Privacy Policy Missing Data Subject Rights Information

xx

I've noticed that Kagi's privacy policy does not clearly state the GDPR/CCPA rights available to users. Specifically, the privacy policy should inform users about:

Right of access - Users can request and view their personal data
Right to rectification - Users can correct inaccurate information
Right to erasure - Users can request deletion of their data ("right to be forgotten")
Right to restriction - Users can restrict how their data is processed
Right to object - Users can object to certain types of data processing
Right to data portability - Users can request their data in a portable format
Right to lodge a complaint - Users can file complaints with data protection authorities

Additional Information Needed

The privacy policy should also include practical instructions for:

How to delete your account:
Show how users can delete their Kagi accounts via the Kagi website (https://kagi.com/settings/user_details)
How to submit privacy-related questions:
You could use support@kagi.com as a contact method for users who have questions regarding privacy or use a dedicated email for this.

Why This Matters

This is not just a best practice, it's a legal requirement under GDPR for websites serving EU and UK customers. Users have these rights regardless, but organizations must actively inform them.

I'm genuinely puzzled why this hasn't been addressed yet, as adding this information to the privacy policy doesn't require significant effort. A simple, clear section outlining these rights and the procedures to exercise them would bring Kagi into full compliance and improve user trust.

bostonblack

Thank you! This is important ideed.

xx

bostonblack I’m a bit shocked that it hasn’t been done yet.

As far as I know, they’re breaking the law. All countries that serve EU/UK customers must state EU/UK user rights in their privacy policy and also abide by GDPR.

I expected better from Kagi, hopefully they don’t try and brush it off.

bostonblack

xx it is probably just an oversight and not on purpose, as the laws apply anyhow. This also technically isnt product but legal "feedback" so maybe an email to vlad or their info would be a better way to motivate this change. Of couse this is not your job, but as your already quite into the topic, maybe this would be of help to them 🙂

xx

bostonblack I've already been told that this was mentioned to @Vlad before. This Kagifeedback thread is enough.

You can do it if you wish to

RoxyRoxyRoxy

I'll raise this with legal.

bostonblack

RoxyRoxyRoxy has this been raised? I read in some boards, that this is also a major gripe that keeps people from using Kagi. Also this is a lawsuit coming if Kagi continues to serve European Customers, which I guess it would want, right?

fxgn

bostonblack Also this is a lawsuit coming

Who's gonna be the one to sue them?

RoxyRoxyRoxy

bostonblack Yes, it has. We're reviewing our GDPR processes right now, and will update our privacy policy soon.

xx

fxgn The EU can attempt to fine them

Edited the link:
https://www.edpb.europa.eu/about-edpb/about-edpb/members_en

fxgn

xx the EDPS, which you linked, deals with privacy violations by the European Government itself, not by private companies. GDPR violations by private companies have to be reported to your country's Data Protection Authority - and, unless the case directly involves your own data (ie. a company refuses to delete it), they're not even required to respond to your complaint. In reality I think the only way to have Kagi fined over this is for someone to take them directly to court - which is probably possible (though I'm not a lawyer), but that would require someone to be concerned about this enough to spend significant time and money on this.

I'm not saying that not having a proper privacy policy is acceptable, by the way. It's just not true to say this is a "lawsuit coming", because those laws are unfortunately barely enforced.

xx

fxgn You’re right, it can be reported here:

https://www.edpb.europa.eu/about-edpb/about-edpb/members_en