A privacy policy generator turns your answers into a policy. The harder part comes later. Sites add and drop tools far more often than privacy laws change, and a policy written from last spring's answers doesn't know about the ad pixel you added last month.
So we tested both halves. We built a small fictional shop, gave every generator identical answers and read what each one published. Then we added an advertising pixel to the shop and read every policy again over the next nine days. Where a generator needed its owner to do something before the pixel could appear, the results say what.
Disclosure: ConsentStack makes one of the generators on this page. That is why the method is public. The test shop at generatortest.consentstack.io is live, every result below is dated, and our own version history for the shop's Privacy Policy is public, with the reason each version was published.
The test: one shop, nine generators
Fernhollow Candle Co. is a fictional online candle shop. Its site runs real tracking scripts with dummy account IDs, so every request a real shop would make happens, but nothing is collected. The tools it runs:
- Google Analytics 4Analytics
- Meta PixelAdvertising and retargeting
- Stripe.jsPayments
- Mailchimp signup formNewsletter
- Reddit PixelAdvertising, added October 30 once every policy was published
Every generator got the same answer sheet. These are the answers that decide what a correct policy says for this shop:
- Business
- Fernhollow Candle Co. LLC, an online candle shop in Vermont
- Customers
- The US (including California), the UK and the EU
- Size
- Under $1 million in revenue and under the CCPA's thresholds
- Sells personal data for money
- No
- Shares data for targeted advertising
- Yes, through the Meta Pixel
- Do Not Track
- Not honored
- Global Privacy Control
- Honored as an opt-out of sharing
- Children
- Not directed to children under 16
Each generator published its Privacy Policy, and its Cookie Policy where it makes one, on October 30, 2026. At 21:33 UTC that evening we added the Reddit Pixel to every page of the shop, then read every policy again on November 2 and November 9. Advertising was already part of the shop's answers, so a generator that follows the site had everything it needed to add the new pixel by itself.
We paid for Termly Pro+ ($20 a month), the Termly plan sold with weekly scans and auto-updated policies, a Termageddon license ($12 a month) and GetTerms Business ($12 a month). Every other generator ran on its free plan, ConsentStack's included. Plans and prices were read on each vendor's site on November 9, 2026.
Snapshot
Nine days after the pixel went live, one Privacy Policy named it. ConsentStack against the other 8 generators, every number traceable to the table below:
Two policies also told visitors something the shop's answers contradict. iubenda's US notice says the shop doesn't sell or share data or use it for targeted advertising, and Usercentrics' says the shop does not sell or share personal information. The shop runs the Meta Pixel and said so. Both are covered in the generator-by-generator sections.
Results
One row per generator, read on November 9, 2026. Every mark reports what that generator's published policy said, not what its marketing pages promise. The sections further down quote the policies behind each mark.
| Generator | Learns your tools by | Privacy Policy names the shop's four tools | States the owner's Do Not Track and GPC answers | Privacy Policy named the new pixel within 9 days | Cookie Policy listed the new pixel's cookie on its own | What the owner had to do |
|---|---|---|---|---|---|---|
| ConsentStack | Detects the tools the site loads, plus a questionnaire for tools that never load in a browser | Yes | Yes | Yes | Yes | Nothing |
| Termly | Questionnaire; a site scan builds the Cookie Policy only | Yes | Partly | No | Partly | Log in so the scheduled scan runs, then add Reddit to the Privacy Policy questionnaire by hand |
| Termageddon | Questionnaire; the Cookie Policy comes from a bundled Usercentrics license and its scan | Partly | Partly | No | No | Rescan for the Cookie Policy and add the pixel to the Privacy Policy questionnaire by hand |
| iubenda | A site scan suggests services; the owner adds each one | Partly | Partly | No | No | Open the scan results and add each service; the Reddit Pixel was not among the suggestions |
| Usercentrics | Picks from its service list, plus typed entries; no scan of the site | Partly | No | No | Not offered | Add the pixel in the generator by hand |
| GetTerms | Questionnaire; a site scan feeds the Cookie Policy's categories | Partly | Partly | No | No | Add the pixel to the questionnaire by hand; the Cookie Policy would still name no service |
| CookieYes | Questionnaire; its site scan builds the Cookie Policy | No | Partly | No | Partly | Run a scan by hand (the free plan can't schedule one) and add the pixel to the Privacy Policy by hand |
| TermsFeed | Questionnaire | Partly | No | No | No | Generate the policy again with the new tool; a version that describes this shop truthfully was priced at $134 before tax, one time, on October 30 |
| FreePrivacyPolicy | Questionnaire | No | No | No | No | Generate the policy again; a truthful version was priced at $134, one time, on October 30 ($168 with the CCPA clauses) |
What "automatic updates" means here
Several of these tools sell automatic updates, and the phrase covers two different things. One is the law: when a privacy law changes, the vendor updates its template, and policies that are hosted or embedded pick up the new wording. The other is your site: when you add or drop a tool, the policy changes to match. This test measured the second.
Only some generators look at the site at all. ConsentStack checks the tools it detects once an hour and republishes both policies on its own when the facts change, holding anything that changes what the policy promises for the owner's review. Termly, CookieYes, Termageddon (through a bundled Usercentrics license) and GetTerms scan the site, but the scan feeds only the Cookie Policy. iubenda scans and emails the owner a list of services to add. Usercentrics' generator, TermsFeed and FreePrivacyPolicy don't look at the site.
Generator by generator
ConsentStack
By ConsentStack. Tested on Basic, free. Read on November 9, 2026. See the generator
ConsentStack checks every published policy against the tools it detects on the site once an hour. The shop already disclosed advertising (the Meta Pixel), so a second advertising tool published on its own as a new dated version of both policies. A first advertising tool would have waited for the owner's review instead, because it changes what the policy promises.
| Test | Result | What the published policy said |
|---|---|---|
| Privacy Policy names the shop's four tools | Yes | All four, from detection: Google Analytics, Meta Pixel, Stripe.js and Mailchimp signup forms, each with its provider and purpose. |
| States the owner's Do Not Track and GPC answers | Yes | "We do not respond to DNT signals." and "We honor Global Privacy Control signals." Asked the state-law thresholds and left out the CCPA section the shop doesn't need. |
| Privacy Policy named the new pixel within 9 days | Yes | 45 minutes after the pixel went live, with no one touching the dashboard: Reddit Pixel, Reddit, Inc., its purposes and opt-out link under "Advertising and remarketing". |
| Cookie Policy listed the new pixel's cookie on its own | Yes | In the same automatic update: Reddit Pixel and its _rdt_uuid cookie. |
What the owner had to do: Nothing.
- Both policies' version histories are public, with the reason for each version: the Reddit Pixel arrived in an automatic update at 22:17 UTC on October 30.
- Hosted pages on policies.consentstack.io, or an embed for any page. The free plan's policies end with a short line crediting ConsentStack.
Termly
By Termly. Tested on Pro+, $20 a month billed monthly ($15 billed annually), per website. Read on November 9, 2026. See the generator · ConsentStack vs Termly
Termly's Privacy Policy comes from its questionnaire, and its Cookie Policy comes from scans of the site. Pro+ is the Termly plan sold with weekly scans and "Auto-updated policies". In our test the weekly scan scheduled for November 6 ran only when the owner next logged in, on November 9, and it listed the new cookie without saying whose it was.
| Test | Result | What the published policy said |
|---|---|---|
| Privacy Policy names the shop's four tools | Yes | All four, picked in its questionnaire: Google Analytics, "Facebook", Stripe and "MailChimp". |
| States the owner's Do Not Track and GPC answers | Partly | "We recognize and honor Global Privacy Control (GPC) signals." Its fixed Do Not Track section, never asked about, says it does not respond to "any other mechanism that automatically communicates your choice not to be tracked online", which GPC is. It prints a full CCPA section without asking whether the law applies. |
| Privacy Policy named the new pixel within 9 days | No | Unchanged through November 9. Nothing from the scan reaches the Privacy Policy. |
| Cookie Policy listed the new pixel's cookie on its own | Partly | On November 9, only once the owner logged in: _rdt_uuid listed as an "unclassified" cookie, with Reddit not named and no purpose. The weekly scan due November 6 had not run. |
What the owner had to do: Log in so the scheduled scan runs, then add Reddit to the Privacy Policy questionnaire by hand.
- Scheduled scans were off for the new site until we turned them on, and the frequency read every 3 months until we chose weekly.
- The Privacy Policy printed "please contact us at __________." although the privacy email was given twice.
Termageddon
By Termageddon. Tested on One license, $12 a month or $119 a year, per website. Read on November 9, 2026. See the generator
Termageddon writes its policies from a questionnaire and updates them when the law changes. Setting up the Cookie Policy activates a free Usercentrics license, which scanned the site once. Neither policy changed after the pixel was added.
| Test | Result | What the published policy said |
|---|---|---|
| Privacy Policy names the shop's four tools | Partly | Google Analytics, and Meta Pixel as "an analytics tool". Stripe and Mailchimp only as categories: "Financial transactions processors" and "Email marketing vendors". |
| States the owner's Do Not Track and GPC answers | Partly | "We do not support DNT." No Global Privacy Control statement. Asked the state-law thresholds; no California section, and a Nevada sale opt-out. |
| Privacy Policy named the new pixel within 9 days | No | Unchanged through November 9. |
| Cookie Policy listed the new pixel's cookie on its own | No | Built from one scan on October 30 and unchanged through November 9. No scan schedule was shown. |
What the owner had to do: Rescan for the Cookie Policy and add the pixel to the Privacy Policy questionnaire by hand.
- The Cookie Policy filed Google Analytics under Marketing and listed Facebook Social Plugins, which the shop does not run.
iubenda
By iubenda. Tested on Free (paid plans from $5.99 a month billed annually, per website). Read on November 9, 2026. See the generator
iubenda scans the site and suggests services, and the owner adds each one with a click. Nothing is added on its own: the scan emails the owner about missing services. Its November 3 rescan ran without anyone asking, and still missed the new pixel.
| Test | Result | What the published policy said |
|---|---|---|
| Privacy Policy names the shop's four tools | Partly | Google Analytics and Mailchimp. Meta and Stripe are paid services on the free plan, so they were left out. |
| States the owner's Do Not Track and GPC answers | Partly | Honors GPC; no Do Not Track statement. Its US notice reads "Sold or Shared: No" and "Targeted Advertising: No", which a shop running the Meta Pixel can't say. |
| Privacy Policy named the new pixel within 9 days | No | Unchanged through November 9. |
| Cookie Policy listed the new pixel's cookie on its own | No | It rescanned by itself on November 3 and emailed that 7 services were missing from the policy, but the scan did not find the Reddit Pixel, which iubenda's own service list includes. |
What the owner had to do: Open the scan results and add each service; the Reddit Pixel was not among the suggestions.
- The first scan found 8 services within about 15 minutes of adding the site, and the email arrived soon after.
Usercentrics
By Usercentrics. Tested on Privacy Policy Generator, Free. Read on November 9, 2026. See the generator · ConsentStack vs Usercentrics
Usercentrics' generator builds a Privacy Policy from a questionnaire and its list of services, delivered as an embed. It does not look at the site, so nothing changes when the site does.
| Test | Result | What the published policy said |
|---|---|---|
| Privacy Policy names the shop's four tools | Partly | Google Analytics, Meta and Mailchimp from its list; Stripe only because it was typed in. |
| States the owner's Do Not Track and GPC answers | No | Neither. It says the shop "does not sell or share personal information", which a shop running the Meta Pixel can't say, and the questionnaire never asked. |
| Privacy Policy named the new pixel within 9 days | No | Unchanged through November 9. |
| Cookie Policy listed the new pixel's cookie on its own | Not offered | This generator writes no Cookie Policy. |
What the owner had to do: Add the pixel in the generator by hand.
- It printed data types from its service list that the shop doesn't collect: date of birth, national ID numbers and GPS location for Google Analytics, payment information for Meta.
- No hosted page on the free plan, and the policy carries "Powered by Usercentrics".
GetTerms
By GetTerms. Tested on Business, $12 a month billed monthly ($8 billed annually), per website. Read on November 9, 2026. See the generator
GetTerms writes its policies from a questionnaire and scans the site for its Cookie Policy, which lists cookie categories rather than services or cookies. Neither policy changed after the pixel was added.
| Test | Result | What the published policy said |
|---|---|---|
| Privacy Policy names the shop's four tools | Partly | Google Analytics, Meta and Mailchimp in a bare list of third parties; Stripe only because it was typed in. |
| States the owner's Do Not Track and GPC answers | Partly | A Do Not Track statement inside the US section; no Global Privacy Control statement. One CCPA checkbox and no threshold questions. |
| Privacy Policy named the new pixel within 9 days | No | Unchanged through November 9. |
| Cookie Policy listed the new pixel's cookie on its own | No | Its Cookie Policy names no service and no cookie, only category headings, and was unchanged through November 9. |
What the owner had to do: Add the pixel to the questionnaire by hand; the Cookie Policy would still name no service.
- The policy said data is stored in the United Kingdom (the shop stores it in the US), named a Data Protection Officer the shop doesn't have, and told readers to reply "STOP" to texts the shop never sends. The Data Protection Officer and text-message boxes were left unticked.
CookieYes
By CookieYes. Tested on Free (paid plans from $10 a month, per domain). Read on November 9, 2026. See the generator · ConsentStack vs CookieYes
CookieYes writes the Privacy Policy from a questionnaire and the Cookie Policy from its last scan of the site. On the free plan nothing rescans by itself; one manual scan picked up the new cookie and described it correctly.
| Test | Result | What the published policy said |
|---|---|---|
| Privacy Policy names the shop's four tools | No | None from its own choices. Meta and Stripe appear only because they were typed into free-text boxes; the matching built-in choices are on paid plans. |
| States the owner's Do Not Track and GPC answers | Partly | A Do Not Track sentence the owner typed; no Global Privacy Control statement. It says "We sell or share the information we collect", from one combined question. |
| Privacy Policy named the new pixel within 9 days | No | Unchanged through November 9. |
| Cookie Policy listed the new pixel's cookie on its own | Partly | Only after the owner ran a manual scan on November 9: _rdt_uuid under Advertisement, with Reddit named. Scheduled scans are on the Pro and Ultimate plans. |
What the owner had to do: Run a scan by hand (the free plan can't schedule one) and add the pixel to the Privacy Policy by hand.
- No hosted policy page on the free plan; the policy installs from a script.
TermsFeed
By TermsFeed. Tested on Free (paid clauses are one-time purchases). Read on November 9, 2026. See the generator
TermsFeed writes a free policy from a questionnaire and sells each specific clause, such as analytics, payments or the GDPR, as a one-time add-on.
On this tool's free path, describing analytics, advertising, payments, email or the GDPR and California laws is a paid clause. We answered No to each paid clause to stay free, so this row shows what the free path produces for this shop, not what the paid version can do.
| Test | Result | What the published policy said |
|---|---|---|
| Privacy Policy names the shop's four tools | Partly | All four, but only as links to each tool's own privacy policy, typed into its free "Add Your Own" field with no purpose. |
| States the owner's Do Not Track and GPC answers | No | Neither, and no GDPR or California section on the free path. |
| Privacy Policy named the new pixel within 9 days | No | Unchanged through November 9. |
| Cookie Policy listed the new pixel's cookie on its own | No | The free Cookie Policy lists only the site's own necessary and functionality cookies, and was unchanged through November 9. |
What the owner had to do: Generate the policy again with the new tool; a version that describes this shop truthfully was priced at $134 before tax, one time, on October 30.
- The free policy carries a "Text Messages Privacy Notice", although the shop sends no texts.
FreePrivacyPolicy
By FreePrivacyPolicy.com. Tested on Free (paid clauses are one-time purchases). Read on November 9, 2026. See the generator
FreePrivacyPolicy works like TermsFeed: a free policy from a questionnaire, with paid clauses for anything specific. The two produced nearly the same document.
On this tool's free path, describing analytics, advertising, payments, email or the GDPR and California laws is a paid clause. We answered No to each paid clause to stay free, so this row shows what the free path produces for this shop, not what the paid version can do.
| Test | Result | What the published policy said |
|---|---|---|
| Privacy Policy names the shop's four tools | No | None of the four. |
| States the owner's Do Not Track and GPC answers | No | Neither, and no GDPR or California section on the free path. |
| Privacy Policy named the new pixel within 9 days | No | Unchanged through November 9. |
| Cookie Policy listed the new pixel's cookie on its own | No | Unchanged through November 9. |
What the owner had to do: Generate the policy again; a truthful version was priced at $134, one time, on October 30 ($168 with the CCPA clauses).
- 99% of its Privacy Policy's eight-word phrases appear word for word in TermsFeed's, all 23 of its headings appear in TermsFeed's in the same order, and its free policies credit TermsFeed's generators with a link.
Frequently asked questions
It depends on whether you want the policy to keep up with your site. We gave nine generators the same shop and the same answers, then added an advertising pixel to the site. Nine days later, only ConsentStack's Privacy Policy named it; it did so 45 minutes after the pixel went live, with no one touching the dashboard. Among the others, Termly came closest: it named all four of the shop's tools from its questionnaire, but its Privacy Policy never picked up the new pixel, and its Cookie Policy listed the pixel's cookie, unnamed, only once the owner logged in. We build ConsentStack, so the test shop is public and every result on this page is dated.
Most that say so mean changes in the law: the vendor updates its template, and the update reaches your policy if it is hosted or embedded. That is different from your policy changing when your site does. In our test, none of the eight other generators changed the Privacy Policy when the site added an advertising pixel. Two Cookie Policies listed the new cookie after an owner step: Termly's when the owner logged in, and CookieYes's after the owner ran a scan by hand.
Check what the free version leaves out. On TermsFeed's and FreePrivacyPolicy's free paths, describing analytics, advertising, payments or the GDPR is a paid clause, and a policy that described our test shop truthfully was priced at $134. iubenda's free plan left out Meta and Stripe, and its US notice said the shop doesn't share data for advertising. ConsentStack's generator is included on every plan, the free one too, and names the tools it detects on your site.
The laws mostly ask for categories: the GDPR asks for the recipients or categories of recipients of personal data, and California's online privacy law asks for the categories of third parties you share it with. Some tools ask for more. Google Analytics' terms require your privacy policy to disclose that you use it. Naming each tool is also what keeps a policy true when the tools change, because a category list doesn't show what was added.
We built a fictional candle shop running Google Analytics, the Meta Pixel, Stripe and a Mailchimp signup form, and gave every generator the same answer sheet. Once every policy was published, we added the Reddit Pixel to the site and read every policy again 3 and 9 days later. We paid for Termly Pro+, a Termageddon license and GetTerms Business, and used free plans elsewhere. On TermsFeed and FreePrivacyPolicy we stayed on the free path, which leaves out every paid clause.
A privacy policy that keeps up with your site.
Free on every plan. ConsentStack writes your privacy and cookie policies from the tools it detects on your site, and updates them as those tools change.