Privacy Policy AdSense Compliance: What You Actually Need
A Privacy Policy listed services that were not active and omitted a disclosure AdSense specifically requires.
ShabelleHub had a Privacy Policy from launch. It was inaccurate in three specific ways, and one of those inaccuracies was a hard requirement for AdSense approval that we had missed entirely.
This is what was wrong, why it matters, and what a compliant Privacy Policy for an AdSense-monetised Next.js site actually needs to contain.
What the Original Policy Got Wrong
Problem 1: It Listed Services That Were Not Active
The original Cookies section stated:
> "We use cookies for analytics (Google Analytics) and to remember your preferences such as saved tools."
Google Analytics was not installed. No gtag script existed in _document.js. The only reference to GA was a defensive if (window.gtag) check in lib/affiliate.js that did nothing because gtag never loaded.
Stating that you use a service you do not use is an accuracy problem. If a user reads your Privacy Policy to understand what data you collect, they deserve an accurate description. A Privacy Policy that describes phantom services is not a Privacy Policy — it is a template that was never updated.
Problem 2: It Named Email Providers That Were Not Configured
The original newsletter section stated:
> "We may use email service providers like Mailchimp or ConvertKit to manage newsletter delivery."
Neither Mailchimp nor ConvertKit was configured. The newsletter endpoint (/api/subscribe) accepted submissions and logged them to the console. No email was ever stored or delivered anywhere.
Naming specific third-party processors you do not use is both inaccurate and potentially misleading — users may believe their data is being shared with Mailchimp when it is not going anywhere at all.
Problem 3: No Advertising Disclosure
This was the critical missing section. The Privacy Policy said nothing about advertising cookies or Google AdSense.
Google's AdSense programme policies require publishers to have a Privacy Policy that discloses:
- That third-party vendors (including Google) use cookies to serve ads
- That these cookies may be used to serve ads based on prior visits to this site and other sites
- How users can opt out of personalised advertising
A Privacy Policy without this section is grounds for AdSense application rejection. It is not a minor omission — it is the primary data-collection disclosure that AdSense requires from every publisher.
The Fixed Privacy Policy
We rewrote the relevant sections to accurately describe what ShabelleHub actually does:
Information We Collect
We collect information you provide directly, such as your email address
when subscribing to our newsletter or submitting our contact form. We may
also use third-party analytics tools to understand aggregate site usage,
such as which pages are visited. We do not sell your personal data."May also use" rather than "we use" — honest about the fact that analytics is planned but not yet installed.
Cookies and Similar Technologies
We use cookies or local storage to remember your preferences, such as
tools you have saved. If we enable an analytics service, it may set its
own cookies to measure site usage. You can disable cookies in your browser
settings, though this may affect site functionality such as saved tools.No mention of Google Analytics by name until it is actually installed. The "if we enable" framing is accurate for a feature that is planned but not yet active.
Advertising — The Critical New Section
This site may display advertisements served by Google AdSense and other
third-party advertising networks. These networks may use cookies, device
identifiers, and similar technologies to serve ads based on your visits
to this and other websites.
Google's use of advertising cookies enables it and its partners to serve
ads based on your visit to this site and other sites on the internet.
You can opt out of personalised advertising by visiting Google's Ad
Settings, and learn more about how Google uses data at
https://policies.google.com/technologies/partner-sites.This section is required. It must be present before submitting an AdSense application. The specific elements it covers:
- Third-party ad networks use cookies
- Ads may be personalised based on browsing history
- Users can opt out via Google's Ad Settings
- Link to Google's privacy information
Newsletter
If you subscribe to our newsletter, we use your email address to send
you updates about new AI tool reviews and comparisons. You can unsubscribe
at any time using the link in any newsletter email.No mention of Mailchimp or ConvertKit. When an email provider is configured, the policy will be updated to name it. Until then, the description is accurate: email is used to send newsletter content.
The Implementation
The Privacy Policy content is defined as a SECTIONS array in pages/privacy.js:
const SECTIONS = [
{
title: 'Information We Collect',
body: 'We collect information you provide directly...',
},
{
title: 'How We Use Your Information',
body: 'We use the email address you provide...',
},
{
title: 'Cookies and Similar Technologies',
body: 'We use cookies or local storage...',
},
{
title: 'Advertising',
body: 'This site may display advertisements served by Google AdSense...',
},
{
title: 'Affiliate Links',
body: 'Some links on this site are affiliate links...',
},
{
title: 'Contact',
body: 'Questions about this privacy policy? Use the Contact page.',
},
];The page component maps these sections to consistent HTML. The "Last updated" date appears at the top. Internal links connect to the Disclosure page and Contact page.
The Rule: Privacy Policies Must Match Reality
A Privacy Policy describes what your site actually does with user data — not what you plan to do, not what the template you started from assumed you would do, not what sounds more comprehensive.
For a Next.js site preparing for AdSense:
List only services you have actually installed. If GA is in your _document.js, mention it. If it is not, do not.
Name only email providers you have configured. If your newsletter endpoint writes to Resend, say Resend. If it only logs to console, say "we collect email addresses for newsletter delivery" without naming a provider.
Include the advertising disclosure before applying. This is not optional. Google requires it, and it should accurately describe the cookie behaviour of the ad network you are adding.
Update the policy when things change. When GA is installed, update the Cookies section. When an email provider is configured, name it. The "Last updated" date exists for a reason.
A Privacy Policy that is accurate on the day it is written but never updated becomes a liability as the site evolves. The sections that change most often are Cookies (when analytics is added or changed), Advertising (when ad networks are added), and Newsletter (when email providers change). Check these sections every time a new third-party service is integrated.
*This article is part of the ShabelleHub Building in Public series.*
📬 Get the latest AI tool reviews
Expert picks and comparisons, weekly. No spam.