Data Privacy Consultant

It depends on who visits your site and what you load. If you have European visitors and set non-essential cookies, GDPR requires consent before those cookies are set. If you are a covered business under CCPA/CPRA, you need opt-out mechanisms including honoring Global Privacy Control, which for most sites is easiest to deliver through the same banner.

Your attorney makes that call. What I bring to the conversation is a concrete inventory: every cookie your site sets, which vendor sets it, and what fires before anyone clicks anything.

Consent Mode v2 is Google's framework for passing a user's consent choices into Google Tag Manager, GA4 and Google Ads. Instead of tags being present or absent, they adapt: with consent denied they send cookieless pings, and Google models the conversions it cannot observe directly.

If you advertise with Google and serve users in the EEA, it is effectively required for remarketing and audience features to keep working. Beyond that requirement, it is the difference between blocking tags and going blind, and blocking tags while keeping usable reporting.

It changes it rather than ends it. Observed conversions drop for the share of users who decline, modeled conversions fill part of that gap, and server-side tagging carries the signals you are still permitted to send.\n\nIn practice the bigger risk to your data is a broken implementation: consent defaults set after the tag loads, the wrong consent types required on a tag, or a GA4 configuration tag demanding all four consent types when it only needs analytics storage. Those mistakes suppress far more data than compliance does.

I have implemented Cookiebot, CookieYes, Usercentrics and the open-source CookieConsent library, and they all work when wired correctly.

• Licensed platforms (Cookiebot, CookieYes, Usercentrics) bring automated cookie scanning, consent logging and per-region rule sets, priced per domain and pageview.
• Open-source CookieConsent has no license cost and full control over behavior and design, at the cost of building the scanning and logging you would otherwise buy.

The deciding factors are usually how many domains you run, whether your legal team wants formal consent records, and how much design control you want over the banner.

You need a way for California residents to submit access and deletion requests, and a process behind it that actually answers them. On the website side I build the intake: a request form matching your design, conditional logic for request types, server-side validation, and authenticated delivery into whatever privacy platform or internal queue handles fulfillment.\n\nI also surface the request ID back to the visitor on submission, so both sides have a reference when the response comes due.

Global Privacy Control is a browser-level signal that tells a site the visitor opts out of sale and sharing of their personal information. Under CPRA, covered businesses must honor it, and honoring it means detecting the header or JavaScript property and applying the opt-out automatically, without waiting for a banner interaction.\n\nIt is a small piece of code and a frequently missed one, which is exactly why compliance scanners flag it.

Because the banner and the tag manager were never connected. The banner renders and stores a choice, but nothing translates that choice into consent state that GTM checks before firing, so the tags carry on as normal.\n\nThe fix is a bridge from the CMP into Consent Mode, denied-by-default state applied before GTM loads, and per-tag consent checks. Then a full container audit for the tags that bypass all of it: hardcoded scripts in the theme, obfuscated Custom HTML tags, and vendor loaders that inject their own pixels.

Only if you configured it. Most banners stop future scripts from loading but leave cookies already set by earlier visits sitting in the browser, which is exactly what a compliance scanner screenshots.\n\nI configure automatic clearing per category, then verify vendor by vendor that the cookies really disappear on reject, rather than trusting the library defaults.

Each platform has its own consent behavior and, in HubSpot's case, its own banner that will happily compete with yours. The clean setup is one CMP as the source of truth, the platform's native banner disabled, and a bridge that maps your consent categories onto the platform's consent API so attribution cookies load for users who accept and stay off for everyone else.\n\nAd pixels are similar: moved into GTM where they can be gated, given the correct consent types, and checked for the ad_user_data and ad_personalization signals that LinkedIn and Reddit tags are commonly missing.

It is adjacent, and it comes up in the same audits. A CSP controls which scripts are allowed to run at all, which is how you stop an injected third-party script from exfiltrating form data, and security questionnaires and audits routinely require one.\n\nI roll it out in report-only mode first, whitelist asset by asset from real traffic, then enforce, testing page by page. Payment frames, e-signature flows and video embeds are the usual casualties, and they get fixed rather than exempted.

No. I am an engineer, not an attorney, and the question of which laws apply to your business belongs with counsel. What I do is implement their guidance accurately, show them exactly what the site does today, and give them documentation they can review, so the legal decisions are made on real technical facts.