Sub-processors: services your privacy policy leaves out

The rule

The Article 29 Working Party’s transparency guidelines say how to choose between naming recipients and giving categories.

Article 12(1) adds that the information be given “in a concise, transparent, intelligible and easily accessible form, using clear and plain language”, so where the list sits and how it reads count as well as what it says.

On penalties, Article 83(5)(b) places “the data subjects’ rights pursuant to Articles 12 to 22” in the upper tier, with a ceiling of EUR 20 million or 4% of worldwide annual turnover, whichever is higher. Articles 13 and 14 sit inside that range. The check’s citation lists Art. 83(5) generally; the applicable point is (b), and the AEPD applied it to an Article 13 finding in the decision listed below. It set EUR 2,000 and noted that Spanish law classes a failure to give all the Article 13 and 14 information as minor for limitation purposes. The Garante’s EUR 120,000 covers several findings together, so the share for the notice is not stated.

What PeekWell checks and how

EU-04 asks one question: does the privacy policy say who the site actually talks to? The scan answers it by setting what your pages did against what your policy says.

The scan is automated. It opens your public pages the way a visitor’s browser would and notes each outside company the page contacts or that sets a cookie. It also reads the privacy policy your site links to, for the recipients it names and the kinds of recipient it mentions. Each company lands in one of three groups: named in the policy, covered only by a general category, or not mentioned. Generic wording gets its own result, because it isn’t the same as silence.

The scan has limits, and the report says so. It sees the public pages it visited, and the members area when you give it a sign-in. It doesn’t port-scan, try to get in where it isn’t allowed, run any security test or open addresses nobody linked to. Seeing that a page contacted a company doesn’t show what data was sent, or whether that company acts as a processor or as a controller in its own right. That’s for you and your legal adviser. Sharing that happens on a server, in an app, or after a step a visitor wouldn’t take is outside what a browser visit can see. A Passed means the expected behaviour was observed on the pages scanned. It doesn’t say the site complies.

EU-01 asks a related question: what loads before the visitor answers the banner. The UK version of this check, UK-06, asks the same question under UK GDPR and the ICO’s guidance.

Why it matters for a company

The two decisions described here began with a complaint to the regulator, one in Italy and one in Spain. From there the regulator could read the notice and set it against what the company actually did.

In the AEPD’s procedure PS/00080/2023, the agency visited the website on 8 February 2023 and checked its privacy and cookie policies. The complaint describes a consent banner that spoke of “us and our partners” and led to a list of 1,522 vendors. The policy did name tools, among them Google Analytics and Google AdSense. The AEPD’s concern was that the interests of the third parties behind the banner were not set out, so a reader had to open the vendor policies one by one, and that no transfer outside the EU was mentioned. It found an infringement of Article 13 and ordered the company to adapt its policy within a month.

The Garante’s decision of 18 December 2025 shows the same article at group scale. The company’s notice came from a template prepared for every affiliate in the group, some outside the EU. The Garante found that it did not clearly identify the controller, the processors or the recipients, and that the phrase “those who need to know” did not say who could in fact reach the data.

In practice a complaint can start the process, and the notice is the first document read. A notice that is right on the day it is written can fall behind the site within weeks, because the site changes more often than the policy.

Smaller companies and larger companies

The rule has no size threshold. What differs is how the gap appears.

In a small company the privacy policy usually comes from a generator or a template, written once when the site launched. Afterwards someone adds a chat widget, a review plugin, a booking tool or an ad pixel, and the policy is never reopened. The notice is simply older than the site. The Spanish decision shows a limited company with a website was within the AEPD’s reach on Article 13 transparency; its findings concerned purposes, legal basis, third-party interests and transfers, not a recipient list.

In a larger company the problem is the number of owners. Marketing runs the tag manager, product adds an SDK, and a consent platform brings in a vendor list that runs to the thousands. One notice is written for many sites and countries, so it stays general. The Italian decision describes this pattern: a document drafted for the whole group and applied to one company. The guidelines ask for the specific recipients, or for categories that are specific.

How to fix it

The steps below fit most sites. Whether a given tool counts as a processor or a controller is a question for your legal adviser.

1. Make the observed list yourself. Open the site in a private window with the browser’s network tab open, load the main pages and write down every third-party domain that appears. Then open the cookie list in your consent tool or in the browser’s storage panel and add any company that sets a cookie. A spreadsheet is enough.
2. Name the company behind each domain. Use the vendor’s own site, not a guess. Note what it does for you and what visitor data it receives.
3. Choose names or specific categories for each. The Working Party’s default is the name. If you use a category, make it specific: “analytics provider based in the United States” says more than “partners” or “service providers”.
4. Put the list in the policy itself. Add a section headed “Who we share data with”, in plain language, with the company or category, what it does and where it is based. Do not rely on a link to a vendor list that runs to thousands of entries as the only place visitors can find out.
5. Check the policy matches the transfer and legal basis sections. If a recipient sits outside the EU, Article 13(1)(f) asks the policy to say so.
6. Tie the policy to your release process. Add one line to the checklist for adding any tag, plugin or SDK: “Is this company in the privacy policy?” Put a review date on the policy.
7. Re-scan. Run a scan again once the policy is live. Companies that were on the observed list only should now show as named.