Most privacy audit checklists are written in the language of lawyers and compliance teams. But the stakes are human. Behind every dataset are customers, patients, students, and families who are trusting a company to handle their information the way it said it would.
That promise lives in your privacy policy. Few customers read it word for word, but they rely on it to decide whether a product has earned their trust. An internal privacy audit is how you make sure that promise stays accurate, current, and kept.
In this article, we translate the familiar audit checklist into ten plain questions any team can work through, whether you're building software for classrooms, helping patients manage their health, or handling people’s money.
Ten Questions to Ask in Your Privacy Audit
- What data do you actually collect? Start with a full inventory: account details, purchase history, location, device identifiers, voice and image data, and anything people type or upload. Include "shadow" copies in spreadsheets, support tickets, and internal dashboards.
- Do you need all of it? For every data element, name the purpose it serves for the customer or the product. Data with no clear purpose is risk without benefit, and the most protective choice is often not to collect it.
- Who are your users, really? Products are often used by people they were never designed for, including children. Look at how people actually reach your product, and whether more vulnerable users get a distinct, more protective experience.
- Is your privacy policy accurate, clear, and current? Your privacy policy is the commitment customers, families, and partners rely on, so it deserves the same scrutiny as the product itself. Walk through the product screen by screen and compare what happens against what the policy says. Check when the policy was last updated, whether it covers every feature and vendor added since then, and whether you have a process for revising it and telling people when something material changes. A policy that is accurate but unreadable to an ordinary customer is still a gap.
- Where does the data go? Map every third party that receives personal data, including analytics, hosting, payment, AI, and advertising providers. Confirm each one's contract limits how it can use that data, and that your privacy policy describes these relationships accurately.
- Is any data sold, or used for advertising or profiling? Review ad SDKs, tracking pixels, data-sharing agreements, and behavioral analytics with particular care. Sensitive categories such as health, location, financial, and children's data deserve a higher bar.
- How is AI using personal data? If the product uses AI features, document what user inputs are sent to models, whether that data trains them, and how your privacy policy and product tell people about it.
- How long do you keep it, and can you delete it? Check that retention schedules exist, match what your policy states, and are followed, and that deletion requests actually remove data from production systems and backups.
- Who inside the company can access it? Review access permissions, logging, and staff training. Access should follow need, not convenience.
- What happens when something goes wrong? Test your incident response plan. Confirm who notifies affected customers and partners, how quickly, and what they will be told.
Why Audits Matter More Than Ever
New state privacy laws continue to take effect across the U.S., and long-standing rules for children's, health, and financial data are being revised constantly. A privacy policy that was accurate and reasonable even a year ago may no longer reflect current expectations.
Products move, too. New features, new vendors, and new analytics tools are added all the time, and each one can change what a privacy policy needs to say. When the policy isn't updated alongside the product, the gap between what a company promises and what it actually does widens quietly.
Regular auditing closes that gap before a customer, a business partner, or a regulator finds it first. Just as important, it leaves a company with a privacy policy it can stand behind and honest answers when people ask hard questions.
From Internal Audit to Independent Review
An internal audit gives your team honest answers to the questions above. The natural next step is showing the people who rely on your product that those answers hold up under independent review.
The Common Sense Privacy Seal is built for exactly that. Common Sense Privacy evaluates products against a published rubric grounded in these same questions, starting with the privacy policy itself: whether it clearly and accurately describes what is collected, how it is used, who it is shared with, and how people are protected. Products that earn the Seal can display it as an at-a-glance signal of their privacy practices.
