A little cookie banner that says, “This site uses cookies,” does not automatically make your website compliant. If it is just a notice with an OK or dismiss button while Google Analytics, Meta Pixel, and other scripts are already tracking people in the background, you may have a problem.
This is not a someday issue. Privacy demand letters are real, enforcement activity is growing, and the cost of ignoring the technical side of website privacy can be far greater than the cost of getting your setup right.
The Cookie Banner Myth
A lot of websites have a banner at the bottom that says something like, “We use cookies.” Someone clicks OK, the banner disappears, and the business assumes it is covered.
That is the myth.
There is a major difference between a cookie notice and real cookie consent. A notice tells someone that cookies exist. Consent management actually gives them a meaningful choice and makes the site behave according to that choice.
A compliant implementation needs to do more than look nice. It should be capable of:
- Giving people clear consent choices.
- Allowing them to decline nonessential tracking.
- Blocking applicable tracking scripts until the required consent is received.
- Respecting an opt-out request when someone says they do not want to be tracked.
- Recording consent decisions where needed.
If your banner can be dismissed but your analytics and advertising pixels fire anyway, it is basically a sign in the yard that says you have an alarm system when there is no alarm behind it. It may look reassuring until somebody actually checks.
GDPR vs. CCPA: Opt-In and Opt-Out Are Not the Same
The alphabet soup gets confusing fast, but the core distinction between GDPR and CCPA is straightforward: opt-in versus opt-out.
GDPR: The Answer Starts as No
The General Data Protection Regulation, or GDPR, is an EU privacy law. It can apply to a business outside Europe when people located in EU countries visit and use that business’s site.
For nonessential tracking, GDPR operates on an opt-in model. The person must actively agree before applicable cookies and scripts start collecting data. Pre-checked boxes do not count. Silence does not count. Simply continuing to browse does not count as affirmative consent.
Under this model, the banner stays up until the person makes a choice. The default is no.
CCPA: The Answer Starts as Yes Until Someone Stops It
The California Consumer Privacy Act, or CCPA, works differently. It uses an opt-out model. Data collection may be allowed by default, but the website must provide a clear, working way for people to stop it.
That difference is the heart of it:
- GDPR: Do not start applicable tracking until the person actively says yes.
- CCPA: Collection may begin, but there must be a clear way to say stop.
There is no federal privacy law that neatly solves every situation across the United States. Privacy rules are developing state by state, with states such as Virginia, Texas, Iowa, and Utah also passing laws. Privacy requirements are also expanding globally, including in Canada, Brazil, Saudi Arabia, and elsewhere.
The practical takeaway is simple: if your website serves people in different locations, do not assume your own business address is the only thing that matters.
Why Privacy Demand Letters Are Becoming More Common
We have already seen businesses receive demand letters related to privacy compliance. One business was in California, another was in Arizona. This is not theoretical anymore.
One issue driving these letters is CIPA, the California Invasion of Privacy Act. CIPA is an old wiretapping statute that is being applied to modern online tracking practices. The allegation may be that a website allowed a script, analytics tool, advertising pixel, or session recording service to intercept communications without proper consent.
For example, a site that fires Google Analytics or Meta Pixel before the person gives required consent may be exposed to claims under that theory.
Demand letters often include:
- The business name and website address.
- A list of specific scripts allegedly firing on the site.
- An estimate based on a claimed $5,000-per-violation exposure.
- A scary total based on the number of alleged sessions or violations.
- A settlement request with a short response window, often around 20 to 30 days.
Many of these letters are template-driven and may result from firms or tools scanning websites at scale. That does not mean they should be ignored. It means businesses need to respond intelligently instead of panicking and sending money immediately.
What to Do If You Receive a Privacy Demand Letter
First, do not panic. But do not ignore it either.
A demand letter is not automatically a lawsuit, but you need qualified counsel to understand the difference, assess your options, and determine how to respond. Do not negotiate on your own just because the letter is written to scare you.
Here is the practical response plan:
- Document everything. Save the letter, note the date received, preserve relevant emails, and keep records of your current website setup.
- Audit the site immediately. Identify which scripts, cookies, pixels, and third-party services are firing.
- Fix the underlying technical issue. Put real consent infrastructure, logging, policy updates, and script controls in place.
- Speak with an attorney before responding. Find someone familiar with privacy and website compliance rather than treating this as a generic legal issue.
- Do not pay or settle blindly. Get counsel before making a decision.
This is not legal advice. Every business should confirm the requirements that apply to its own operations, audience, data collection practices, and jurisdictions.
The Four Layers of WordPress and WooCommerce Privacy Compliance
For WordPress, WooCommerce, and really any website, privacy compliance should be treated as a four-layer system. A banner alone is only a small piece of the work.
1. Consent Management
Consent management is the mechanism that presents choices and controls whether scripts can run. The important part is not the design of the popup. The important part is whether it actually blocks or permits tracking based on the selected preferences.
There are WordPress tools such as WP Consent, and there are dedicated compliance platforms such as CookieYes. A dedicated platform can be a stronger option because compliance is its entire job. These platforms can offer broader scanning, categorization, configuration, and management capabilities than a plugin installed and forgotten about.
There is a cost involved, sure. But that is part of the cost of running a website responsibly.
2. Consent Logging
Consent logging gives you a record of what happened. That can include timestamps and records of whether a person opted in, opted out, or changed their preferences.
If a compliance question comes up later, having a banner is one thing. Being able to show that the system recorded consent decisions is another.
3. An Accurate Privacy Policy
Your privacy policy needs to reflect your actual technology stack and actual data practices. A generic policy copied from somewhere else is not enough if your site collects, shares, tracks, or processes information in ways the policy does not describe.
Spell out what the site does with visitor information. If you use analytics, advertising pixels, forms, email marketing tools, payment processors, embedded content, chat tools, or other third-party services, the policy should be accurate about it.
A consent platform cannot rescue an inaccurate privacy policy. If you are doing the script blocking correctly but the policy does not disclose your data practices, that gap can still hurt you.
4. A Script Audit
A script audit is where you stop guessing. You need to inspect what is actually firing on the site.
Open browser developer tools, go to the Network tab, and test the site in a private or incognito browser session. Reload the page before accepting cookies, then check again after accepting or declining. Look for third-party scripts, network requests, and cookies that appear before consent.
This is where hidden problems show up. A marketing tool may have been installed months ago. A plugin may inject a pixel. A tag manager container may fire something that nobody remembered adding. The website can look clean on the surface while quietly sending data all over the place.
This same kind of technical discipline matters across other areas of website risk. For example, privacy and accessibility are separate issues, but both require active review instead of a set-it-and-forget-it approach. For more on that side of the equation, read our guide to website ADA compliance.
Google Tag Manager and Consent Mode V2
Google Tag Manager, or GTM, gives you a more organized way to manage marketing and analytics tracking than loading a bunch of individual plugins. It allows you to configure tags, triggers, variables, and events in one central location.
But GTM is not automatically compliant just because it is more organized. You still need to make sure tags respect consent states.
That is where Google Consent Mode V2 comes in. It should be configured so tags do not fire as if consent has been granted when it has not. Without proper configuration, a tag can keep firing regardless of the person’s choice, defeating the point of your consent setup.
The technical stack has to line up:
- Your consent management platform captures the choice.
- Your logging system records it.
- Your scripts are categorized appropriately.
- GTM and connected tags respect the consent state.
- Your privacy policy accurately explains the system.
A Practical 30-Day Website Privacy Action Plan
This can feel intimidating if you have never opened developer tools or looked at network requests. It is not impossible, though. Take it one week at a time.
Week 1: Audit What Is Firing
Start with the facts. Open your site in an incognito or private window and inspect it with browser developer tools.
- Open the Network tab.
- Reload the site without accepting cookies.
- Record the third-party scripts, cookies, pixels, and services that fire.
- Accept cookies and compare what changes.
- Decline nonessential cookies and compare what changes.
If you are a small business owner without a developer budget, there are tools that can help you understand what you are seeing. AI tools can also help you work through the results. A browser-based assistant such as Claude can be useful for explaining what a script does or helping interpret the findings.
You can also use the scanner at WP Consent’s cookie scanner to identify cookies and scripts that may be tracking people before consent.
Week 2: Install Real Consent Management
Once you know what is on the site, choose and install a real consent management platform or plugin. For a basic WordPress setup, a tool such as WP Consent may be appropriate. For more robust compliance needs, a platform such as CookieYes may be worth considering.
Do not just install the tool and call it a day. Feed it the information from your audit, configure the categories correctly, and verify that the scripts are handled properly.
Week 3: Rewrite the Privacy Policy
Update the privacy policy so it reflects reality. Describe the data you collect, the tools you use, how visitors can manage their preferences, and the relevant processing or tracking activities on the site.
Many consent tools can help generate portions of a policy, but the final version needs to match your actual website. If it says you do not use tracking while your GTM container fires analytics, advertising, and remarketing tools, that is not going to help.
Week 4: Turn On Logging and Validate Consent Mode
Enable consent logging. Confirm that your records include the necessary consent decisions and timestamps.
If you use Google Tag Manager, configure Consent Mode V2 and validate the behavior. Test the site again in a clean browser session. Make sure tags do not behave as though consent was granted before the person makes a valid choice.
What If You Do Not Need Tracking at All?
Here is the simplest route for some websites: do not track people.
If you are a local service business, painter, restaurant, law firm, or small shop and you truly do not need Google Analytics, advertising pixels, session recording, or other tracking, removing those tools can dramatically simplify your privacy situation.
If there is nothing collecting or sending visitor data in the first place, there is far less to manage. Of course, you still need to confirm that no plugins, embedded services, third-party widgets, or tag managers are quietly tracking in the background.
For businesses that do need analytics and advertising attribution, the answer is not necessarily to turn everything off. The answer is to implement it correctly. That includes understanding how privacy controls affect measurement and considering better data infrastructure such as server-side tracking when it fits your overall strategy.
Compliance Is Fixable, but It Has to Be Real
The goal here is not fear mongering. The goal is to get realistic about what a website is doing and fix the gaps before a demand letter forces the issue.
Privacy compliance is manageable when you break it into the right pieces:
- Consent management that controls scripts.
- Consent logging that records choices.
- An accurate privacy policy that reflects your real data practices.
- A script audit that proves what is actually happening on the site.
Letters are real. Fines are real. But the solutions are real too. Audit the site, get your consent system in place, make sure your policies match your stack, and do not wait until somebody else finds the holes for you.
For more Bright Commerce discussions on ecommerce, website operations, and digital strategy, visit Bright Commerce.
