Privacy & Cookie Compliance Markers

Privacy compliance is unglamorous, unforgiving, and increasingly enforced. The EU GDPR, UK GDPR, California CCPA/CPRA, Brazil LGPD, and a growing list of other regulators have settled on a similar set of minimum disclosures — privacy policy, cookie policy, terms, lawful-basis statements, data-controller information. Missing any of those isn't usually a fine in itself, but it's the entry point for complaints that escalate. Regulators tend to start at 'is the basic compliance furniture here?' and move outward; the absence of a privacy policy fast-tracks the investigation. The fix is operationally trivial — write the policy, link it from the footer — and yet startups routinely launch without one because the founder thought lawyers were for later.

Privacy law in the EU, the UK, and California expects a few basics to be easy to find: a privacy policy, a cookie policy, terms of service, a data processing agreement if you sell to businesses, and, where you set non-essential cookies, a consent banner that lets visitors refuse as easily as they accept. The report tells you which of those are missing or not linked from your pages. Whether the documents themselves are well drafted is a job for legal review.

GDPR / UK GDPR / CCPA enforcement risk. The ICO (UK), CNIL (France), DPC (Ireland), and equivalent EU member-state regulators have issued fines for missing or hidden privacy pages, ranging from small administrative penalties to seven-figure assessments for repeat offenders. Class actions have been filed in the U.S. over missing CCPA disclosures. Beyond regulatory risk: B2B customers (especially in regulated sectors) gate procurement on these documents being present. Their absence stalls deals.

Have visible, footer-linked Privacy Policy, Cookie Policy, and Terms of Service from day one. The policies don't need to be perfect on launch — a clear baseline document is better than nothing — but get them in place. Add a compliant cookie consent banner that gates non-essential cookies (analytics, marketing) until consent. The banner needs to offer reject as easily as accept (no 'accept' button styled to dominate), and respect the choice (don't fire trackers on reject). Honor browser-level signals like Sec-GPC. Keep the documents updated; date them; have a process for re-issuing on material changes. For B2B selling into the EU, prepare a Data Processing Agreement template — many enterprise procurement processes require one before signature.