← All scores

The Body Shop

Retail · thebodyshop.ca

13 out of 20 Compliance-bound

The hardest privacy policy measured anywhere in the index, at a brand built on ethical positioning.

Transparency, Consent, Clarity, Control, Empathy · clockwise from the top
01
Transparency 4 / 4

How many clicks to find the privacy policy from the homepage?

One click, from the footer. Opens as a web page with an effective date of April 2025.

02
Consent 1 / 4

Is there a meaningful choice about cookies and tracking before data is collected?

No banner, and no route described. Nothing appears on a first load and ten tracking identifiers are set immediately, including Hotjar session recording, Meta and TikTok. The policy describes no cookie opt-out at all, not a preference centre and not browser settings.

03
Clarity 2 / 4

How hard is the policy to read, how much of it is there, and can you get it in one piece?

Grade 17.1 across 4,923 words, in one place. Difficulty 0, length 3, access 4. This is the hardest prose measured anywhere in the index, comfortably past postgraduate level and harder than any bank, insurer or telecom in it. The cause is visible in the arithmetic: 4,923 words across 176 sentences, an average of 28 words per sentence. Measure it yourself.

04
Control 2 / 4

How many clicks to reach data settings, and can you delete your account yourself?

A data protection officer behind the word “here”. The only privacy contact is a mailto link labelled “here”, pointing at privacy@naturaeco.com, an address at the group that sold the company in 2023. It is a dedicated privacy address and it is easy to miss.

05
Empathy 4 / 4

Find the support page. How many clicks, and is there a way to speak to a human?

A form and a chat, one click away. Contact Us offers an enquiry form with a chat widget beside it. No phone number and no support address is published.

Overall finding

13 out of 20 Compliance-bound

The Body Shop sells itself on transparency about what goes into the bottle, and writes about your data at grade 17.1, the least readable document in this index. The two facts sit oddly together. Nothing here is hostile; the policy is dated, findable and complete. It is simply written for lawyers, offers no consent mechanism of any kind, and points its only privacy contact at a former owner’s domain.

Scored
8 August 2026
Region
Canadian site (thebodyshop.ca), private window
Session
Logged out throughout

Scored from public evidence only. No company can pay to change a score, and paid relationships are disclosed here. Read the independence statement.