![59.3% of Privacy Policies Pass Core GDPR Rules [2026 Data]](/_astro/gdpr-privacy-policy-compliance-2026.BwsSQpaq_Z1xXX3A.webp)
Only 59.3% of EU privacy policies meet all seven core GDPR transparency requirements, according to the most detailed academic audit of the subject published to date: a peer-reviewed study of 6,278 privacy policies from researchers at the University of Wisconsin and EPFL. Global privacy policies outside the EU score almost the same, at 58.2%. Five years after the study's 2020 publication, no comparable large-scale academic re-audit has replaced it, and the specific gap it found, weak disclosure of data categories, still shows up as an enforcement priority in 2026's fine data.
What percentage of privacy policies actually comply with GDPR?
Figure 1: 59.3% of EU privacy policies meet all seven core GDPR transparency requirements measured in the study. Source: Linden et al., "The Privacy Policy Landscape After the GDPR," PoPETS 2020.
59.3% is the average share of EU privacy policies meeting seven requirements distilled from the UK Information Commissioner's Office's GDPR guide, covering duties like naming the purposes of processing, the categories of data collected, and the right to withdraw consent. The researchers, Thomas Linden, Rishabh Khandelwal, Hamza Harkous, and Kassem Fawaz, built an automated pipeline to score each policy against these seven checklist items rather than relying on manual review, then validated a sample against human subject-matter experts and found the automated scoring agreed with the experts about as often as the experts agreed with each other. Global privacy policies scored 58.2% on the same test, a gap of roughly one percentage point between EU and non-EU sites.
That headline number covers a policy that meets a requirement in both its pre-GDPR and post-GDPR form, plus any policy that added a requirement it previously lacked. Sites collecting personal data from EU residents can close the most common transparency gaps directly with a privacy policy generator built for GDPR that keeps required disclosures current rather than relying on manual review after the fact.
Which GDPR privacy policy requirement fails most often?
Figure 2: Share of EU privacy policies meeting each core GDPR disclosure rule after May 2018. Source: Linden et al., PoPETS 2020.
Disclosing the categories of personal data collected is the weakest of the seven requirements by a wide margin, met by only 41.3% of EU policies and 42.8% of global policies, the sole requirement that falls below half. Policies do far better naming who the data goes to: 77.8% of EU policies and 80.3% of global policies specify the recipients of personal data, and 65.0% of EU policies (62.4% global) name where the data originally came from when it was not collected directly from the user. A policy that says "we may share your information with our partners" without listing what categories of information get shared, name, location, device identifiers, or browsing history, fails this requirement even if every other clause reads as thorough.
That gap matters beyond the study: CMS Law's GDPR Enforcement Tracker Report, covering 2,685 documented fines through a March 2026 cutoff, identifies transparency and information obligations as an emerging horizontal enforcement priority across EU data protection authorities, the same failure mode this 2020 audit flagged as the single weakest disclosure years earlier.
How was privacy policy GDPR compliance actually measured?
Figure 3: Composition of the 6,676 privacy policy pairs analyzed, split between EU-based and global sites. Source: Linden et al., PoPETS 2020.
The researchers built two datasets: 3,084 matched pairs of EU privacy policies and 3,592 matched pairs of global policies, each pair containing a pre-GDPR snapshot (the last stable version before May 25, 2018) and a post-GDPR snapshot (the most recent version as of the study's 2019 data collection cutoff), pulled from the Internet Archive's Wayback Machine. Website selection started from the Alexa Top Sites API, covering the top 3,000 domains in each of the 28 EU member states for the EU set and a topically diverse global sample, then filtered down through an automated policy-detection classifier that the authors report was 99.09% accurate against a manually labeled test set. Compliance scoring itself followed the ICO's published GDPR checklist rather than the researchers' own interpretation of the law, which is what makes the 59.3% figure closer to a regulator-aligned audit than a subjective content review.
Direct in-text collection of personal data categories is not the only spot the audit found gaps; adoption of privacy policies overall varies just as sharply by site popularity, a pattern our companion piece on how many websites actually have a privacy policy covers in detail.
Did privacy policies get longer and more detailed after GDPR?
Average EU privacy policy length grew 35% after GDPR took effect, from 1,936 words in the pre-GDPR snapshot to 2,621 words in the post-GDPR version, while global policies grew a comparable 25%, from 1,709 to 2,140 words. Sentence counts followed the same pattern, up 33% for EU policies and 21% for global policies, evidence that companies added material to their policies rather than just rewording existing clauses.
Figure 4: Average privacy policy word count before and after the GDPR's May 2018 enforcement date. Source: Linden et al., PoPETS 2020.
Length alone did not guarantee better disclosure. The same study's specificity analysis found that 25.22% of EU policies became more precise in describing their data practices after GDPR, naming exact data types instead of vague categories, but 22.7% actually became less specific, adding broader catch-all language at the expense of detail. A longer policy is not automatically a more compliant one.
Is GDPR compliance different for EU sites versus the rest of the world?
Figure 5: EU privacy policies outperform global policies on every compliance dimension measured, though the gaps are narrow. Source: Linden et al., PoPETS 2020.
EU-based sites out-improved global sites on every dimension the study measured, but the margins are consistently narrow rather than dramatic. The average compliance score gained 4.8 percentage points for EU policies between their pre- and post-GDPR versions, against 3.5 percentage points for global policies. Category-level coverage tells a similar story: EU policies improved their disclosure of data retention periods by 52 percentage points versus 31 for global policies, and improved coverage of user access, edit, and deletion rights by 21 percentage points versus 13. The direction is consistent everywhere: EU sites face the regulation directly and respond somewhat harder, but neither group treats the law as optional, and neither group is fully compliant either.
How does compliance compare across the seven core GDPR requirements?
| GDPR disclosure requirement | GDPR reference | EU compliance rate | Global compliance rate |
|---|---|---|---|
| Recipients of personal data | Art. 14(1)(e) | 77.8% | 80.3% |
| Source of personal data | Art. 15(1)(g) | 65.0% | 62.4% |
| All seven requirements (average) | Art. 12-22 | 59.3% | 58.2% |
| Categories of personal data collected | Art. 14(1)(d) | 41.3% | 42.8% |
Source: Linden et al., "The Privacy Policy Landscape After the GDPR," Proceedings on Privacy Enhancing Technologies, 2020.
Categories of personal data collected is the only requirement in this table below the 50% mark, and it sits nearly 20 percentage points under the 59.3% average across all seven requirements, which is exactly the kind of gap a specific, itemized data-collection clause closes in one edit.
The Bottom Line
59.3% compliance with seven core GDPR transparency requirements, five years after regulators started enforcing the law, is not a passing grade. The good news is that the failure is concentrated: one requirement, disclosing the categories of personal data collected, drags the average down more than any other, while policies already do reasonably well naming who receives the data and where it came from. A site that fixes its data-category disclosure and keeps pace with what a privacy policy generator built for GDPR tracks as the law evolves closes most of the gap this study measured, without waiting for a regulator to flag it first.
Frequently Asked Questions
What percentage of privacy policies comply with GDPR? 59.3% of EU privacy policies and 58.2% of global privacy policies meet all seven core transparency requirements drawn from the UK Information Commissioner's Office GDPR checklist, according to a peer-reviewed audit of 6,278 privacy policies published in Proceedings on Privacy Enhancing Technologies.
Which GDPR privacy policy requirement fails most often? Disclosing the categories of personal data collected is the weakest requirement, met by only 41.3% of EU privacy policies and 42.8% of global privacy policies, the only one of the seven core requirements that falls below 50%.
Did privacy policies get longer after GDPR took effect? Yes. Average EU privacy policy length grew 35%, from 1,936 words before GDPR to 2,621 words after, while global policies grew 25%, from 1,709 to 2,140 words, according to the same 6,278-policy study.
Is GDPR compliance improving over time? Slowly. On average 15.1% of EU privacy policies and 10.66% of global policies improved a compliance requirement between their pre-GDPR and post-GDPR versions, versus 10.3% and 7.12% that lost a requirement they used to cover, a modest net gain rather than a sweeping fix.
Where the Numbers Come From
- Linden, Khandelwal, Harkous, and Fawaz. "The Privacy Policy Landscape After the GDPR." Proceedings on Privacy Enhancing Technologies (PoPETS), 2020. Audit of 6,278 unique English-language privacy policies (3,084 EU pairs, 3,592 global pairs), the source of every compliance, coverage, word-count, and specificity figure in this post.
- UK Information Commissioner's Office. "Guide to the General Data Protection Regulation (GDPR)." Source of the seven-item "Right to be Informed" and "Right of Access" checklist the study's compliance queries were built from.
- CMS Law. (2026). "GDPR Enforcement Tracker Report 2025/2026, Numbers and Figures." 2,685 documented fines, EUR 6.11 billion cumulative, cutoff March 1, 2026, published May 21, 2026; transparency and information obligations noted as an emerging enforcement priority.
Note: All figures verified as of August 2026. The 59.3% compliance figure and every supporting statistic in this post come from Linden et al.'s 2020 peer-reviewed audit, the largest and most methodologically detailed academic study of GDPR privacy-policy compliance published to date; no larger-scale academic re-audit has superseded it as of this writing. Enforcement-trend context is refreshed against CMS Law's tracker report at least twice a year as new editions publish.
