Tracker scan
We list every cookie, pixel, and third-party script on your site: analytics, ad pixels, chat widgets, booking and ordering embeds.
Cookie banner · Global Privacy Control · Google Consent Mode
Cookie consent that actually works, set up and checked for you.
Most small-business websites load tracking tags from Google, Meta, booking widgets, or chat tools the moment a page opens. We find every one, put a clear cookie banner in front of them, honor the privacy signals visitors’ browsers send, and recheck your site every month so it stays that way.
What we do
Pricing: Included with IT as a Service, or $5/month per location. Covers your website, online ordering pages, or booking pages that you control.
Consent banner
Accept all, Reject all, and Customize with equal weight. Optional tags are blocked until a visitor says yes, and the choice is remembered.
Global Privacy Control
When a visitor’s browser sends a GPC opt-out signal, ad and sharing tags stay off automatically, no click needed.
Google Consent Mode v2
Google Analytics and Google Ads start with consent “denied” and only update after the visitor chooses, so your Google tags respect the banner.
Cookie policy
A plain-language cookie policy listing what your site actually uses, plus a “Cookie preferences” link in the footer so visitors can change their mind.
Monthly rescans
New plugins and marketing tags creep in. We rescan monthly, fix anything that loads before consent, and send you a short report.
Accessible and fast
Keyboard and screen-reader friendly, readable contrast, works on phones, and it doesn’t push your page around when it appears.
Proof it works
We test that “Reject” really blocks the tags. The New York Attorney General has flagged sites whose privacy controls didn’t work as described.
Why it’s needed
If your site has a Meta pixel, Google Ads tag, TikTok pixel, chat widget, or session recorder, it is sharing visitor data with other companies. Several laws now require you to tell visitors, let them say no, and honor browser opt-out signals. Plaintiffs’ firms have also filed many lawsuits over tracking pixels and chat widgets on ordinary business websites.
The laws and the penalties
New Jersey Data Privacy Act (NJDPA)
In effect since January 15, 2025. It applies to businesses that handle personal data of at least 100,000 New Jersey consumers a year, or at least 25,000 if they earn money from selling personal data. Since July 15, 2025, covered businesses that use data for targeted advertising or sell it must honor universal opt-out signals such as Global Privacy Control. The Attorney General enforces it under the Consumer Fraud Act: up to $10,000 for a first offense and $20,000 for later offenses. The 30-day chance to fix a problem before enforcement ended July 1, 2026. Sources: NJ Division of Consumer Affairs FAQ (opens in a new tab), N.J.S.A. 56:8-166.11 (opens in a new tab).
California Consumer Privacy Act (CCPA / CPRA)
Applies to businesses that meet its thresholds (for example, more than $26,625,000 in annual revenue as of 2025) and collect data from California residents, including website visitors. Sharing data with ad pixels can count as “selling” or “sharing,” and covered businesses must honor opt-out preference signals like GPC. Fines are up to $2,663 per violation, or $7,988 per intentional violation or violation involving minors under 16 (2025 inflation-adjusted amounts), from the California Privacy Protection Agency (Civ. Code § 1798.155) or in Attorney General lawsuits (Civ. Code § 1798.199.90). Sources: CPPA monetary thresholds (opens in a new tab), § 1798.155 (opens in a new tab), § 1798.199.90 (opens in a new tab), California AG on opt-out signals (opens in a new tab).
California Invasion of Privacy Act (CIPA)
An older wiretapping law (Penal Code § 631) that plaintiffs now use against websites whose pixels, chat widgets, or session recorders send visitor activity to third parties without consent. There is no size threshold, and any California visitor can sue. Anyone injured may recover the greater of $5,000 per violation or three times actual damages, without having to show actual harm (Penal Code § 637.2). Sources: § 631 (opens in a new tab), § 637.2 (opens in a new tab).
New York
New York has not passed a comprehensive privacy law; the proposed New York Privacy Act did not pass in the 2025–2026 session. But the Attorney General says privacy statements and controls on websites must be truthful under New York consumer protection law, and has gone after sites whose “opt out” controls kept tracking visitors anyway. The SHIELD Act is a separate law about protecting data and reporting breaches, not cookies. Sources: NY AG website privacy controls guide (opens in a new tab), NY SHIELD Act (opens in a new tab).
Video Privacy Protection Act (VPPA)
If your site hosts videos and a pixel shares which videos a visitor watched, this federal law allows lawsuits for actual damages of at least $2,500 per person (18 U.S.C. § 2710(c)). Relevant mainly to sites with video content and ad pixels. Source: 18 U.S.C. § 2710 (opens in a new tab).
Visitors from Europe (GDPR)
If you serve customers in the EU or UK, non-essential cookies need opt-in consent first. GDPR fines can reach €20 million or 4% of worldwide annual revenue. Source: GDPR Article 83 (opens in a new tab).
Not legal advice. This page is general information current as of October 2026, not legal advice. Whether a law applies depends on your business, your size, and your visitors. Talk to your attorney about your obligations; we handle the technical setup.
See what your site is sharing
Included with IT as a Service, or $5/month per location. Book a free walkthrough and we’ll show you which trackers load on your site today, before anyone clicks anything. Call (212) 960-8139.