Tagged
Privacy policy
A user ID that never changes keeps data personal under GDPR, even if hashed
Italy's data protection authority fined IQVIA 7 million euros for treating a patient database as anonymous when each pa…
11 Oct 2026
If your SaaS imports personal data, list its sources. The 2026 GDPR transparency check asks your customers.
In 2026, 25 European data protection authorities are questioning recruiters, healthcare, finance, marketing and public…
7 Oct 2026
A DSA illegal content report form should accept reports without a name or email
If people in the EU can upload, publish or share content through your product, the Digital Services Act requires a way…
29 Sep 2026
Every contact you publish for GDPR data requests must be easy to use on its own
Spain's regulator fined Securitas Direct 100,000 euros for a paid 902 phone line on its camera signs, even though its p…
23 Sep 2026
Your AI agent's tool list is the recipient list your privacy policy has to name
Giving a language model tools means the model decides at run time which companies receive personal data. GDPR Article 1…
21 Sep 2026
GDPR gives you one month to answer a deletion request, even if the data is already deleted
On 21 July 2026 the CNIL fined the IT consultancy EXTIA 300,000 euros over deletion requests, mostly because 166 people…
12 Sep 2026
Your app sends personal data outside the EU. Each destination needs its own transfer mechanism.
Making personal data available to a separate company outside the EEA is a transfer, and GDPR Chapter V requires a named…
11 Sep 2026
Uber fined 825 million euros for automatically banning drivers
On 21 August 2026 the Dutch data protection authority fined Uber 824,990,000 euros for switching off drivers' accounts…
8 Sep 2026
How long can you keep user data? Write down the period, then make something enforce it.
Set a period for each category of data you hold, publish it, and build something that enforces it. GDPR Article 5(1)(e)…
4 Sep 2026
Shipping every week? Five changes that put your privacy policy out of date.
Privacy policy drift is a document written once against a product that ships every week. Regulators name five changes u…
1 Sep 2026
Do you need a DPA with every vendor? Sort your list into three groups first.
No. GDPR Article 28(3) requires a written contract only where a vendor is your processor, meaning it handles the data o…
26 Aug 2026
An auditor keeps your security honest. Nothing keeps your privacy policy honest.
A SOC 2 audit examines the security controls you scoped into it, and platforms like Vanta collect the evidence for that…
24 Aug 2026
Adding AI to your app? Add these three disclosures to your privacy policy.
Calling an LLM API adds three things to what GDPR Article 13 makes you disclose: the model vendor becomes a recipient o…
19 Aug 2026
Your Vercel app deploys on every merge. Its privacy policy is still on version one.
Vercel's compliance covers Vercel's own service, not the app you deploy on it. From day one your privacy policy must di…
19 Aug 2026
Enterprise buyers read your privacy policy before they read your pricing
Enterprise buyers are legally required to vet you: GDPR Article 28 lets a controller use only processors providing suff…
18 Aug 2026
Remove "we may" or "possible" from your privacy policy. EU regulators call for plain language.
Search your own privacy policy for "we may". I did it to 336 published policies from Product Hunt launches and 231 of t…
18 Aug 2026
Product Hunt seriesThe most upvoted Product Hunt launches are no more compliant than the least
I scanned 458 products launched on Product Hunt over 30 days in 2026 and split them by upvotes. Across a range from 4 t…
11 Aug 2026
Product Hunt seriesOnly 45% of Product Hunt privacy policies name a legal basis
I scanned 458 products that launched on Product Hunt over 30 days in July and August 2026. 397 published a readable pri…
11 Aug 2026
Product Hunt series60% of Product Hunt sites load a foreign vendor their policy never mentions
I scanned 458 products launched on Product Hunt over 30 days, loading each from inside the EU and reading its legal pag…
11 Aug 2026
Two days from launch with no privacy policy. Twelve facts have to be true.
Before you publish a Privacy Policy, GDPR Article 13 requires twelve items. Two are close to boilerplate and one is you…
6 Aug 2026
Your Privacy Policy says "anonymised". The EDPB just asked: for whom?
The EDPB's draft Guidelines 02/2026, out for consultation until 30 October 2026, treat anonymity as relative: the same…
31 Jul 2026