1 in 6 UK SME Websites Had an Outdated Privacy Policy — Here's What That Could Mean for AI Trust Signals

Last updated: March 2026

When AI systems crawl a business website, they may read more than just product descriptions and service pages. Policy pages — privacy policies, cookie notices, terms of service — are part of a site's trust infrastructure. A policy dated 2019 does not just raise compliance questions; it may also signal to automated systems that a website has not been actively maintained. In a spot-check of UK SME websites conducted in March 2026, roughly 1 in 6 had privacy or cookie policies carrying clearly outdated dates.

---

TL;DR

• 4 out of 24 UK SME websites checked (17%) had privacy or cookie policies with visibly outdated dates
• The oldest policy found was dated April 2019 — approximately 7 years old at the time of checking
• That 2019 policy predates key updates to GDPR enforcement guidance, cookie consent regulation, and the emergence of AI-powered search
• Privacy policies sit at standard URL paths (/privacy, /privacy-policy) that AI crawlers routinely access
• Outdated policies may act as a negative freshness signal — suggesting a site is not being actively maintained
• GDPR compliance requirements have evolved since 2019; an old policy may no longer reflect current practice

---

Why Privacy Policies Matter Beyond Compliance

Privacy policies are a legal requirement under UK GDPR for any organisation collecting personal data. But their function on a website extends beyond compliance. They are one of the few pages that carry an explicit date, a stated contact address, a description of business practices, and a declaration of organisational responsibility.

For AI systems building a picture of a business, this combination of structured, dateable content may carry weight as a trust and freshness signal. AI-powered search tools — including large language model search features, AI overviews, and business intelligence systems — increasi