 7014, § 1798.121
Finding: The site does not use sensitive personal information beyond the requested service, so no limit-use link is required.
Evidence: No sensitive PI categories (precise geolocation, government ID) detected in checkout or account forms.
How to Fix: No action needed unless sensitive PI use expands beyond fulfilling the requested service.
Severity: info
02

Tracker & network leak detection

Full network-layer scan of outbound requests during page load

Third-Party Marketing Trackers

Ref: § 7013, § 7025
Finding: Two marketing pixels load on page render, before any consent choice is made.
Evidence: Meta Pixel (connect.facebook.net) and TikTok Pixel (analytics.tiktok.com) requests fired at page load.
How to Fix: Gate marketing-pixel script tags behind the consent-management platform so they load only after opt-in.
Severity: high

Third-Party Request Inventory

Finding: 18 distinct third-party domains were contacted during page load, all categorized and none uncategorized.
Evidence: Full inventory recorded: 6 analytics, 4 marketing, 3 CDN, 3 payment, 2 support-widget domains.
How to Fix: No action needed; continue reviewing the inventory when adding new vendors.
Severity: medium
03

Global Privacy Control (GPC) validation

Sends the GPC signal and verifies the site responds with opt-out behavior

GPC Signal Honored

Ref: § 7025(a)
Finding: Marketing cookies and ad-tech requests continued firing after the GPC signal was detected.
Evidence: Meta Pixel and TikTok Pixel requests observed after Sec-GPC: 1 was sent on page reload.
How to Fix: Wire the GPC signal handler into the consent-management platform so marketing vendors are blocked the moment GPC is detected.
Severity: critical

GPC Status Display

Ref: § 7025(c)(6)
Finding: The site does not show consumers any confirmation that their GPC opt-out was recognized.
Evidence: No status banner or account-page indicator found after re-visiting with Sec-GPC: 1 set.
How to Fix: Add a visible confirmation (banner or account setting) telling the visitor their opt-out preference signal was received.
Severity: high
04

Privacy policy substance review

Every required disclosure element checked against the 2026 CCPA/CPRA statute

Privacy Policy

Ref: § 7011
Finding: A comprehensive privacy policy was found at /privacy-policy.
Evidence: Policy document located at shop.example.com/privacy-policy, last-modified header present.
How to Fix: No action needed; keep the policy published and linked.
Severity: critical

Policy: Data Categories Disclosure

Ref: § 7011(e)(1)(A)
Finding: The policy lists identifiers, commercial information, and internet activity as categories collected.
Evidence: Policy section 'Information We Collect' enumerates 5 categories of personal information.
How to Fix: No action needed; keep the category list current as data practices change.
Severity: critical

Policy: Collection Purposes

Ref: § 7011(e)(1)(C)
Finding: The policy states the business purpose for each category of data collected.
Evidence: Policy section 'How We Use Your Information' maps each category to a stated purpose.
How to Fix: No action needed; keep purposes aligned with actual data use.
Severity: critical

Policy: Right to Know

Ref: § 7011(e)(2)(A)
Finding: The policy explains the consumer's right to request disclosure of collected data.
Evidence: Policy section 'Your Rights' includes a 'Right to Know' subsection with a request process.
How to Fix: No action needed.
Severity: high

Policy: Right to Delete

Ref: § 7011(e)(2)(B)
Finding: The policy describes the right to request deletion and lists a designated submission method.
Evidence: Policy states requests can be submitted via the '/privacy-requests' web form.
How to Fix: No action needed.
Severity: high

Policy: Right to Correct

Ref: § 7011(e)(2)(C)
Finding: The policy describes the consumer's right to correct inaccurate personal information.
Evidence: Policy section 'Your Rights' includes a 'Right to Correct' subsection.
How to Fix: No action needed.
Severity: high

Policy: Right to Opt-Out

Ref: § 7011(e)(2)(D)
Finding: The policy does not mention the right to opt out of the sale or sharing of personal information.
Evidence: No 'opt-out', 'do not sell', or 'do not share' language found anywhere in the policy text.
How to Fix: Add a section explaining the right to opt out of sale/sharing and link it to the Do Not Sell or Share page.
Severity: critical

Policy: 12-Month Lookback Period

Ref: § 7011(e)(1)
Finding: The policy states that disclosures cover the preceding 12 months of data practices.
Evidence: Policy includes the sentence: 'This policy reflects our data practices over the preceding 12 months.'
How to Fix: No action needed.
Severity: medium

Policy: Service Provider Disclosure

Ref: § 7011(e)(1)(H)
Finding: The policy discloses categories of service providers receiving personal information.
Evidence: Policy section 'Service Providers' names payment processors, shipping carriers, and email vendors.
How to Fix: No action needed.
Severity: medium

Policy: Categories of Sources

Ref: § 7011(e)(1)(B)
Finding: The policy does not identify where personal information is collected from.
Evidence: No 'sources of information' or equivalent section found in the policy text.
How to Fix: Add a section listing sources such as 'directly from you', 'automated technologies', and 'third-party partners'.
Severity: critical

Policy: Categories of Third Parties

Ref: § 7011(e)(1)(E)
Finding: The policy identifies the categories of third parties receiving sold or shared data.
Evidence: Policy section 'Third Parties We Share Data With' lists ad networks and analytics providers.
How to Fix: No action needed.
Severity: critical

Policy: ADMT Disclosure

Ref: § 7011(e)(2)(F)-(G), § 7200
Finding: The policy contains no language describing automated decisionmaking technology.
Evidence: No 'automated decision', 'ADMT', or equivalent term found in the policy text.
How to Fix: If ADMT is used for significant decisions, add a Pre-use Notice describing its logic, purpose, and consumer rights.
Severity: info

Policy: Sensitive PI Usage

Ref: § 7011(e)(1)(J)
Finding: The policy states the business does not use sensitive personal information beyond permitted purposes.
Evidence: Policy states: 'We do not use sensitive personal information for purposes beyond providing our services.'
How to Fix: No action needed.
Severity: high

Policy: Right to Limit Sensitive PI

Ref: § 1798.121, § 7011(e)(2)(E)
Finding: The policy's sensitive-PI statement makes the limit-use disclosure inapplicable, and this is stated.
Evidence: Policy notes sensitive PI is used solely for the § 7027(m) permitted purposes, so no limit-use right applies.
How to Fix: No action needed unless sensitive PI use expands beyond the permitted purposes.
Severity: high

Policy: Minors Under 16 Sale

Ref: § 7011(e)(1)(G)
Finding: The policy states the business has no actual knowledge of selling or sharing data of consumers under 16.
Evidence: Policy includes the statement: 'We do not knowingly sell or share the personal information of consumers under 16.'
How to Fix: No action needed.
Severity: high

Policy: Non-Discrimination Rights

Ref: § 7011(e)(2)(H)
Finding: The policy assures consumers they will not be discriminated against for exercising CCPA rights.
Evidence: Policy section 'Non-Discrimination' lists denial of goods, different pricing, and different service quality as prohibited responses.
How to Fix: No action needed.
Severity: high

Policy: Verification Process

Ref: § 7011(e)(3)(E)
Finding: The policy explains how consumer identity is verified before fulfilling a request.
Evidence: Policy section 'Verifying Your Request' describes matching submitted details against account records.
How to Fix: No action needed.
Severity: medium

Policy: Privacy Contact Information

Ref: § 7011(e)(3)(J)
Finding: The policy provides no email, phone number, or web form for privacy-related inquiries.
Evidence: No contact method found in the policy's 'Contact Us' section beyond a general customer-service link.
How to Fix: Add a dedicated privacy contact method, such as an email address or web form, in a clearly labeled section.
Severity: medium

Policy: Authorized Agent Instructions

Ref: § 7011(e)(3)(H)
Finding: The policy explains how a consumer can designate an authorized agent to submit requests.
Evidence: Policy section 'Authorized Agents' describes the written-permission requirement.
How to Fix: No action needed.
Severity: medium

Policy: Last Updated Date

Ref: § 7011(e)(4)
Finding: The policy shows a last-updated date, but it is over 18 months old relative to the scan date.
Evidence: Footer of the policy reads 'Last Updated: January 12, 2025.'
How to Fix: Review the policy for accuracy and refresh the last-updated date whenever data practices change.
Severity: medium

Trackers Detected

Meta Pixel
connect.facebook.net
Category: Marketing
Fired before consent: Yes
Blocked under GPC: No
TikTok Pixel
analytics.tiktok.com
Category: Marketing
Fired before consent: Yes
Blocked under GPC: No
Google Analytics 4
www.google-analytics.com
Category: Analytics
Fired before consent: No
Blocked under GPC: Yes

Ready to Audit Your Site?

Run a free, instant network-layer audit to check for unauthorized trackers, dark patterns, GPC signals, and CCPA compliance gaps.

Run a Free Scan