Sample report
This is a real Audulate scan of quebooking.com — a site we own and use as a public dogfood target. Scroll down to see exactly what findings, evidence, and remediation guidance look like.
7
Pages crawled
7
Findings · 1H / 2M / 4L
6.5s
Scan duration
1
AI-verified downgrade
Live data · Scan id cmp1qx8db
HTTP Security Headers
gdpr-security-headersMissing security headers: Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. These protect users from XSS, clickjacking, and inadvertent data leakage.
How to fix
Add a "headers" block to vercel.json to set: Content-Security-Policy, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy.
Cookie Policy Insufficient for PECR Informed Consent
gdpr-ai-cookie-policy-substanceCookie policy does not meet PECR Reg. 6 informed consent requirements: cookies are not identified by specific name or defined category with meaningful description (+3 more issues).
How to fix
Update your cookie policy: (1) Name cookies or define categories with descriptions. (2) State specific purpose per cookie/category. (3) Include retention/expiry durations. (4) Name all third-party providers.
DSR Process Missing Usability Elements
gdpr-ai-dsr-process-clarityPrivacy policy mentions data subject rights but the process is not sufficiently actionable under GDPR Art. 12(2): no response timeframe meeting Art. 12(3) (30 days / one month).
How to fix
Add to the rights section: (1) a specific email or form URL (not just "contact us"), (2) a 30-day response timeframe, (3) at least 4 of the 6 core rights.
Legitimate Interest Disclosures Inadequate
gdpr-ai-legitimate-interest-adequacyAI second-opinion downgraded this from HIGH → LOW (confidence 0.80). The deterministic rule fired; AI re-read the policy and judged it a likely false positive.
The privacy policy mentions legitimate interests as a legal basis but does not specify the exact interests pursued, nor includes a balancing assessment or link to the Art. 21 right to object.
How to fix
For each LI-based processing activity: (1) name the specific interest, (2) include a balancing statement, (3) explicitly state the Art. 21 right to object.
Privacy Policy References Tracking, But None Detected
gdpr-consent-banner-all-pagesPrivacy policy mentions cookies, analytics and tracking but the scan saw no third-party trackers or non-essential cookies. Either the policy is out of date, tracking happens server-side, or trackers are correctly disabled.
How to fix
Reconcile the policy with actual tracking: remove references if no such tracking occurs, or confirm a CMP is in place. Art. 13/14 requires the policy to accurately describe processing.
Data Breach Notification Policy
gdpr-breach-notificationThe privacy policy should state how users will be notified in the event of a data breach (GDPR Art. 34).
How to fix
Add a breach response section to your privacy policy. State your 72-hour authority notification obligation and how you will notify affected individuals for high-risk breaches.
Automated Decision-Making Disclosure — Found in Wrong Location
gdpr-automated-decisions-misplaced"Automated Decision-Making Disclosure" content was found on the general page, but should be present on your privacy_policy page(s) as required by GDPR.
How to fix
Move or duplicate this content to your privacy_policy page(s). GDPR requires that certain disclosures appear specifically in the privacy notice, not just anywhere on the site.
Most compliance vendors gate their reports behind a sales call. We'd rather you see exactly what the product produces before you decide to sign up. The scan above ran against quebooking.com — a site we own — with the same engine, same findings, and same evidence trail any customer would get.