Most teams are defending the wrong thing
Ask a marketing team how they handle privacy compliance and you will usually get a list of documents. A privacy policy, reviewed by counsel. A cookie policy. A banner on the site. Maybe a data processing agreement folder. The work went into producing artifacts, and the artifacts are treated as the risk surface.
That is a reasonable instinct and it is aimed at the wrong target. Look at where US state privacy enforcement has actually landed since California started and the newer state regimes came online, and the pattern is remarkably narrow. It is not missing policies. It is not, for the most part, dramatic data breaches. It keeps coming back to the opt-out: the control a person uses when they want you to stop.
The privacy policy is the thing you show. The opt-out is the thing you get judged on.
The three failure modes that keep coming up
Strip the specifics out of the enforcement actions and public sweeps and you are left with three recurring problems.
1. The opt-out link that does not work
Missing entirely, mislabeled, pointing at a page that 404s, or pointing at a page that exists and does nothing. A "Do Not Sell or Share My Personal Information" link in the footer that opens a general contact form is a common variant. So is a link that was fine at launch and broke eighteen months later when the site was restructured and nobody re-checked the footer.
2. The Global Privacy Control signal that gets ignored
Several states treat a browser-level universal opt-out signal as a legally valid opt-out. The user does not have to find your link at all. Their browser tells your site, on every request, that they are opting out. If your site does not read that signal and act on it, you are receiving a valid opt-out and disregarding it, at scale, for every visitor who has it enabled.
Most sites we test do not read it. Not out of defiance. Nobody wired it up, because a consent platform can be installed and configured to look perfect without that particular setting ever being switched on.
3. Consent design where declining is deliberately harder
"Accept All" is a single prominent button. Declining takes you to a preferences screen, then requires toggling four categories off individually, then a save. Regulators have specifically called this pattern out as a dark pattern, and it is easy to demonstrate: count the clicks on each path and put the two numbers side by side. Asymmetry is not a subjective design critique here. It is a measurable property of your banner.
Why these three and not something more sophisticated
Because they are the failures anyone can verify from the outside, on a live site, without a subpoena or an internal document request.
Proving that a company mishandled data internally requires investigation. Proving that a link is broken requires clicking it. Proving that GPC is ignored requires turning on GPC and watching the network tab. Proving asymmetric consent requires counting. All three are objective, reproducible, and cheap to check, which means they can be checked at scale, on many companies at once, by a regulator with a small team or by a plaintiff's firm running a sweep.
Enforcement follows what is easy to prove. That is not cynicism, it is how any enforcement regime works. It also means your exposure is concentrated in exactly the parts of your setup that are visible from a browser.
Three controls that people treat as one
A large share of the failures we find trace back to a single misunderstanding: teams think they have one privacy control when they actually need three, and they have implemented one of them.
- The consent banner or floating cookie button. This is your consent management platform. It governs what fires when a visitor arrives. Necessary, and it is what most sites have.
- The named opt-out link. A distinctly labeled link, typically "Your Privacy Choices" with the standardized opt-out icon, or "Do Not Sell or Share My Personal Information." Multiple states expect a link by name, in a conspicuous place. A floating cookie icon is not that link. A visitor cannot be expected to know that the cookie widget is where you exercise a statutory right.
- The rights request path. A form or process for access, deletion, and correction requests. This is a different mechanism from either of the above, with its own response obligations and timelines.
They are three separate obligations. The CMP button does not satisfy the named opt-out. Neither of them satisfies GPC unless the site actually reads the signal. And none of them handle a deletion request. A site with a beautiful banner and none of the rest is not partially compliant. It has one of three controls.
If the distinction between a banner and actual enforcement is new to you, start with Cookie Banner vs. Consent Tool, then read Is Your Consent Banner Actually Blocking Anything? for what we find when we test the gating itself.
The two-minute self-test
Run this on your own site right now. It takes about as long as reading this section.
- Find your named opt-out link. Load the homepage and look for it without using search. If you cannot find it in the footer within fifteen seconds, neither can a visitor. Then click it. Does it open a real control that changes something, or does it open a mailto, a contact form, or the privacy policy? A mailto is not an opt-out mechanism.
- Turn on GPC and watch what fires. Brave has it built in, and there are extensions for other browsers. Enable it, open a clean profile, load your site with the network tab open, and look for requests to your analytics and advertising endpoints. If your ad tags fire normally with GPC on, your site is not honoring the signal.
- Count the clicks both ways. How many interactions to accept everything? How many to decline everything? Write both numbers down. If accepting is one click and declining is four, you have documented your own asymmetry, and so can anyone else.
Every one of these tests is something an outsider can run against you. That is the point. There is nothing here you can only see from the inside.
Passing the test once proves almost nothing
Here is the part that turns a one-time cleanup into an ongoing obligation. Consent behavior drifts, and it drifts silently.
- A developer adds a chat widget or a heatmap tool directly to the template, outside the tag manager, so it never passes through the consent layer.
- A vendor updates their script and changes what it loads or when it loads.
- A site restructure changes URLs and the opt-out link in the footer starts 404ing.
- Somebody troubleshooting a tracking bug disables consent gating to test something and does not put it back.
- A new marketing tool goes live through a platform integration that nobody told the privacy owner about.
None of these produce an error. Nothing turns red. The banner still appears, so the site looks the same to everyone internally, and the drift is only visible to someone actively testing the behavior. An annual audit means you can be out of compliance for eleven months and find out in the twelfth, and by then the evidence of what fired for whom is gone.
This is why we treat consent as a monitored system rather than a project. TagPipes watches what actually fires, under consent and without it, so a tag that starts ignoring the consent state gets flagged in days rather than discovered in a review. And Managed Privacy exists because the alternative, checking manually every quarter and hoping nothing changed in between, is not a control.
Test the thing that gets tested
Keep the privacy policy current. It matters, and counsel should own it. But recognize what it is: the document you present. Nobody is going to build a case around a well-written policy. They are going to click your opt-out link, turn on GPC, and count clicks on your banner, because that is what an outsider can do in two minutes and what they can prove afterward.
The opt-out is not a document. It is a behavior. Behaviors drift, so it has to be tested and monitored, not written once and filed.
Want to know how your site does on all three checks? Book a Data Audit or ask about Managed Privacy. We check whether your opt-out actually works, link, GPC, and consent symmetry, and then monitor it so it stays working.