DONE FOR YOU โ€” AND KEPT THAT WAY

Privacy & Cookie Compliance for Your Website

Your privacy policy isn't protecting you.
Most sites have a cookie banner. Far fewer have one that actually honors the visitor's opt-out โ€” and that gap is what's getting small businesses sued.
Book a 15-minuteCompliance Check
(opens in a new tab)
Image
A blue-suited man holding a drink sits at an office desk, while a blue, furry character enjoys cookies nearby.

What's Up?

I recently went through every site in our hosting portfolio (an afternoon I'll never get back.) The majority of those websites are not compliant with current privacy law.

The minority already have a cookie banner โ€” but it doesn't actually honor the visitor's opt-out (the Global Privacy Control signal), which is the part that counts. Three things make this urgent today:

  • The lawsuits are already here โ€” firms are targeting small and mid-size businesses over trackers running without consent.
  • The regulators mean it โ€” California fined Sephora $1.2M for exactly this.
  • The deadline is set โ€” California's Opt Me Out Act (AB 566) takes effect January 1, 2027.
A man with curly, gray hair and a beard stands in a cozy room filled with books and a globe.

Chris Foley

Founder - PXLPOD Web Strategy
The actual Problem

The problem isn't your policy.

It's what your banner does (or doesn't do) when someone opts out.

Almost everyone gets this part wrong. Especially if it's a DIY job. Having a privacy policy and having a consent banner are two different things — one is disclosure, the other is consent — and plenty of sites have both. That's not where the exposure is.

The real gap: modern browsers can broadcast an opt-out — Global Privacy Control (GPC), and the older Do Not Track — that says "don't sell or share my data." A compliant banner has to listen for that signal and actually block tracking when it sees it. Most never turn that on. They pop up, collect a click, and keep firing every tracker regardless.

Worse: plenty of sites publish a policy claiming they honor those signals while the banner ignores them. Now you're not just non-compliant — you've put a promise in writing your own site breaks every day. That's the gap that gets noticed.

And no — the fix isn't "turn cookies off." Kill everything and your booking widget, store login, and even your fonts break. The work is honoring the opt-out while keeping the essential cookies running — fiddly by hand, and fiddlier still if the site runs Google Tag Manager.

$0M
the penalty Sephora paid California's first-ever CCPA enforcement action, 2022.
Why Now

You don't have to be big. You just have to be scannable.

Demand letters aren't sent by people browsing the web. They're sent by software.

The firms behind the lawsuit wave run automated scanners looking for one specific setup: trackers firing without consent. Your size never enters the equation โ€” the scanner doesn't know your revenue and doesn't care. It just flags the pattern, and a demand letter follows.

Sephora had an entire legal department and still paid $1.2 million. And from January 1, 2027, California's Opt Me Out Act puts a built-in opt-out in every browser โ€” so the exact thing Sephora got caught on becomes the default state of every single visit, on every site, automatically. Some of my own clients have already been sued. This isn't an edge case. It's a queue, and sites with unconsented trackers are standing in it.

Did you know

The things almost everyone gets wrong.

A smiling man with dark hair and a casual blue shirt, set against a gradient blue background.
myth
"I have a Privacy Policy page, so I’m compliant."
the reality

A policy is disclosure. Consent is a separate system. Having one without the other is like having a receipt for a purchase you never made โ€” the paperwork exists, the transaction doesn’t.

myth
"My cookie banner is up, so I’m covered."
the reality

A banner only counts if it honors the visitor’s opt-out signals โ€” Global Privacy Control and Do Not Track โ€” and actually blocks tracking. Many banners never have that turned on. They collect a click and keep firing everything anyway.

myth
"My policy says we respect Do Not Track and GPC, so we’re fine."
the reality

A policy claim isn’t a control. If the banner doesn’t enforce what the policy promises, you’ve published a promise your own site breaks daily โ€” which is worse than saying nothing.

myth
"I only sell in the US, so this EU cookie stuff doesn’t apply."
the reality

US law already applies. California’s CCPA requires honoring opt-out signals today, and more states join every year.

myth
"My business is too small to get sued over something as stupid as cookies."
the reality

The current wave of privacy lawsuits targets small and mid-size businesses, because the firms behind them run automated scans that flag unconsented trackers regardless of company size. Small makes you a faster target, not a safer one.

myth
"A cookie banner will break my site or tank conversions."
the reality

A correctly configured banner keeps essential cookies running โ€” logins, carts, booking widgets all keep working. Breakage comes from bad configuration, not from compliance.

myth
"Under CCPA I can leave all cookies on and ignore opt-outs."
the reality

California requires you to honor opt-out preference signals like Global Privacy Control. โ€œImplied consentโ€ is not a free pass โ€” ignoring a browser opt-out is exactly what cost Sephora $1.2M.

myth
"This is a future problem I can deal with later."
the reality

The lawsuits are live now, and California’s Opt Me Out Act (AB 566) takes effect January 1, 2027 โ€” after which every browser ships with the opt-out built in.

myth
"Compliance is a one-time setup."
the reality

We wish. The laws keep moving and so does your website. Compliance is a state you maintain, not a box you check. That’s why PodShield Privacy includes the year of management, not just the install.

myth
"If I just turn all cookies off, at least I’m safe."
the reality

Turning everything off breaks core functionality โ€” analytics, bookings, logins, even your fonts โ€” and still isn’t what the law asks for. The requirement is informed choice and honored opt-outs, not a dead site.

    Which are you?

    CCPA or GDPR.

    A shield emblem featuring a lock symbol, a check mark, and the acronym "CCPA" signifying data privacy compliance.

    CCPA

    Of the 20 (currently) US states with comprehensive consumer privacy laws that regulate how websites handle cookies, California is the strictest. Set yourself up to meet CA's requirements you cover the rest. More forgiving: cookies can generally start on, show a consent banner, and honor opt-outs and browser signals.
    A blue background with a circle of yellow stars, a central lock icon, and the text 'GDPR' below, representing data protection.

    GDPR

    Stricter: cookies start off, and you earn a yes before most fire โ€” which affects analytics and conversion data. Our workaround is a server-aware analytics setup so you still see the journey when a visitor declines. And our banner systems detect where the visitor is located and delivers the appropriate banner.

    This is really hard to DIY.

    The right setup handles both — but only when it's configured correctly for your specific site. Which one your site needs is exactly what we sort out on the call.
    The Fix

    Start with a 15-minute call.

    There's no one-size cookie fix โ€” the right setup depends on your site, your traffic, and how it's built. So we don't hand you a buy button and a guess. We start with a short call, figure out exactly what your site needs, and put it in place for you.

    You talk to us. We handle the rest.

    1. Book a 15-minute call. We look at your actual site together.
    2. We tell you exactly what it needs โ€” and which solution fits (some sites are simple; some need more).
    3. We set it up and keep it working โ€” most clients fold this into SecurePod Care so it just stays handled as the laws keep moving.
    Book a 15-minuteCompliance Check
    (opens in a new tab)

    Why a call and not a buy button?

    A buy button can't tell whether your site needs a simple banner or a full consent setup inside a complex tag manager โ€” and paying for the wrong fix is worse than waiting. Fifteen minutes gets you the right answer the first time.

    Already on SecurePod Care?

    You're covered โ€” we've already rolled this across your sites at no extra charge. Nothing to book, nothing to do. (That's the point of SecurePod: the fire drills are our problem.)
    FAQ

    Straight Answers

    Image

    Not fun. But not complicated once someone owns it.

    Questions? Book a quick call. On a SecurePod plan? Don't even bother โ€” we've got it.
    Book a 15-minuteCompliance Check
    (opens in a new tab)
    Ongoing SupportExplore SecurePod Care

    PXLPOD
    builds

    websites that grow your business.