I Audited 10 Popular Websites for Privacy Compliance - Here's What I Found

Amazon performs well across the board. The deductions come from Google Analytics usage and no AI disclosure - notable given Alexa and their AI-powered shopping recommendations are core product features.

Figma is the top scorer at 95 - the only platform to pass all checks except AI disclosure. Strong security headers, clean tracker hygiene, and a proper consent flow. The AI disclosure gap is the only thing stopping a perfect score, despite Figma AI being a prominent feature.

Notion scores well with clean tracker hygiene and a proper consent mechanism. Missing security headers and no AI disclosure are notable gaps for a product that now has significant AI features built in.

GitHub scores lower than expected for a developer platform. All 4 security headers are present, but cookie consent fails - surprising for a Microsoft-owned platform serving millions of EU developers. No AI disclosure despite Copilot being deeply integrated into the product.

Medium scores 75 with strong security headers but a clear cookie consent failure. For a platform that hosts millions of articles and handles paid subscriptions with EU customers, missing consent for cookies is a meaningful GDPR exposure.

Vercel, the platform developers trust to deploy their apps, scores 75. Strong security headers as expected from an infrastructure company. But cookie consent fails and there is no AI disclosure despite their v0 AI product. A case of the cobbler's children having no shoes.

Reddit drops to 55 with two clear fails: cookie consent and privacy policy both missing from the scanned page. Given that Reddit has sold user data to Google and OpenAI for AI training, the absence of AI disclosure is arguably the most significant compliance gap here.

Substack is the lowest scorer among non-portfolio sites at 45. Weak security headers, no cookie consent detected, and no privacy policy link found are all significant issues for a platform hosting paid newsletters with EU subscribers. This result is likely to raise eyebrows.

I included my own portfolio to show that even developers who build privacy tools can fail. Running GA4 and GTM without a cookie consent banner, no privacy policy, and weak security headers. I am fixing this. Lesson: audit your own sites too.