Type a company name or paste a privacy-policy URL, select website, App Store, or Google Play from the drop down and click Analyze. We score policies against the FTC Act §5FTC Act §5 · 15 U.S.C. § 45The federal "unfair or deceptive practices" authority. Used to enforce privacy policies — when a company doesn't do what its policy promises, that's a §5 violation.Enacted 1914, HIPAAHIPAA / HITECH · 42 U.S.C. § 1320dFederal floor for protected health information. Covers healthcare providers, plans, clearinghouses, and their business associates. HITECH adds the 60-day breach notification rule.Enacted 1996 · HITECH 2009, GLBAGLBA · 15 U.S.C. § 6801Privacy notices, opt-outs, and safeguards for nonpublic personal information held by financial institutions — banks, lenders, insurers, fintech, payments.Enacted 1999, FCRAFCRA · 15 U.S.C. § 1681Governs consumer reports: credit, tenant screening, employment background checks. Gives consumers the right to access, dispute, and correct their records.Enacted 1970, COPPACOPPA · 15 U.S.C. § 6501Requires verifiable parental consent before collecting personal data from kids under 13. The "Epic Rule" applies: disclaimers don't excuse the policy if minors actually use the service.Enacted 1998, and conditional overlays for the rest of the federal stack. Free. No account. No tracking. Nothing stored about you.
Two-layer rubric: five universal scoring categories plus conditional overlays for HIPAA, ECPA, TCPA, CAN-SPAM, and VPPA — applied only when the policy triggers them.
"Not directed to children" disclaimers don't earn full credit if the service is plausibly used by minors. Established by FTC v. Epic Games, 2022.
We score what the policy actually says, not what the company allegedly does. Good actors with thin policies still need to fix their docs.
25% · Data Minimization 18.75% · Individual Rights 18.75% · Security & Breach 18.75% · Children & Vulnerable 18.75%. Truthfulness carries extra weight because FTC §5 is the universal federal backbone — every other federal privacy statute ultimately enforces "do they do what they say."