Common Privacy Policy mistakes that still ship

I still reach for curl first when someone says the policy is "on the site somewhere." Somewhere is not a footer. Somewhere is how 404s survive review. SlaySlop's Privacy policy check "Checks whether a public privacy policy can be found and reached." The mistakes below fight that bar.

Outcome if you catch these early

You ship a discoverable, publicly reachable policy URL on the hosts you promised. Legal can still revise the prose later. Reachability is the web team's part of the bargain. I would rather fix a path on Tuesday than explain a dead footer on a Friday launch call.

Boundaries

Read-only public scan. Permission required. Not legal drafting. Closing this finding does not inventory cookies or prove consent. Different Legal rows. Terms page is also separate even when both documents live under /legal.

Mistake: link without a live document

Design includes Privacy. CMS link field points at /privacy. Nobody created the page. Or the page lived on the old CMS path. Curl tells on you faster than another meeting.

HOST="https://www.example.com"
curl -sI -L "$HOST/privacy" | awk 'BEGIN{IGNORECASE=1} /^HTTP|^location:/{print}'

If you see a terminal 404, stop calling it done. I have fixed this on launch morning more times than I want to admit. The redesign kept the label and dropped the page type. Nobody noticed until a human clicked.

Mistake: policy behind authentication

The only copy sits inside the logged-in app help center. Marketing apex has no public link. Prospects and crawlers never see it. Some teams call that "secure." The check calls it unreachable as a public policy. If counsel wants a public document, it needs a public route.

Mistake: cookie banner as substitute

Consent UI matters. It is not a privacy policy. Cookie signals matter. They are not a privacy policy. I keep saying that on calls because the collapse is common and expensive in trust terms. Banners answer a different question about choice UI. Policies answer what you claim to do with data.

Mistake: scanned host is not the linked host

Scan runs on www. Footer points at legal.example.com that was never deployed. Or the opposite. Align DNS, link targets, and the host in SlaySlop. Otherwise you fix the wrong place and the row stays red. I write the exact host in the ticket title so deploy scripts do not "helpfully" retarget the wrong apex.

Mistake: temporary coming soon that graduates to production

Placeholders feel honest in week one. They ship. Clients click them on the launch call. Replace placeholders with the real document or remove the link until the document exists. Half-states are still findings waiting to happen. Soft launches do not excuse hard 404s.

What good looks like

One canonical public URL, linked from global chrome, returning a readable document, named in the portal, rechecked after redesigns. When SlaySlop already monitors the site, a quiet Privacy policy row after the fix is a useful acceptance check. Soft product fit, only because the evidence beats another "trust me" in chat.