# data[].attributes.body
Here are constructive suggestions for improvement, targeted at different stakeholders: Rock Paper Shotgun (the publisher), regulators, and users. These are designed to move from the current problematic model towards practices that are more ethical, user-centric, and sustainable.

A. For Rock Paper Shotgun (The Publisher)

These suggestions focus on building trust through transparency, ethical design, and exploring alternative business models.

1. Drastically Improve the Consent Interface (UI/UX):

· Default to Rejection: The most user-trusting change would be to have the initial choice be between "Reject All" and "Manage Preferences," with "Accept All" as a secondary option. This puts privacy first by default.

· Plain Language: Replace jargon like "personalised advertising" and "unique identifiers" with clearer explanations. For example: "We and our partners use data to show you ads for games you've recently looked at on other sites" or "We use a tracker to recognize your browser across different websites."

· Structured, Intuitive Categories: In the "Manage Preferences" menu, group purposes clearly (e.g., "Essential," "Performance Analytics," "Personalized Ads") and provide a one-sentence explanation for each. Use a simple on/off toggle.

2. Increase Meaningful Transparency:

· Partner Vetting and Capping: Commit to reducing the number of partners and publicly state a policy for vetting them based on their data security and privacy practices. Instead of "902 partners," aim for a curated, accountable list.

· Just-in-Time Explanations: Instead of one massive banner, consider contextual explanations. For example, if an article uses an interactive embed, a small notice could say, "This content needs XYZ to function. [Learn More]." This breaks down the consent process.

· A Clear "Why": Before the technical list, explain the business model simply: "We are ad-supported. Allowing personalized ads helps fund the free journalism you enjoy. You can choose to support us in these ways:" and then present the options.

3. Explore and Incentivize Privacy-Friendly Alternatives:

· Promote Contextual Advertising: Offer advertisers the option for contextual ads (e.g., showing PC hardware ads on a PC gaming news site). Actively market this as a privacy-friendly alternative that doesn't require tracking.

· Develop Value-Exchange for Consent: Instead of framing rejection as a loss, frame acceptance as a conscious choice to support the site. Consider a model where users who log in or subscribe get an ad-light/no-tracking experience, while anonymous users see contextual ads.

· Invest in Direct Revenue Streams: Continue to build on subscriptions, memberships, and donations to gradually reduce reliance on the most invasive forms of advertising.

---

B. For Regulators and Industry Bodies

The current problems are systemic and require top-down solutions to create a fair playing field.

1. Enforce Stricter UI Standards and Ban Dark Patterns:

· Mandatory "Reject All" Button: Legally require that "Reject All" is as equally prominent and easy as "Accept All." The European Data Protection Board (EDPB) has already issued guidelines in this direction; this needs robust enforcement.

· Define "Nudging": Provide clear examples of prohibited language, such as framing the rejection of tracking in a negative light (e.g., "see less relevant ads"). Consent must be presented in a neutral manner.

2. Promote Technological Shifts:

· Mandate Support for Global Privacy Control (GPC): Legally recognize GPC—a browser-level signal that communicates a user's desire to opt-out of data sales—as a valid expression of non-consent, just like a "Reject All" button.

· Encourage the Phase-Out of Third-Party Cookies: Support the industry's shift towards privacy-preserving technologies (like Google's Privacy Sandbox proposals, with careful scrutiny) that aim to provide utility for advertisers without exposing individual user data to hundreds of companies.

3. Clarify the Legality of Current Practices:

· Rule on Real-Time Bidding (RTB): Issue definitive rulings on whether the mass broadcasting of user data in RTB systems, even with consent, is compliant with data minimization and purpose limitation principles. This would force the industry to adapt.

---

C. For Users / The Public

While the burden should not be on the user, there are ways to navigate this landscape more effectively.

1. Use the "Manage Preferences" Link. Always.

· It's the single most powerful action. Instead of reflexively clicking "Accept," take the extra few seconds to click "Manage Preferences" or "Options" and disable everything that isn't "Essential." You will often find you can disable 90% of the tracking with a few clicks.

2. Leverage Browser and Tool-Level Solutions:

· Install a Privacy-Focused Browser: Browsers like Brave or Firefox Focus are designed to block trackers by default.

· Use Browser Extensions: Extensions like uBlock Origin (ad/tracker blocker), Privacy Badger (blocks spying ads and invisible trackers), and ClearURLs can automatically handle a large portion of this problem.

· Enable Global Privacy Control (GPC): Check your browser's settings or use an extension to enable GPC to broadcast your privacy preference automatically.

3. Support Publishers Directly:

· Subscribe or Donate: If you value a site like Rock Paper Shotgun, the most effective way to free it from the ad-tech dependency is to become a paying subscriber or member, if that option is available.

Summary: A Shift in Philosophy

The ultimate improvement requires a fundamental shift from a model of "harvesting consent through manipulation" to one of "earning trust through transparency and choice."

The ideal future state would be:

· For Publishers: A default private experience, with clear value propositions for why data collection might benefit the user (e.g., better recommendations) or support the site, presented with neutral, ethical design.

· For the Ecosystem: A move away from mass surveillance and profiling towards contextual advertising and user-supported models.

By implementing these suggestions, a publisher like Rock Paper Shotgun could distinguish itself as a leader in ethical digital publishing, building a more loyal and trusting audience in the long run.

# data[].attributes.body
1. Clarify Data Use: Explain exactly what data is used for each purpose.

2. Enhance Cookie Banner: Add clear “Accept/Reject” buttons and detailed cookie categories.

3. Show Transfer Safeguards: Publish how Hilton protects data moved outside the UK/EU.

4. List Retention Periods: Specify how long each data type is stored.

5. Increase Transparency: Identify key third parties and anonymisation steps.

6. User Control: Create a privacy dashboard for managing personal data and consent.

7. Staff Training: Ensure all employees understand GDPR duties.

# data[].attributes.body
Key Elements:

- Rights listed

- Data subject request/contact channel

- Lawful bases/legal grounds

- Automated decision-making/profiling

- Data categories & third parties

Assessment:

- Clear - High level purposes and categories of data are describe in readable language.

- Unclear - granular lawful-basis mapping, detailed retention schedules, technical details on profiling/automated decisions

Areas of Concern:

- Consent vs. legitimate interest for tracking/personalisation ads

- Off-site tracking and third-party cookies/tags

- Lack of detailed, itemised retention periods

- Practical friction in exercising rights

# data[].attributes.body
Data Collected: Personal data (name, contact, payment, ID), technical data (IP, device info), and behavioral data (usage, preferences).

Use of Data: For reservations, marketing, analytics, personalization, and security.

Sharing: With Hilton subsidiaries, service providers, advertisers, and third-party partners.

Transparency Issues:

Some sharing and anonymisation practices are not fully explained.

Retention timelines and optional vs required data are unclear.

# data[].attributes.body
Overall Assessment Summary

Practice Assessment Risk/Implication

Scale (902 Partners) Excessive & Unmanageable Loss of data control, increased security risk, and user fatigue.

Data Type (Identifiers) Designed for Tracking Enables persistent surveillance and profiling across the web, not just on RPS.

Primary Purpose (Ad Targeting) Commercial Exploitation The user's behavioral data is the product being sold. The service is the bait.

Method (Real-Time Bidding) High-Risk Industry Standard Involves broadcasting user data to a unpredictable number of entities in a poorly controlled environment.

Conclusion:

The data collection practice disclosed by Rock Paper Shotgun is a textbook example of the pervasive, surveillance-based business model that dominates the modern internet. It is:

1. Extensive: It goes far beyond what is necessary for the website's function.

2. Opaque in Practice: While transparent in stating the number of partners, it is impossible for a user to know who they are or what they do.

3. Profiling-Focused: The goal is to build a detailed behavioral model of the user for financial gain.

4. Inherently Risky: Sharing data with such a vast network creates significant privacy and security vulnerabilities.

While this practice is legally compliant on the surface due to the presence of a consent banner, its scale and nature raise serious questions about whether the consent obtained is truly informed, free, and specific as required by laws like the GDPR. It represents a fundamental power imbalance where the user's choice is between accepting industrial-scale tracking or facing a degraded experience.

# data[].attributes.body
Add Explicit Withdrawal Option:
Include clear instructions on how users can withdraw or modify their cookie consent at any time after initial selection.

Detailed Information on Third Parties:
Specify if third-party cookies are used, identify these third parties, and explain their role in data processing.

Cookie Duration and Data Retention:
Include information on how long cookies remain on users' devices and how long data collected is stored.

Provide Link to Full Privacy Policy:
Add a visible link to the full privacy policy for users seeking more detailed information.

Enhance Consent Logging:
Implement systems to log and store user consent to demonstrate compliance during audits.

Consider Cookie Banner Design:
Make sure the cookie consent interface prevents pre-ticked boxes and does not assume consent if users don’t interact, adhering to GDPR “freely given” consent standards.

Transparency on Profiling Impact:
Clarify if marketing cookies influence decision-making or have legal/other significant effects on users to ensure compliance with GDPR profiling rules.

# data[].attributes.body
Consent Mechanism: Hilton provides a cookie banner and “Manage Cookies” options on its website.

Opt-out Option: Users can manage or reject cookies, but the clarity and visibility of the “Reject All” option vary by region.

Compliance: Likely GDPR-compliant, but the banner’s clarity and purpose explanations could be improved.

# data[].attributes.body
GDPR Rights: Hilton includes rights such as access, correction, deletion, data portability, objection, and consent withdrawal.

Transparency: The privacy statement explains how Hilton collects, uses, and shares data, but some details (e.g. specific purposes or retention times) are general.

Concerns:

Limited detail on which data is used for which purpose.

Unclear retention periods.

Vague on international transfer safeguards and legitimate interest balance.

# data[].attributes.body
Data Minimization:
The cookies collect information necessary for site operation (technical), preferences, analytics (anonymous), and marketing (browser/device identification without directly storing personal info).

Anonymization:
Statistical cookies collect aggregated and anonymous data, which is positive from a privacy standpoint.

Profiling & Personal Data:
Marketing cookies create profiles based on device/browser behavior but claim not to store directly personal information, which is important under GDPR. However, profiling can still be subject to GDPR rules if it impacts the user.

Consent & Purpose Limitation:
Users are informed about purposes before consent. The purposes align with typical use cases.

Potential Risks:
Profiling without explicit consent or without offering an opt-out might conflict with GDPR’s requirements for marketing cookies.

# data[].attributes.body
H&M collects personal data through account registration, purchases, newsletter sign-ups, cookies, and customer service interactions. The data includes contact details, purchase history, payment information, device data, and browsing behaviour. It is used to process orders, personalise marketing, improve services, and analyse website performance. H&M shares data with service providers, logistics partners, and marketing platforms, stating that transfers outside the EEA are safeguarded. Some data is aggregated or anonymised for analytics. Overall, data collection is clearly explained and mostly transparent, though details on third-party sharing and anonymisation could be clearer for full GDPR transparency.

# data[].attributes.body
1. Information Collection:

* Personal Information: Name, address, contact info, payment data, preferences.

* Automatic Data: IP addresses, browsing activity, device info, location data via cookies and technologies.

* Third-Party Information: Data from partners, travel agencies, and other third parties.

2. How They Use Your Data:

* Booking & Reservations: To manage bookings, reservations, and customer support.

* Personalization: Customizes experience (room preferences, offers, targeted ads).

* Marketing & Communication: Sends promotional emails/messages based on preferences/behavior.

* Business Operations: Research, analytics, and internal business purposes.

3. Data Sharing:

* Service Providers: Shares data with vendors for services like payment, marketing, and support.

* Affiliated Brands: Shares data for cross-promotion or service improvements.

* Legal Requirements: Discloses data if required by law or for safety/protection.

4. Data Security and Retention:

* Security Measures: Uses encryption and access controls to protect data.

* Retention: Keeps data as long as necessary for business, legal, or regulatory purposes.

5. Your Rights:

* Opt-out: Option to opt-out of marketing and manage cookie preferences.

* Data Rights: Right to access, correct, delete, or restrict use of personal data depending on jurisdiction.

6. Cookies and Tracking:

* Cookies: Uses cookies for functionality, behavior tracking, and personalized ads.

* Preferences: You can manage cookie settings through browser settings.

7. Children's Privacy:

* Under 13: Does not knowingly collect data from children under 13 (except as permitted by law).

8. International Transfers:

* Data Transfers: Data may be transferred outside your home country, subject to different privacy laws.

9. Changes to the Privacy Statement:

* Updates: Hilton may update its privacy policy and will post changes on their website.

# data[].attributes.body
Clarity & Transparency:
The cookie categories are clearly defined and explained in plain language, which helps users understand what types of cookies are used and their purposes.

User Control:
Users are given options via checkboxes to manage their cookie preferences, which is GDPR-compliant as it requires explicit consent (except for strictly necessary cookies).

Mandatory vs Optional Cookies:
The explanation about technical cookies being strictly necessary and their blocking potentially breaking site functionality aligns with GDPR guidelines on necessary cookies.

Granularity:
The separation of cookie types (technical, preference, statistics, marketing) provides granular control, allowing users to opt-in/out of specific cookie categories.

Consent Mechanism:
The text mentions the ability to “set your preferences using the check box provided,” indicating an active opt-in method, which is good practice.

Possible gaps:

No mention of a mechanism for users to withdraw or change consent after the initial choice.

No explicit mention of cookie duration or data retention.

No details about third-party cookies or whether data is shared with external partners.

# data[].attributes.body
website uses cookies to enhance your browsing experience and provide you with personalized services. We use different types of cookies, including technical cookies necessary for website functionality, preference cookies for personalization, statistics cookies for analyzing website performance, and marketing cookies for targeted advertising.

You have control over your cookie preferences and can choose which categories to accept or decline using the checkboxes provided. Please note that blocking certain cookies may affect the performance or functionality of the website.

All collected data is processed in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws. We ensure that your data is anonymized where possible and never used to identify you personally without your explicit consent.

For more details, please refer to our full Privacy Policy.

# data[].attributes.body
Evaluating the cookie consent practice, as exemplified by the Rock Paper Shotgun (RPS) passage and widely used across the web, requires looking at it from multiple angles: legal compliance, user experience, business reality, and ethical design.

Here is a structured evaluation:

1. The Theory: A Step Towards Empowerment (The Pros)

In a pre-GDPR world, tracking was often silent and invisible. The current practice of cookie consents is theoretically founded on several positive principles:

· Transparency: It forces websites to be upfront about their data collection practices. Users are no longer completely in the dark about who is tracking them and for what purpose.

· Choice and Control: The core idea is to give users a choice. Laws like the GDPR established the principle that consent must be "freely given, specific, informed, and unambiguous." The "Manage Preferences" option is the embodiment of this, allowing granular control.

· Accountability: It places legal responsibility on publishers to obtain and manage consent, creating a paper trail for regulators.

2. The Reality: Pervasive Flaws and Manipulation (The Cons)

In practice, the implementation of cookie consent has become deeply problematic and often undermines its own principles.

· Dark Patterns and Choice Architecture:

· Nudging to Accept: As seen in the RPS text, the interface is designed to make acceptance easiest. The affirmative "I Accept" button is prominent, while the path to rejection is often hidden behind a "Manage Preferences" or "More Options" link.

· Framing Rejection as a Loss: Warning users that they will see "less relevant" ads (as RPS does) is a psychological nudge that leverages loss aversion to steer behavior toward acceptance.

· False Equivalency: The choice is often presented as "Accept" or "Customize," rather than a simple, equally prominent "Reject All" button. This makes rejection a multi-step, cumbersome process.

· Consent Fatigue and Banner Blindness:

· The constant barrage of complex pop-ups on every website leads to user exhaustion. Faced with legalese and an overwhelming number of "partners" (902 in RPS's case), most users simply click "Accept" to make the banner disappear and access the content. This makes the consent uninformed and reflexive, voiding its legal spirit.

· The Illusion of Control:

· The "Manage Preferences" menu is often complex, confusing, and filled with marketing jargon. For a non-technical user, toggling settings for hundreds of entities is an impractical task. This creates an illusion of control rather than genuine, understandable choice.

· The "Cookie Wall" Problem:

· Some sites implement a "take-it-or-leave-it" approach, blocking access to content entirely if the user does not consent to tracking. This contradicts the GDPR's requirement that consent be "freely given," as it is a condition for service.

3. The Business and Legal Context

· Economic Model: For many publishers like RPS, personalized advertising is the primary revenue source that allows them to offer free content. The consent banner is the gatekeeper to this essential revenue stream. Their design incentives are misaligned with pure user privacy; they need users to say "yes."

· Legal Compliance (on the surface): Most of these banners are built by Consent Management Platforms (CMPs) that are designed to meet the bare minimum legal requirements. They provide the necessary information and record consent, but the manner in which consent is obtained often pushes the boundaries of what is ethical and, in some cases, legal.

Overall Evaluation and Conclusion

The current state of cookie consent practices is a well-intentioned but fundamentally broken system.

It has successfully made tracking visible, which is a crucial first step. However, it has largely failed in its goal of giving users meaningful and autonomous control over their data.

· For the User: The experience is one of annoyance, manipulation, and a sense of powerlessness. The choice is rarely a fair one.

· For the Business: It's a necessary compliance hurdle that often damages user trust and creates friction, all while being a constant legal risk.

· For Privacy: It has become a "checkbox" exercise that legitimizes widespread surveillance capitalism rather than challenging it. The sheer scale of data sharing (902 partners) revealed in these banners demonstrates how normalized mass tracking has become.

The Future:

The failure of this model is leading to calls for more robust solutions,such as:

· Global Privacy Control (GPC): A browser-level signal that automatically communicates a user's desire to opt-out of data sales, making granular consents less necessary.

· Shift in Business Models: More publishers may be forced to explore alternatives like subscriptions, micropayments, or contextual advertising (which targets the content of the page, not the user) to reduce their reliance on invasive tracking.

· Stricter Enforcement: Regulators may begin to crack down on deceptive designs and "dark patterns" in consent banners, forcing a more user-friendly standard.

In summary, while the RPS banner and its countless cousins are a product of privacy laws, they have been co-opted by business interests. They represent a flawed compromise that highlights the tension between user privacy and the ad-supported web, but ultimately places the burden of a complex systemic problem on the individual user.

# data[].attributes.body
H&M’s cookie banner offers “Accept all” and “Only required cookies” options, with a link to “Cookie Settings” where users can easily reject or adjust preferences. It explains cookie categories (necessary, performance, functional, marketing) and states that non-essential cookies require consent, which can be withdrawn anytime. The mechanism is broadly GDPR-compliant as it provides clear choices, transparent purposes, and an easy opt-out process, though consistency across regional sites and equal visibility of consent options should be ensured.

# data[].attributes.headline
General Suggestions for Improving Data Collection Practices

# data[].attributes.subject
General Suggestions for Improving Data Collection Practices

# data[].attributes.body
Suggestions for Improving Data Collection Practices

1.

Transparency & Clarity

Clearly explain what data is collected, why, and how it will be used.

Use plain language instead of long legal jargon so users can easily understand.

2.

Granular Consent

Allow users to choose which types of cookies or data collection they consent to, instead of an all-or-nothing approach.

Make it easy to update or withdraw consent at any time.

3.

Minimization of Data Collection

Only collect data that is strictly necessary for service delivery.

Avoid excessive tracking for marketing or analytics purposes without clear user benefit.

4.

Stronger Data Protection

Implement robust encryption, access controls, and regular audits to prevent unauthorized access.

Regularly review and delete outdated or unnecessary data to reduce risk exposure.

5.

User Control & Rights

Provide simple ways for users to access, correct, or delete their personal data.

Offer opt-out options for marketing and third-party sharing without impacting essential services.

6.

Third-Party Management

Ensure third-party vendors comply with strict privacy and security standards.

Clearly disclose data sharing practices with third parties.

7.

Regular Privacy Updates

Keep the privacy policy and cookie notices up-to-date with regulatory changes.

Communicate changes to users proactively and in plain language.

8.

Education & Awareness

Provide users with short guides or FAQs about how their data is collected, stored, and used.

Encourage users to actively manage privacy settings and cookies.

# data[].attributes.body
1. Personal Information:

Bentley collects personal data such as name, contact details, vehicle information (e.g., VIN), and financial data during interactions with its websites, mobile applications, and services  .

2. Vehicle Data:

For vehicles equipped with Bentley Connected Car Services, data including vehicle diagnostics, location, and usage patterns may be collected to provide services like navigation assistance and remote diagnostics  .

3. Online Interactions:

When using Bentley’s online services, data such as IP addresses, browser types, and usage patterns are collected to enhance user experience and ensure security  .

# data[].attributes.body
This is an excellent example of a modern, GDPR-style privacy notice that is designed to obtain user consent for data tracking and advertising. Here is a detailed analysis of its components, implications, and underlying strategies.

1. Breakdown of Key Components

· The Actors:

· "We": Rock Paper Shotgun (RPS).

· "902 partners": A strikingly high and specific number that includes ad networks, data brokers, analytics companies, and social media platforms. This number is intentionally disclosed to be transparent but also to signal the complexity of the modern ad-tech ecosystem.

· The Action:

· "Store and/or access information on a device": This is the technical definition of using cookies, localStorage, and other tracking technologies.

· "Process data": This encompasses collecting, analyzing, combining, and selling the data they gather.

· The Data:

· "Browsing data": Your history on RPS and potentially other sites.

· "Unique identifiers": Such as cookie IDs, device IDs, or other tokens that can be used to create a profile of you over time and across different websites.

· The Purpose (The "Value Proposition"):

The notice lists the core reasons for processing data:

· Personalised advertising and content: Tailoring ads and even editorial content to your perceived interests.

· Advertising and content measurement: Analyzing how well ads and content perform (e.g., click-through rates).

· Audience research: Understanding the broader demographics and interests of their readership.

· Services development: Using data to improve their website and services.

· The User's Control & The "Nudge":

· The Default Action: The path of least resistance is to click "I Accept," which enables all tracking.

· The Consequence of Saying No: It explicitly states a downside: "some content and ads you see may not be as relevant to you." This is a common "nudge" technique to encourage acceptance by framing rejection as a loss of personalization.

· Granular Control: It informs you that you can "Manage Preferences" later, which is a legal requirement under laws like the GDPR. This allows users to give consent for some purposes but not others.

2. Strategic Analysis & Implications

· Compliance with GDPR/CPRA: The passage is clearly designed to comply with strict privacy regulations like the EU's General Data Protection Regulation (GDPR) and the California Privacy Rights Act (CPRA). It provides notice, seeks consent for specific purposes, and outlines the user's right to withdraw consent.

· The "Privacy Paradox" in Action: It perfectly illustrates the tension between user privacy and a publisher's business model. RPS likely relies on revenue from personalized advertising to fund its free content. This consent mechanism is the gatekeeper for that revenue stream.

· Framing and Choice Architecture:

· "I Accept" is a powerful, affirmative button that makes consent feel like the correct, default action.

· The warning about "less relevant" ads uses loss aversion—people are more motivated to avoid a loss than to acquire an equivalent gain. They are framing the loss of personalization as a negative outcome to steer you toward accepting.

· The "Manage Preferences" link is present but less prominent, requiring an extra step from the user. This is a classic example of making the desired business outcome (consent) easier than the alternative (granular control or rejection).

· Transparency vs. Overload: Mentioning "902 partners" is transparent, but it's also a number so large that it can feel abstract and overwhelming to the average user. This can sometimes lead to "consent fatigue," where users just click "accept" to make the pop-up go away because managing preferences with 902 entities seems impossible.

3. What This Means for You (The User)

· Consent is Binary (at first glance): The initial choice is presented as "Accept" or manage preferences. Clicking "I Accept" gives permission for RPS and all 902 partners to track you for the listed purposes.

· Your Data is a Commodity: Your browsing data and identifiers are being used to create a profile that is valuable to advertisers. RPS and its partners are acting as intermediaries in this data marketplace.

· Control is Possible, but Requires Effort: You have the right to refuse or customize your consent. However, you must take the proactive step of clicking "Manage Preferences," which will likely lead to a more complex menu where you can toggle different categories of data processing on or off.

· The Experience May Change: If you disable tracking, you will likely see more generic, repetitive, and potentially irrelevant advertisements. The site's functionality should remain intact, but some personalized content recommendations might not work.

Summary

This passage from Rock Paper Shotgun's privacy statement is a sophisticated, legally-compliant tool that serves a dual purpose:

1. To Inform: It clearly tells you that you will be tracked by RPS and a vast network of partners for advertising and content personalization.

2. To Nudge: It is designed to guide you toward giving broad consent by making it the easiest option and by highlighting a perceived downside to refusing.

It is a microcosm of the modern internet's fundamental bargain: free content in exchange for the user's data and attention, now mediated by legally-mandated consent interfaces.

# data[].attributes.body
H&M’s privacy statement meets core GDPR requirements by outlining data controllers, legal bases, user rights, and international transfers. However, it lacks clarity on which legal bases apply to specific activities, uses vague retention terms, and provides limited detail on profiling, automated decisions, and data transfers abroad. The use of broad language like “we may process” reduces transparency. Overall, it is largely compliant but could better explain how and why data is processed to fully meet GDPR transparency standards !

# data[].attributes.body
1.

Cookie Consent Banner

Upon visiting Nike’s website, users are presented with a cookie consent banner. This banner informs users about the use of cookies and provides options to manage their preferences. Users can typically choose to:

Accept All Cookies: Grants permission for all cookie categories.

Customize Settings: Allows users to select specific cookie preferences.

Reject Non-Essential Cookies: Opts out of non-essential cookies, which may affect certain website functionalities.

The banner ensures that users are aware of the cookies in use and can make informed choices about their data privacy.

2.

Cookie Categories

Nike’s cookie policy outlines various categories of cookies used on their website:

Essential Cookies: Necessary for the basic functionality of the website, such as user authentication and security.

Performance Cookies: Collect information about how users interact with the website, helping Nike improve site performance.

Functional Cookies: Remember user preferences and settings to enhance the user experience.

Advertising Cookies: Used to deliver personalized advertisements based on user behavior and interests.

Users can manage their preferences for each category through the cookie settings interface.

# data[].attributes.body
1.

YouTube Privacy Statement Summary

YouTube, as part of Google, collects and processes personal data to provide, maintain, and improve its services. Key points include:

Data Collected:

Account information (name, email, phone number)

Usage data (videos watched, search queries, watch time)

Device and log information (IP address, device type, browser)

Location data (if location services are enabled)

Cookies and similar tracking technologies

Interactions with ads, videos, and content

Purpose of Data Use:

Personalizing content and recommendations

Improving service functionality

Targeted advertising

Analytics and research

Fraud detection and legal compliance

Sharing of Data:

With Google and its affiliates

With content creators (for analytics)

With advertisers (aggregated or anonymized)

Legal or safety requirements

User Rights:

Access, update, or delete your data

Control ad personalization

Manage activity controls and location settings

# data[].attributes.body
When first opening Amazon, the cookie banner appears:

Explicit consent before setting non-essential cookies such as tracking or advertising cookies.

Allows the user to 'Accept all', 'Reject all' or 'Manage Preferences'

Provides the user with a Cookies Preferences Page where users can later adjust their choices.

# data[].attributes.body
Key Findings:
The privacy statement provides extensive detail on data collection and usage but lacks core GDPR requirements, such as specifying the legal basis for processing, retention periods, data subject rights, and clear identification of the data controller.

Cookie Consent Findings:
The policy mentions cookies and tracking technologies but does not explain how consent is obtained or how users can opt out, falling short of GDPR and ePrivacy standards for clear, informed, and freely given consent.

Data Collection Findings:
The policy clearly outlines the categories and sources of personal data collected, including online, offline, and third-party data, showing strong transparency in scope but limited explanation of lawful processing purposes and data minimization.

Suggestions for Improvement:
Clearly identify the data controller and lawful bases for each processing activity, include retention periods, outline users’ GDPR rights and contact methods, and implement a compliant cookie consent mechanism that allows users to easily opt in, opt out, and withdraw consent.

# data[].attributes.body
Amazon's privacy notice contains information for the following:

The data they collect (like account info, device identifiers, purchase history, etc.)

Why they collect it (to deliver orders, personalize recommendations, prevent fraud, etc.)

Who they share it with (subsidiaries, delivery partners, advertisers — always with a lawful basis)

User rights under GDPR (access, deletion, portability, objection, restriction)

This privacy notice is used to collect and process personal data through Amazon websites. They state that they know the user cares about how their information is used and shared and that it will be used carefully and sensibly.

# data[].attributes.body
Transparency about Purposes & Legal Basis

The Dutch data protection authority found that Netflix’s earlier privacy statement did not clearly specify for each purpose what legal basis (consent, legitimate interest, performance of contract) they were using. Stibbe+3Autoriteit Persoonsgegevens+3GDPR EU+3

After the regulatory decision, Netflix updated its privacy statement to try to improve clarity. Autoriteit Persoonsgegevens

Retention Periods

Netflix often uses generic language like “as long as necessary,” “required or permitted by applicable laws,” etc. But they do not always provide specific retention periods by data category or explain the criteria used to determine retention durations. Netflix Help Center+3noyb.eu+3Autoriteit Persoonsgegevens+3

The NOYB complaint showed that Netflix kept IP addresses older than 2 years without giving justification. noyb.eu

Which Third Parties Receive Data and Why

One of the issues found by the Dutch DPA was that Netflix did not clearly explain which personal data is shared with which parties, and for what purposes. This affects transparency under GDPR (Articles 13 & 15). Autoriteit Persoonsgegevens+2GDPR EU+2

International Data Transfers Safeguards

The statement mentions international transfers and that safeguards are in place, but earlier policy versions did not clearly explain how exactly Netflix ensures data protection when transferring outside the EU (e.g. what specific mechanisms/agreements or clauses are used). This was one of the DPA’s concerns. Autoriteit Persoonsgegevens+1

Granularity & Clarity

Some statements are very general: “we retain as required,” “for billing or records” etc. GDPR demands that data controllers, where possible, specify retention periods or at least provide criteria for setting them. noyb.eu+1

Some users/external bodies found that when making access requests, Netflix’s responses were incomplete or unclear regarding data types, sources, or retention.

# data[].attributes.body
Netflix's cookie consent was found by Dutch regulators in late 2024 to be non-compliant with GDPR due to a lack of transparency and clear affirmative consent, leading to a significant fine.

Lack of Transparency:

Netflix did not adequately explain the purposes for processing customer data, including for its recommendation engine or audience analysis.

They failed to explicitly list the third parties who received customer data.

Failure to Provide Full Data:

When users requested access to their data under GDPR, Netflix provided incomplete and ambiguous responses.

The Dutch Data Protection Authority (AP) fined Netflix €4.7 million for these infringements, serving as a warning to other companies.

# data[].attributes.body
Cookie types & categories
BMW uses multiple categories of cookies:

Strictly necessary / essential cookies: Needed for core functionality (login sessions, site navigation, configurators, switching between http/https, storing consent / cookie banner status). These are first‑party cookies. BMW Group Careers+3BMW Shop+3discover.bmw.co.uk+3

Performance / statistics / analytics cookies: Tracking how users engage with the site, which pages are popular, etc. Typically aggregated and anonymised. Used to improve site performance. BMW Shop+2discover.bmw.co.uk+2

Functional cookies: Remember user preferences (language, location, choices in site features, video embedding etc.), providing personalization. discover.bmw.co.uk+2bmw-public-charging.com+2

Marketing / advertising / targeting cookies: Used for retargeting, delivering ads relevant to user interests, limiting how many times a user sees an ad, measuring effectiveness. These are often third‑party cookies. BMW Shop+2bmw.ca+2

First‑party vs. third‑party cookies

Many of the essential, functional and performance cookies are first‑party (set by BMW’s domain). BMW Shop+2b2b.bmw.com+2

Third‑party cookies are used for advertising, social media content, tracking, etc. BMW Shop+2bmw.ca+2

Consent & user control

BMW gives users the ability to accept or reject (or toggle) cookies depending on category. Certain categories (non‑essential ones) are subject to consent. BMW Shop+2discover.bmw.co.uk+2

Strictly necessary cookies cannot be turned off via the site's cookie‑settings in many of their policies. BMW Shop+1

Users are often told that disabling certain categories may reduce functionality. bmw-public-charging.com+1

# data[].attributes.body
Gaps / Notable Issues (Based on Regulator Actions & Public Reports)

In France, CNIL fined Amazon for placing certain cookies automatically for visitors arriving via third-party ads before obtaining consent. This is a violation: non-essential cookies were being set without proper prior consent.

There’s been criticism (and regulatory guidance) around cookie banners that are not clear enough, or that make rejecting non-essential cookies very difficult. Things like “pre-ticked opt-in boxes,” or only having an “accept all” option, or hiding the “reject” option, are often flagged as non-compliant.

# data[].attributes.body
Amazon has a Cookie Preferences page (“Customise third-party advertising cookies”) for UK users. This suggests they provide at least some granular consent / opt-out for advertising cookies.

Amazon Pay’s help pages acknowledge cookies, explain how browser settings can be used to disable cookies, etc.

Amazon also uses the IAB TCF (Transparency & Consent Framework) for certain third-party partners; presumably that gives some structure to vendor listing / purposes when consenting. This is visible in the “details” section of their cookie partners settings

# data[].attributes.body
Areas for Improvement / Clarification

1. Lacks Specific Legal Basis for Processing

Why it matters: Under GDPR Article 6, companies must specify the legal grounds for processing data (e.g. consent, legitimate interests, contractual necessity).

Improvement: The policy should state why the data is collected, e.g. “We process your data based on legitimate interest when you contact us directly, or contractual necessity when you purchase a product.”

2. No Reference to User Rights

Why it matters: GDPR requires informing users about their rights: access, rectification, erasure, restriction, objection, and data portability.

Improvement: Include a section like: “You have the right to access, correct, or delete your data. Learn more about your rights here [link].”

3. No Mention of Data Retention Periods

Why it matters: Users must know how long their data is retained.

Improvement: State how long personal data will be stored and the criteria used to determine retention.

4. Unclear Reference to International Transfers

Why it matters: BMW AG is based in Germany, and some data may be transferred internationally (especially outside the UK). Users must be told if their data leaves the UK/EU.

Improvement: Add a line like: “Some data may be transferred to BMW AG or other entities outside the UK. We ensure appropriate safeguards are in place.”

5. Lacks Contact Details or Link to Full Policy

Why it matters: Users should easily be able to find out more or ask questions.

Improvement: Add a link or contact like: “For more details or to contact our Data Protection Officer, please visit [URL] or email [DPO contact].”

# data[].attributes.body
Trust-Oriented Language

Example: “BMW Group UK understands that its use of your information requires your trust.”

Analysis: This opening sets a positive, user-centric tone. It acknowledges the importance of trust, which is good practice for building customer confidence.

Commitment to Data Privacy

Example: “Committed to the highest standards of data privacy...”

Analysis: This assures users that the company recognises and adheres to high standards, which aligns with GDPR and general data protection principles.

Clear and Specific Data Collection Methods

Example: Lists specific ways data is collected, such as direct contact, purchases, vehicle servicing, finance applications, etc.

Analysis: Transparency in data collection methods is a key GDPR requirement. BMW’s approach here is comprehensive and clear.

Mention of Third-Party Data Sources

Example: “Transferred from authorised centres... social media sites... BMW Group legal entities or business partners...”

Analysis: Acknowledging third-party data sources is important under GDPR to inform users of indirect data collection.

Consent on Behalf of Others

Example: “If you give information on behalf of someone else…”

Analysis: This shows attention to lawful processing — ensuring data is only shared with proper consent, which is often overlooked in basic privacy statements.

# data[].attributes.body
What they collect — account details, billing/shipping, purchase and viewing history, device identifiers, geolocation, voice recordings and transcripts (Alexa/Fire TV), communications, support logs, and advertiser/behavioural signals.

Purposes — to provide services (orders, streaming), personalise recommendations, improve products (machine learning), detect fraud, and targeted advertising.

Lawful bases claimed — contract performance (for orders/subscriptions), legitimate interests (recommendations, fraud prevention, product improvement), and consent where needed (marketing/ads in some contexts). The Notice mixes bases by purpose.

Transfers — Amazon confirms international transfers and points to the EU/US Data Privacy Framework material and standard contractual clauses as transfer mechanisms for cross-border processing.

User controls — in-account “Request your data” tools, ad preferences/cookie controls, Alexa voice-data review and deletion.

# data[].attributes.body
The netflix privacy statement explains how Netflix collects, uses, shares, and protects your personal information when you use its services. The policy also describes who Netflix may share your data with (like service providers or legal authorities), how long it keeps your information, and the rights you have to access, correct, or delete your data under privacy laws such as the GDPR

# data[].attributes.body
What You Can See & Control (Your Rights)

Because of GDPR / UK GDPR, you generally have the following rights and visibility:

Access: You can request what data Amazon holds about you (account info, viewing history, etc.).

Rectification: You can ask Amazon to correct inaccurate or incomplete data.

Erasure (“right to be forgotten”): Under certain conditions you can have your data deleted.

Restriction of Processing: You may request that Amazon limit how certain data is processed.

Data Portability: You can ask for your data in a portable format in some cases.

Object to Processing: For certain uses (e.g. marketing, profiling), you can object.

Consent / Withdrawal: Where data processing depends on your consent, you can withdraw that consent.

Transparency: Amazon has to publish its privacy notice, disclose the categories of data collected, purposes of processing, with whom they share the data, how long it’s kept, etc.

What Amazon Shares / Visibility to Others

Amazon may share anonymous or aggregated data with content providers (studios etc.) to report on viewership without revealing your identity.

They may share data with service providers (e.g. for streaming infrastructure, analytics, billing) under contractual data protection obligations.

For advertising: data or identifiers may be used to deliver personalized ads; and some data may be shared with advertising partners, subject to your settings / consent.

Legal / regulatory / safety-related sharing (law enforcement, fraud prevention, etc.) as required.

# data[].attributes.body
Data Sharing / Third Parties

Amazon shares some user data with third parties (e.g. for advertising, analytics).

It is often not fully clear which third-party entities get what data, under what terms, or how much control over their future usage is enforced.

Use for Advertising / Profiling

Amazon uses interest-based advertising. This means Amazon builds profiles of behaviour — what you watch, buy, search — in order to display personalised ads.

It’s not always fully clear to a non-expert user how to opt out or limit this, or what the consequences are for having it enabled.

Data Retention & Deletion

When it comes to how long Amazon stores data (especially usage data, voice recordings, viewing history, etc.), or what happens after account cancellation, the policies are not always fully specific.

Also, while some types of data deletion are possible, some data may be retained for legal / business purposes.

# data[].attributes.body
Data collected: Identity, contact, travel details, payment info, preferences, and in some cases, sensitive data (e.g. health, religion, biometric).

Purpose: To process bookings, ensure safety, personalise experiences, and send marketing communications.

Legal basis: Contractual necessity, consent, and a legal obligation.

User rights: Access, correct, delete data, and withdraw consent at any time.

Security: Claims strong technical and organisational safeguards.

# data[].attributes.body
The “Accept” option is implied (e.g., continuing to browse or clicking Accept All on some regional versions). Ensure that cookies for marketing and analytics do not activate before consent is granted.

# data[].attributes.body
Minor follow-up: If you were to test the site, check that no marketing/analytics cookies fire before consent — textually compliant, but needs technical confirmation.

# data[].attributes.body
Zara should provide clearer details on data retention periods, third-party sharing, and profiling practices.
They could enhance transparency by offering simplified, layered privacy notices and more granular consent options.
Implementing stronger cookie controls and easier data-rights management would further boost GDPR compliance and user trust.

# data[].attributes.body
Glossier's privacy policy outlines the collection of personal data through various channels, including their website, customer support, retail locations, and promotional activities. They specify the types of personal data collected- contact information, purchase history, and usage data. The policy also details the purposes for data processing, including order fulfillment, marketing, and analytics. Glossier provides users with rights to access, correct, and delete their personal data, aligning with GDPR requirements.

# data[].attributes.body
The banner lacks a first-layer “Reject All” button with equal prominence to “Accept all.”

This makes consent not perfectly “freely given”, as per EDPB and ICO guidance.

Verification of technical behaviour (whether analytics/marketing cookies load before consent) would be necessary to confirm compliance in practice.

# data[].attributes.body
Selfridges.com provides an informative and user-friendly cookie banner explaining the purposes of cookies and linking to a detailed Cookie Policy. Users can choose “functional cookies only” or “Accept all,” with further settings available in the preference centre. While transparent, the banner could be strengthened by adding a clear “Reject All” option on the first layer to fully align with GDPR and ePrivacy guidance.

# data[].attributes.body
Zara collects customer data through purchases, online accounts, apps, and cookies to manage orders, personalize services, and support marketing.
While it outlines lawful bases and user rights under GDPR, details on data sharing, retention, and profiling are sometimes vague.
Overall, Zara’s data collection is compliant in intent but could be more transparent and specific about how and why data is used.

# data[].attributes.body
Partially — “Accept all” is visible, but “Reject all” is not shown on the first layer. Users can opt for “functional cookies only,” which functions as a partial opt-out.

A fully compliant design under GDPR/ePrivacy should offer a Reject All button of equal prominence.

# data[].attributes.body
YouTube collects data through a combination of user activity, cookies, cross-platform tracking, and AI analysis. This allows it to deliver personalised recommendations and advertising but raises privacy concerns about transparency, informed consent, and data minimisation under GDPR.

# data[].attributes.body
Zara’s cookie policy states that non-essential cookies (like analytics and advertising) require informed user consent and can be managed anytime through a settings panel.
However, it’s unclear if these cookies are fully blocked until consent is given or if users get truly equal “accept” and “reject” options.
Overall, Zara shows GDPR awareness but could improve transparency and control in its cookie consent design.

# data[].attributes.headline
Privacy statement for L’Oréal , YouTube and Prada

# data[].attributes.subject
Privacy statement for L’Oréal , YouTube and Prada

# data[].attributes.body
Beauty : L’Oréal  - L’Oréal UK & Ireland’s privacy policy demonstrates clear compliance with GDPR by outlining the purposes for data collection, respecting data subject rights, ensuring data security, and regulating third-party data sharing and international transfers. However, it could improve by explicitly stating the legal bases for processing, clarifying any use of automated decision-making, and providing specific contact details for a Data Protection Officer. Overall, the policy reflects a strong commitment to protecting personal data while maintaining transparency and user rights.

Media : YouTube - YouTube's privacy policy outlines its commitment to user data protection and compliance with the General Data Protection Regulation (GDPR). The policy details how YouTube collects, uses, and shares personal data, emphasizing transparency and user control. It provides information on data retention, security measures, and the rights of users under GDPR, such as access, correction, and deletion of personal data. Additionally, the policy explains YouTube's practices regarding data sharing with third parties and international data transfers. Overall, YouTube aims to ensure that users' personal data is handled responsibly and in accordance with applicable data protection laws.

Fashion : Prada - Prada’s privacy policy explains how it collects and uses personal data for order processing, customer management, and marketing, following GDPR rules. It highlights individuals’ rights like access, correction, and erasure, and clarifies legal bases for data processing such as consent and contract necessity. Prada ensures data security, controls data sharing with third parties, and manages international transfers responsibly. Contact details are provided for exercising privacy rights or inquiries.

# data[].attributes.body
Users can manage preferences at any time. Upon entering the website, users are required to accept or reject a cookie pop-up.

They have visible options, "accept all", "reject all" or "personalize my choices" and they offer follow-up information detailing how they manage browsing cookies - thus this gives the user the right to withdraw consent

Could allow users to consent to different categories separately

# data[].attributes.body
Zara collects and uses customer data to manage purchases, provide services, and personalize experiences across its platforms.
While its privacy policy aligns broadly with GDPR, some areas—like cookie consent, profiling transparency, and data retention clarity—could be improved.
Overall, Zara demonstrates compliance awareness but would benefit from greater transparency and user control.

# data[].attributes.body
Transparency & Informed Consent

Goal: Make it clearer to users what data is collected, why, and how consent works.

Granular Cookie Controls
→ Offer a layered consent banner that allows users to opt-in separately to analytics, advertising, and personalization cookies (not just “Accept All” or “Reject All”).

# data[].attributes.body
Users are able to opt out of personalised advertising or tracking in many cases.

For embedding YouTube videos, there is an “Enhanced Privacy Mode” (“no-cookie” mode) which aims to reduce initial tracking cookies until the user engages.

# data[].attributes.body
Collects personal data during purchases, newsletter sign-ups, and app usage.

Uses cookies and similar technologies to personalize user experience.

Offers opt-out options for marketing communications and cookie preferences.

# data[].attributes.body
Hilton collects a variety of personal and technical information, both directly from guests or users, and via automated tools.

Contact & Identity Details

Stay & Reservation Details

Government / Identification Data

Device & Technical Data

# data[].attributes.body
Collects personal data during purchases, newsletter sign-ups, and app usage.

Uses cookies and similar technologies to personalize user experience.

Offers opt-out options for marketing communications and cookie preferences.

# data[].attributes.body
Collects personal data like name, email, payment info, and browsing behaviour.

Shares data with third-party service providers (e.g., delivery, analytics) under strict contractual terms.

Offers transparency about third-party involvement and allows users to withdraw consent.

# data[].attributes.body
Hilton uses cookies and similar technologies (e.g. pixel tags, web beacons, device IDs) to collect information about visits, use patterns, analytics, and to personalize advertisements and content.

# data[].attributes.body
Cookie banner allows users to manage preferences.

Non-essential cookies (e.g., marketing, analytics) require opt-in consent.

Users can update preferences via account settings.

# data[].attributes.body
Uses a cookie banner with options to accept or reject non-essential cookies.

Explains use of pixel tags and third-party cookies for analytics and marketing.

# data[].attributes.body
Hilton publishes a Global Privacy Statement that describes how it collects, uses, discloses, and transfers personal information from guests, job applicants, etc

# data[].attributes.body
Amazon uses a cookie banner that allows users to manage preferences. Non-essential cookies require active opt-in, aligning with UK GDPR and PECR standards.

# data[].attributes.body
YouTube publishes privacy policies outlining what data is collected (watch history, uploaded content, interactions, IP addresses, etc.), how it is used, how it’s shared, how long it’s stored, etc.

# data[].attributes.body
PLT outlines its data collection scope across web, app, and social media. Identifies Boohoo Group’s DPO for contact

# data[].attributes.body
Clearly identifies Charlotte Tilbury Beauty Ltd as the data controller. Includes contact details for their Data Protection Officer (DPO) and explains user rights under GDPR.

# data[].attributes.body
Privacy Statement: Amazon clearly outlines its data processing purposes, including service delivery, personalization, and advertising. It specifies lawful bases such as consent and legitimate interest

# data[].attributes.body
Mainly transparent but lack details, they need clearer details about

how long data is stored

Where it is sent

How tracking and profiling are used

Stronger user control over marketing and behavioural data

# data[].attributes.body
Likely that it isn’t non-compliant with GDPR and UK PECR, they need a opt in banner that allows users to accept reject or manage cookie preferences before any non essential cookies are activated

# data[].attributes.body
They use cookies and tracking technologies, and have an “interest-based advertising” component.

They share data internally (across corporate affiliates) and with third parties under certain conditions (e.g service providers, advertising, legal compliance). They claim to secure data and take precautions to protect it from unauthorised access through with usual disclaimers.

# data[].attributes.body
REFY policy includes:

identification of data controller and contact information

When the policy became effective

Legal bases mentioned

The different categories of personal data collected and purposes

User rights

Data sharing with third parties

Security and breach provisions

Retention and data erasure

However gaps include and risks includes:

lack of specificity around cookie and tracking consent

Automatic deployment of non essential cookies/tracking without opt out

Lack of mention on DPIA

No mention of the DPO or supervisory authority

# data[].attributes.body
Carhartt is the most complient respecting the gdpr guidelines due to the fact it’s a smaller company and therefore needs to be more aligned with their ethics behind gdpr as they don’t the finances to back them.

# data[].attributes.body
boots cookies / consent mechanism is not deeply detailed in their policy

# data[].attributes.body
for Disney+ the balance of “legitimate interest vs user objection” is vaguely phrased. The policy also relies on consent for cookies but may risk non-compliance if non-essential tracking is loaded before explicit opt-in.

# data[].attributes.body
Carhartt clearly outlines gdpr rights. Potential concerns: “as long as necessary” retention lacks precise timeframes; notice does not deeply explicate profiling/ad-targeting beyond advertising cookies; and does not clearly state whether non-essential cookies are blocked by default pending consent.

# data[].attributes.body
cookies / consent mechanism is not deeply detailed in their policy. The linkage across its many business lines (retail,pharmacy,opticians) may pose profiling risk

# data[].attributes.body
Easy jet’s privacy statement are clear and concise. There is a lot of detailed information which is easy to digest.

# data[].attributes.body
Disney + does have the ability to trap its customers data through vaguely phrased compliance agreements. You have to consent to cookies to have access to the website

# data[].attributes.body
Netflix has lack of clarity about what Data Netflix collects, uses, shares.

They have insufficient detail when users asked for their own data.

Unclear data retention duration

Lack of transparency about international transfers

# data[].attributes.headline
Uses a banner to briefly explain their cookies policy

# data[].attributes.subject
Uses a banner to briefly explain their cookies policy

# data[].attributes.body
It explains the type of cookies/tracking they use (first and third party) and how they plan to use this data.

They are vague with what third parties they’re using and how each one are using the data

# data[].attributes.body
Dove is policies outline a clear overview of the type of data collected, the purpose and how it is processed under the GDPR. Their statement covers user rights and guides users through the process. Some areas of concern is the lack of transparency on third-party data sharing.

# data[].attributes.body
Jet2’s cookie policy explains that it uses cookies and similar technologies to improve website functionality, analyze usage, personalize content, and deliver targeted advertising. Only essential cookies are automatically enabled, while users must give consent for non-essential cookies such as analytics or marketing ones through a consent banner when they first visit the site. Users can change their cookie preferences at any time via the “Manage Settings” option. Jet2 also uses Google Consent Mode to ensure tracking respects user choices, and it clearly distinguishes between first-party and third-party cookies in its policy.

# data[].attributes.body
Twitch offers category’s and settings for cookies which included opt in consent for many usages. However the reject and decline button for non essential cookies is inconsistent.

# data[].attributes.body
Adidas’ privacy statement outlines data collection, rights, and legal bases under GDPR. It’s transparent and detailed but lacks uniform retention clarity, strong vendor oversight, and sufficient disclosure on security, children’s data handling, and automated decision-making, affecting overall data protection robustness.

# data[].attributes.body
The company must have a lawful basis for processing personal data (such as fulfilling a contract or gaining consent), provide clear privacy notices explaining how data is used, and enable individuals to exercise their rights — including accessing, correcting, or deleting their information.

Jet2 must also implement strong security measures, conduct risk assessments for high-risk data uses, document all processing activities, and notify the Information Commissioner’s Office (ICO) of any data breaches within 72 hours if they pose a risk to individuals.

In practice, Jet2 publishes a detailed privacy policy, registers as a data controller with the ICO, and enforces data protection requirements on suppliers. It must also safeguard sensitive information, like health details provided for travel, ensure lawful international data transfers, and give customers control over marketing preferences.

# data[].attributes.body
ITV’s cookie consent practices show partial GDPR compliance. They distinguish essential from non-essential cookies and provide a consent management interface, which supports user choice. However, the policy is vague about whether non-essential cookies are blocked until consent is given, and it lacks fine-grained controls for analytics versus marketing. Consent appears device- and browser-specific, placing burden on users. Overall, transparency is fair, but implementation may fall short of GDPR’s strict consent and prior-consent requirements.

# data[].attributes.body
1. Summary of key elements

Here’s a high-level summary of what ITV’s policy states (in broad strokes):

What they collect / what data categories

Registration data (name, email, phone, date of birth, postcode, password) ITVX

Payment data and purchase history (for paid services, prizes, etc.) ITVX

Usage / behavioral data: viewing history, search queries, interactions, device info, inferences / profiling ITVX

Technical / device data: IP address, device type, OS, network type, performance metrics, cookies & identifiers, etc. ITVX

Location data: non-precise (via IP) and precise (only with explicit permission) ITVX

Data from third parties: e.g. from partners, advertising / tracking providers, platforms (smart TV providers, social media) ITVX

Data you provide voluntarily (feedback, surveys, entering competitions, contact form) ITVX

Purposes / legal bases

To deliver the service (account functions, content access, login, performance, etc.) — “performance of a contract” and/or “legitimate interest” ITVX

To improve, analyse and enhance services, measure usage, testing, recommendations, etc. — using “legitimate interest” ITVX

For marketing and personalised advertising (targeted ads) — relying mainly on “legitimate interest” or explicit consent depending on context ITVX

To manage competitions, polls, events, prize fulfilment, etc. ITVX

To comply with legal obligations (e.g. law enforcement, regulatory) ITVX

Sharing / disclosures

With service providers (IT / analytics / support) on a “need to know” basis ITVX

With distribution partners (smart TVs, set-top boxes) to enable cross-device / platform functionality ITVX

With advertising / marketing partners for ad delivery, profiling, exposure reporting, matching hashed identifiers, etc. ITVX

With group companies within ITV for cross-service improvements / promotions ITVX

With government / law enforcement as required by law or for legitimate interest (safety, fraud, legal claims) ITVX

Cross-border transfers: acknowledging that they rely on adequacy decisions, standard contractual clauses, or other UK-law compliant mechanisms ITVX

# data[].attributes.body
The BBC’s privacy policy is comprehensive and GDPR compliant, with strong transparency and user rights. Minor improvements are needed in cookie consent granularity, data retention clarity, and simplification for non expert users.

# data[].attributes.body
Twitch should enhance cookie controls, strengthen security, clarify data retention, improve breach response, protect minors, increase transparency on third-party sharing, simplify user rights access, and adopt stronger privacy-by-design measures.

# data[].attributes.body
Twitch collects extensive user data, including activity, device, and behavioral information. While disclosed in its policy, broad data use for analytics and advertising raises concerns about minimisation and transparency under GDPR.

# data[].attributes.body
Twitch’s cookie consent banner informs users about tracking but offers limited granular control. Default settings favor data collection, and rejecting non-essential cookies isn’t straightforward, raising GDPR compliance and transparency concerns.

# data[].attributes.body
30 words about the the GDPR of nike

# data[].attributes.body
Twitch’s privacy statement outlines data collection, rights, and security under GDPR. It’s transparent and region-specific but lacks detail on retention, encryption, and tracking controls, raising concerns about children’s protection and data security.

# data[].attributes.body
Cookie and Consent Mechanisms:

Weaknesses: Consent Evidence and UX - public pages show controls but fo not publish organsisations approach to how consent choices are stored and how long consent records are kept

Third party scope: Some third party sharing can be opaque

# data[].attributes.body
Weaknesses:

- Low per-feature granularity - central privacy notice is broad - not prime video feature level - reducing the transparency under GDPR.

- Layered Linking Risk

# data[].attributes.body
Nandos clearly define the categories of cookies used such as required, performance, functionality and advertising.

Nandos has a cookies preference control which can be accessed at any time.

There's information about what cookies are used, how they're used and why the use of them can improve customer experience.

They state that non essential cookies are used and can be shared with third parties.

Negatives are that the third parties are not named. The length that information is stored for is not explicitly given in a time period.

# data[].attributes.body
BERSHKA collects data on website usage, customer preferences, social media interactions.

They use this data to personalise marketing, improve website performance, enhance shopping experiences, target key regions, and boost brand engagement.

# data[].attributes.body
Boots' main commercial website uses an explicit cookie consent mechanism, notifying users about the types of cookies deployed and allowing them to opt in or out, particularly for cookies that are not strictly necessary to website

# data[].attributes.body
L’Oréal’s privacy statements are designed to inform users about how their personal data is collected, processed, and protected across its digital platforms. The statements are generally clear, structured, and aligned with the General Data Protection Regulation (GDPR), providing transparency about the types of data collected—such as identity details, contact information, behavioural data from website use, and preferences gathered through cookies or direct input.

The privacy statement outlines the legal bases for processing personal data, which include consent (for marketing and personalised services), contractual necessity (for fulfilling purchases or service requests), legitimate interest (for analytics and service improvement), and compliance with legal obligations. It also includes a breakdown of user rights under GDPR, such as the right to access, rectify, delete, or restrict data, as well as the right to object to profiling and direct marketing. Instructions for exercising these rights and contacting the Data Protection Officer are typically provided.

L’Oréal explains its data sharing practices, noting that personal data may be shared within the L’Oréal Group or with authorised third-party service providers. While cross-border data transfers are acknowledged, specific safeguards (e.g., standard contractual clauses) are mentioned only briefly in some regional policies. Data retention policies are also included but tend to lack precise timeframes, often stating that data will be kept “as long as necessary,” which could be made more transparent.

Overall, L’Oréal’s privacy statement demonstrates a strong commitment to data protection and user transparency. However, areas such as profiling explanations, opt-out processes, and specific retention details could be improved for better compliance clarity and user control. The policy reflects a solid GDPR framework but would benefit from further consistency across different brand and regional implementations.

# data[].attributes.body
Youtube only uses non-essential cookies after user consent, explaining their purpose clearly and allows users to manage or withdraw consent at anytime .

Additionally, their cookie banners and settings comply with GDPR and the eprivacy directive (EU cookie law)

Essential cookies (keeping you signed in, videos), Analytics cookies (Measure engagement and performance) and advertising cookies ( deliver personalised or non - personalised ads) are used.

# data[].attributes.body
Nandos privacy policy is written in a friendly more light hearted tone allowing for a more compassionate feel to the reader. Nandos acknowledge the length of their policy but have aimed for clarity over simplification.

Nandos are very clear about the range of data that they collect such as name, contact information and location, and how it is used within their company.

Data is collected automatically to improve the experience of the service.

Nandos are very clear about how they use data provided and put an emphasize on only processing necessary data.

# data[].attributes.attachment_link.description
Last update: 9th January 2023 Thanks for using one of our platforms. Whether it was visiting one of the Nando’s websites, downloading and installing the Nando’s App or for using one of our services which requires you to provide us with your Personal Information (as defined below). We want to make sure you feel comfortable about what happens when you browse our website or give us any of your information. Formal’s not our style, so we’ve made this as easy to read as we can (but we can’t help it being so long, sorry). We will always make sure your Personal Information is safe and secure.

# data[].attributes.body
Data collection practices:

Account creation – name, email, date of birth, address, and password.

Online purchases – payment details, billing/shipping addresses, and order history.

Cookies and tracking technologies – collect browsing behaviour, device IDs, IP addresses, click patterns, and location data.

Newsletter sign-ups and surveys – voluntary submission of preferences or opinions.

Social media and advertising pixels – data collected via Facebook/Meta Pixel, Google Ads, and similar tools for targeted advertising.

# data[].attributes.body
Cookie Consent Strengths: Consent banner shown on first visit. Detailed cookie categories and explanations. Granular management possible. Withdrawal option available.

Sephora’s cookie consent mechanism is partially compliant with GDPR.
While it satisfies the transparency and information requirements, it falls short of GDPR’s strict standards for freely given, informed, and prior consent.

Until Sephora ensures that:

no cookies load before consent,

“Reject all” is as easy and visible as “Accept all,” and

consent records are auditable,

its cookie consent practices remain only partly in line with GDPR.