What is Privacy Compliance?

What Does a Privacy Compliance Program Include?

Every privacy law is different, but the work of complying with them looks similar from one organization to the next. Most programs cover:

• A data inventory. Map what personal data you collect, where it’s stored, and which vendors receive it. Every other part of the program depends on this map.
• A clear privacy notice. Tell people what you collect, why, and who gets it, in language they can follow.
• Consent and opt-out handling. Record what each person agreed to or refused, and make sure your systems act on it.
• Rights requests. Have a process to answer access, correction, and deletion requests within the deadlines each law sets.
• Vendor contracts. Put data protection terms in place with every vendor that receives personal data from you.
• Security and breach response. Protect the data you keep, and know who does what if it’s exposed.
• Ongoing checks. Confirm that what your notice and consent settings promise is what your systems actually do.

That last item is where most programs struggle, and the website is usually the reason.

Which Privacy Laws Apply to Your Organization?

If you have visitors from more than one country, you almost certainly answer to more than one privacy law. The International Association of Privacy Professionals’ (IAPP) latest count puts about 80% of the world’s population, more than 6.6 billion people, under some form of national data protection law. That number doesn’t include US state laws like the CCPA, so the real reach is higher.

The laws website teams run into most often:

• GDPR (EU and EEA): The General Data Protection Regulation requires a legal basis for any processing, and consent before most tracking. For the full breakdown, see our GDPR compliance guide.
• US state privacy laws: California’s CCPA, as amended by the CPRA, is the most actively enforced. About 20 states now have comprehensive privacy laws in effect. Our webinar on consent management platforms (CMPs) and state privacy regulations covers how to manage them without tracking each law separately.
• Sector laws: HIPAA, COPPA, and GLBA apply based on what kind of data you handle, not where your visitors live. Healthcare sites face extra risk from pixels that pass health information to ad platforms.
• Other national laws: Brazil’s LGPD (official Portuguese text), India’s DPDP Act, and dozens of others follow a GDPR-like model.
• Wiretap laws: Laws like the California Invasion of Privacy Act (CIPA) weren’t written for websites, but plaintiffs’ firms now use them to sue over session replay, chat widgets, and ad pixels.

How Privacy Laws Differ From One Region to the Next

The biggest difference between privacy laws is the default. Under GDPR and laws modeled on it, visitors are opted out until they agree to tracking. Under most US state laws, visitors are opted in until they say no, though many states require opt-in consent before processing sensitive data like health information.

It’s a big difference that changes how your site has to behave. A European visitor who lands on your homepage and ignores the cookie banner should see no advertising cookies at all. A California visitor in the same position can be tracked, but the moment they opt out, the tracking has to stop, and it has to stop everywhere you sell or share their data.

Opt-out signals add another layer. Global Privacy Control (GPC) is a browser setting that tells every site a visitor doesn’t want their data sold or shared. California treats it as a valid opt-out request, as do several other states. In 2027, California’s AB 566 will go further by requiring browsers to offer a built-in opt-out signal. A site can honor every “Do Not Sell or Share” click and still ignore GPC because the browser signal has to be detected and applied separately, and many consent implementations never turn that on.

Individual rights vary too. Most laws give people some version of access, deletion, and opt-out, but the details (who qualifies, how fast you have to respond, what counts as “sensitive” data) change from law to law. For organizations covering several regions, our guide to continuously monitoring consent management walks through testing each region and consent state.

Why Websites Are Where Privacy Compliance Breaks

Your privacy policy says what you collect. Your website decides what you actually collect. And on most sites, those two things drift apart.

A typical enterprise site runs analytics, ad pixels, session replay, chat, video players, and A/B testing tools, often added by different teams over several years. Each one can set cookies and send visitor data to a third party. Some load other tags that nobody approved. A consent banner sits on top of all of it, and it only works if every one of those tags respects what the visitor chose.

These are the failures we see most often:

• Tags fire before the visitor makes a choice. Advertising cookies load on page arrival, before the banner has read the visitor’s preference.
• The CMP and tag manager aren’t working together. The consent platform might record the visitor’s choice, but the tag manager doesn’t act on it. This can happen because tags aren’t tied to the right consent triggers, category names don’t match between the two systems, or the tag manager loads first and fires tags before the CMP has read the visitor’s preference.
• GPC is ignored. The site handles banner clicks but never checks the browser signal.
• Google Consent Mode is missing or wrong. Google has required Consent Mode v2 for re-marketing and ad personalization in the EEA and UK since March 2024 (website tagging best practices). When ObservePoint scanned Fortune 1000 sites, only 55.5% of those using Google Ads sent any consent mode flag, and only 52% of those sent the correct opt-out flag.
• Old pixels keep running. A tag from a vendor you dropped two years ago can still send data if you left it on your page.
• Page context leaks sensitive data. URLs, page titles, and form fields can reveal health conditions, financial details, or other sensitive information to any tag that reads them.

Regulators are already penalizing these exact failures. In September 2025, France’s CNIL fined Shein €150 million because advertising cookies loaded before visitors made a choice and kept loading after they clicked “Refuse all.” Shein has said it will appeal. In California, Healthline settled for $1.55 million in July 2025 over trackers that kept sharing data after opt-outs and a cookie banner that didn’t disable ad cookies. And Disney settled for $2.75 million in February 2026 after its opt-out toggle, webform, and GPC handling failed to stop data sharing across its services.

Regulators aren’t the only risk. Plaintiffs’ firms scan websites for session replay tools, chat widgets, and ad pixels on sensitive pages, then send demand letters under wiretap laws like CIPA, often before any consumer has complained. Our CIPA guide covers which tags show up most often in those letters.

None of these show up on a privacy policy review or a banner screenshot. You only find them by watching what the site actually does in each consent state.

How to Check Whether Your Website Is Privacy Compliant

The only reliable test is to visit your own site the way your visitors do, in every consent state and region that matters, and record what actually loads.

1. Inventory every tag and cookie. Scan broadly, and prioritize the pages where tracking and sensitive data overlap. Look for tags loading outside your tag manager or piggybacking on other tags.
2. Map each one to a consent category. Decide whether it’s strictly necessary, analytics, advertising, or something else. A cookie can belong to different categories in different regions. Don’t label a tag strictly necessary just because marketing relies on it; categorize it the way a visitor would.
3. Test each consent state. Compare what loads when a visitor makes no choice, accepts all, rejects all, and has GPC turned on. If an ad pixel appears after “Reject All,” your setup isn’t working correctly.
4. Test from each region you serve. A European visit should start opted out. A California visit should honor GPC.
5. Check high-risk pages separately. Checkout, account, health, and financial pages need a closer look for session replay, chat widgets, and pixels that can read form data. Consider requiring opt-in specifically for those tools.
6. Monitor on a schedule. A new campaign tag or a CMP update can break a setup that was working last month.

Our website tagging best practices go deeper on keeping tags consent-aware, and our CMP health check covers what you should be testing to make sure you get the most out of your investment.

Privacy Compliance FAQs

Does a Cookie Banner Make My Website Privacy Compliant?

No. A banner collects the visitor’s choice, but your tag manager and tags have to honor it. Leadership can assume the CMP takes care of everything, but the handoff between the CMP and Tag Management System is often where things go wrong. That’s why you have to test which cookies and tags load in each consent state.

Is Privacy Compliance the Same as Data Security?

They overlap but aren’t the same. Data security focuses on keeping unauthorized people out of a company’s databases, systems, and networks. Privacy compliance governs what your organization itself does with personal data, including what you collect and share with vendors on purpose. A website can be fully secure and still break privacy laws if its tags send visitor data to third parties without consent.

Do US Websites Need Consent Before Tracking Visitors?

Usually not under state privacy laws, which mostly work on an opt-out basis. The main exceptions is sensitive data, such as health or precise location information, which many states require opt-in consent to process. But you have to stop selling or sharing data once a visitor opts out, including through GPC. Wiretap laws like CIPA and sector laws like HIPAA can still require more care on sensitive pages.

Do I Have to Honor Global Privacy Control?

In California, yes. Several other states also treat GPC as a valid opt-out. Under GDPR, GPC alone doesn’t satisfy consent requirements, since European visitors should already start opted out.

How Often Should I Check My Website for Privacy Compliance?

Continuously, or at least on a regular schedule. Sites change every time someone launches a campaign, adds a vendor, or updates the consent platform.

See What Your Website Is Actually Doing

ObservePoint Audits scan your site’s pages for the cookies, tags, and data flows that don’t match your consent rules. Journeys go further, walking through specific consent states, regions, and paths like checkouts, including GPC-enabled visits, to confirm tags respect each choice. Request a demo to see your own site’s results.