diff --git a/src/wp-admin/includes/misc.php b/src/wp-admin/includes/misc.php
index c3c2ae5f10..8a3be1093d 100644
--- a/src/wp-admin/includes/misc.php
+++ b/src/wp-admin/includes/misc.php
@@ -1644,7 +1644,7 @@ final class WP_Privacy_Policy_Content {
 			/* translators: 1: Privacy Policy guide URL, 2: additional link attributes, 3: accessibility text */
 			printf(
 				__( 'Need help putting together your new Privacy Policy page? <a href="%1$s" %2$s>Check out our guide%3$s</a> for recommendations on what content to include, along with policies suggested by your plugins and theme.' ),
-				admin_url( 'tools.php?wp-privacy-policy-guide=1' ),
+				esc_url( admin_url( 'tools.php?wp-privacy-policy-guide=1' ) ),
 				'target="_blank"',
 				sprintf(
 					'<span class="screen-reader-text"> %s</span>',
diff --git a/src/wp-admin/privacy.php b/src/wp-admin/privacy.php
index 3b6933df33..557e4a4187 100644
--- a/src/wp-admin/privacy.php
+++ b/src/wp-admin/privacy.php
@@ -182,7 +182,7 @@ require_once( ABSPATH . 'wp-admin/admin-header.php' );
 		printf(
 			/* translators: 1: Privacy Policy guide URL, 2: additional link attributes, 3: accessibility text */
 			__( 'Need help putting together your new Privacy Policy page? <a href="%1$s" %2$s>Check out our guide%3$s</a> for recommendations on what content to include, along with policies suggested by your plugins and theme.' ),
-			admin_url( 'tools.php?wp-privacy-policy-guide' ),
+			esc_url( admin_url( 'tools.php?wp-privacy-policy-guide' ) ),
 			'',
 			''
 		);