Your privacy policy claims a certification you no longer hold

A seven-step play for a privacy compliance firm. It starts from Data Privacy Framework, stacks Firecrawl and Wayback Machine on top, and ends in a message to the privacy or legal lead that is useful before anyone replies.

Deploy in Glider

Installs this workflow, five project tables and a draft campaign. Source access and any external outputs are checked before research.

Category: Public records
Sources: 3
Steps: 7

The workflow

TriggerData Privacy FrameworkFramework participants marked inactive, with the date
Evidence
FirecrawlThe company's current privacy policy Wayback MachineWhether the claim stayed up after the lapse
Artifact
What you hand overA gap memo: the exact sentence in the policy, the inactive record and date, and the two ways to fix it.
Contact
GliderFinds the privacy or legal lead, with a verified work email and a phone
Message
Send itFrom your own mailboxes, evidence attached

Why it earns attention

Claiming a Data Privacy Framework certification you no longer hold is the kind of statement the FTC has brought cases over. The fix is a renewal or one sentence, and you have already found the sentence.

The play in seven steps

01
Find lapsed certifications
Data Privacy Framework
What you pull
Organizations on the Commerce Department list with an inactive status: name, the date it went inactive and the frameworks covered.
Why it matters
Inactive means they missed the annual recertification. Many companies don't notice because nothing breaks right away.
Example
Status: inactive since May 2026 · EU-US DPF and UK Extension
02
Read their live privacy policy
Firecrawl
What you pull
The current privacy policy text, searched for any claim of participation in the framework.
Why it matters
The record alone is not the problem. The problem is the public claim, and you can quote it word for word.
Example
"We participate in and comply with the EU-US Data Privacy Framework." · section 9
03
Check the claim stayed up after the lapse
Wayback Machine
What you pull
Archived copies of the policy before and after the lapse date.
Why it matters
It shows the claim has been live through the gap, not just updated yesterday. It also shows when they last touched the policy.
Example
Same sentence in captures from March, July and October · policy last changed January
04
Build the gap memo
Your artifact
What you build
The sentence, the record, the dates, and two fixes: recertify, or reword the policy until they do.
Why it works
Legal can act on it in a day. It reads as help, not as a threat.
Example
1 sentence · inactive 6 months · fix A: recertify · fix B: reword section 9
05
Check before you send
Check the live list the day you send: recertification can land late. Keep the tone neutral, never imply a complaint has been or will be filed.
06
Find the privacy or legal lead in Glider
Glider
Search for
Privacy counselGeneral counselData protection officerHead of compliance
Why them
They own the policy and the certification. A gap they find themselves is a problem; one handed to them with a fix is a favor.
What you get
A work email and a direct phone, with the email verified before it goes into a sequence.
07
Send the evidence, then run the first test
To: the privacy or legal leadEvery line comes from a step above
The Commerce Department's Data Privacy Framework list shows your certification inactive since May.¹ Section 9 of your privacy policy still says you participate,² and that sentence has been live the whole time.³ Misstating participation is something the FTC has brought cases over. I wrote up the sentence, the record and two ways to fix it.⁴ Want the memo?
- Facts from the data (the number is the step)
- What you built for them
- One small ask
Why it works
It points to one sentence on their own site and one public record that disagree. The fix is clear, and the sender has already done the reading.
First test
Fifty inactive participants whose live policy still names the framework.
Success looks like
Four replies out of twenty, and one recertification engagement.