The Privacy Policy Was Perfect. The Website Fired 86 Trackers Before Consent
We recently ran a full compliance scan on the website of a children's education brand that millions of parents know and trust. The brand does almost everything right on paper. Its privacy policy is thorough, well written, and legally complete. Its California disclosures are textbook. If you judged this company by its documentation alone, you would call it a model of privacy compliance.
Then we looked at what the live website actually does. Before we clicked a single button, before any consent was requested or given, the site set 86 tracking cookies and fired requests to 17 known advertising and analytics networks - Google, Facebook, TikTok, Criteo, Taboola, Bing, and more. There was no cookie consent banner anywhere on the page. There was, quite literally, no way to say no.
The final score was 54 out of 100. Not because this is a careless company - it clearly is not - but because no one had ever tested whether the live site did what the policy promised. This is the single most common failure we see, and it is worth understanding in detail.
The policy was excellent. That is the trap.
It is tempting to assume a low compliance score means a company that does not care. In this case the opposite was true. The written privacy program was genuinely strong:
The privacy policy contained all nine required GDPR disclosure elements - the identity of the data controller, the purposes and legal bases for processing, the full list of data subject rights, the right to withdraw consent, third-party sharing, retention periods, and the right to complain to a supervisory authority.
A reachable privacy contact was published, satisfying the requirement to identify who handles data inquiries.
On the California side, the site passed every CCPA check - a working "Do Not Sell or Share My Personal Information" link, all required disclosures, and a clear list of the categories of personal information collected in the past twelve months.
In other words, the legal team did their job. The document was compliant. The problem lived somewhere the document could not reach: in the code running on the homepage.
What the live website actually did
A privacy policy is a promise. The website is where you either keep it or break it. Here is where this site broke it.
86 tracking cookies fired before consent
The most serious finding: the moment a visitor landed on the homepage, the site set 86 non-essential cookies and sent data to advertising and analytics platforms including Google Tag Manager, DoubleClick, Facebook, TikTok, Criteo, Taboola, Microsoft Bing, Segment, and Mixpanel. All of this happened before any consent was requested.
Under GDPR Article 6(1)(a) and the ePrivacy Directive Article 5(3), non-essential cookies - anything used for analytics, advertising, or social tracking - require the user's freely given, prior consent. Only strictly necessary cookies are exempt. Firing dozens of advertising trackers before the visitor has agreed to anything is exactly the pattern regulators and plaintiffs' firms look for, because it is unambiguous and easy to detect automatically.
There was no consent banner at all
Across multiple independent checks, we found no cookie consent banner and no consent mechanism of any kind. This compounds the first problem: not only did tracking start before consent, there was no way for a visitor to grant, refuse, or manage consent even if they wanted to. Two additional checks - whether a reject button actually stops tracking, and whether the banner uses manipulative "dark patterns" - could not even be run, because there was no banner to test.
Functional and unclassified cookies were also set early
Beyond the advertising trackers, 16 functional cookies and 5 cookies of unknown purpose were set before consent. Functional cookies sit in a legal grey area - some data protection authorities require consent for them, others accept a legitimate-interest basis - but their presence before any consent decision is another signal that the site was not gating cookies on user choice at all.
Accessibility gaps that invite ADA lawsuits
The scan also checked the site against the Web Content Accessibility Guidelines, which underpin ADA Title III website lawsuits in the United States. It found:
Images missing text alternatives - 5 of 96 images had no alt text, a WCAG 2.1 Level A failure and the single most-cited issue in accessibility demand letters.
Form fields without accessible labels - 2 of 16 fields, including the site search box, lacked a programmatic label, which breaks the experience for screen reader users.
Insufficient color contrast - a promotional "10% off" element measured a 2.48:1 contrast ratio against a 3:1 minimum.
No skip-navigation link - screen reader users had no way to bypass repeated navigation and jump to the main content.
None of these are exotic. They are the routine, high-frequency findings that automated plaintiff scanners surface every day.
Why good companies end up here
This gap between a compliant policy and a non-compliant site is not a sign of bad intent. It is structural, and it shows up for three predictable reasons.
Policies are written once; websites change every week. A privacy policy is drafted carefully and then rarely touched. The website, by contrast, ships new code, new campaigns, and new third-party scripts continuously. A site that is compliant on launch day drifts out of compliance with every marketing integration.
Marketing adds trackers that legal never sees. Most of those 86 cookies did not come from a developer. They came from a tag manager, where a marketer can add a new advertising pixel in minutes without touching the codebase or telling anyone in legal. Each pixel is a new data flow, and none of them ask whether consent was collected first.
Nobody tests the live site the way a regulator does. Compliance is usually treated as a document review, not an engineering test. But a regulator or a plaintiff's firm does not read your policy - they load your site in a browser, watch what fires, click your opt-out, and measure whether anything actually changed. If your own testing does not replicate that, you find your gaps at the worst possible moment.
What this costs
The exposure here is not theoretical. GDPR penalties reach up to 20 million euros or 4% of global annual revenue, whichever is higher, and consent failures are among the most frequently enforced violations because they are so easy to prove. In the United States, ADA website accessibility lawsuits continue to rise year over year, and the majority target companies well below the enterprise tier. When the site in question serves children, the reputational stakes climb even higher.
The uncomfortable reality is that the same automated scans plaintiffs and regulators run are available to anyone. The only question is whether you run them on yourself first.
How to check your own website
You do not need to guess whether your site has the same gaps. You can test for them directly, and behavior is what matters - not the text of your policy. At a minimum, verify the following on your live site:
Do trackers fire before consent? Open your homepage in a fresh browser session and inspect the network activity and cookies before clicking anything. If advertising or analytics requests fire immediately, you have the same core problem.
Does a consent banner actually load, and does clicking "reject" genuinely stop the tracking rather than just closing the banner?
Do your opt-out and deletion mechanisms work end to end, or do they exist only in the policy document?
Does your site meet basic accessibility requirements - alt text on images, labels on form fields, sufficient contrast, a skip-navigation link?
This is exactly what Complyy does automatically. We test your live website from the outside, the same way a regulator would - loading the site as a real user, watching what fires before consent, exercising your opt-out and deletion flows, and checking every accessibility signal. Every finding comes with timestamped, court-admissible evidence, so you can see precisely where your website and your privacy policy do not line up, and fix it before someone else finds the gap for you.
Your privacy policy is a promise. The only way to know whether your website keeps it is to test the website itself.