Enforcement starts with a browser tab, not a subpoena. In its most recent enforcement report, the state privacy agency disclosed that it had received over a thousand consumer complaints — and the majority of investigations began the same way: an analyst opening the company’s website and watching what happens before a single click.
Here are the seven checks that surface again and again in settlement orders — and what “good” looks like for each.
1. Trackers firing before consent
The number-one finding. Advertising pixels, analytics, and session-replay scripts that load before the visitor agrees — or after they decline — account for a large share of early enforcement actions. Block everything non-essential until consent is granted, and re-verify after every marketing deploy.
2. A banner that isn’t really a choice
Pre-ticked boxes, “accept” in bright purple with “reject” buried two menus deep, or no reject option at all. Regulators increasingly treat manipulative design as its own violation. Accept and reject must be equally easy, on the first layer.
3. Missing or broken opt-out links
Where the law requires a “Do Not Sell or Share” link, it must be conspicuous, functional, and honored — including honoring Global Privacy Control signals. A link to a 404 page has produced real fines.
4. Privacy notices that contradict reality
Your policy says you don’t sell data, but three ad-tech vendors load on the pricing page. Investigators compare claims against behavior routinely. Reconcile the two at least quarterly.
5. No visible way to exercise rights
A request method that’s hard to find — or a form that demands excessive verification — reads as obstruction. Link request options from your footer and keep verification proportionate to the data involved.
6. Dark patterns in the consent flow
Countdown timers, guilt-laden button labels, and interfaces that reset choices on scroll are now named explicitly in several states’ rules. Keep the flow calm, symmetrical, and persistent.
7. No evidence anything was done right
Even compliant companies stumble here. Without timestamped consent records, scan histories, and request logs, you can’t prove the good work happened. Documentation is the difference between a closed inquiry and a settlement.
The encouraging news: all seven are fixable with tooling rather than headcount. Automated scans catch the first six continuously, and a shared system of record solves the seventh permanently.