Privisy Field Notes
Enforcement breakdowns, implementation guides, and original research on California privacy law, written from primary sources: the statute, the regulator's filing, and what a site actually loads.
Connecticut's second round of Data Privacy Act amendments takes effect October 1, 2026. Selling precise geolocation data is banned, purpose limitation tightens, and data brokers must register. Here is what changes on your website.
Start here
Short sequences that take one problem from first principles to a fix. Read them in order.
From which browsers send the signal to why a site can receive it and still ignore it.
How to test pre-consent firing, where it comes from, and the litigation built on it.
Registration, the DROP deletion platform, and who the enforcement is reaching now.
Browse
CalPrivacy and Attorney General actions, broken down by what regulators cited and what it means for a live website.
Governor Newsom signed SB 690 on September 30, 2026. From January 1, 2027, CIPA section 638.51 pen register claims over website and app tracking belong to the Attorney General alone. Section 631 wiretapping claims keep their private right of action.
In early September CalPrivacy fined a B2B contact-data company $36,400 for never registering as a data broker, then its Enforcement Division issued an advisory warning that a registry filing carrying wrong information can draw $200 a day. Both moves point straight at adtech and lead-gen companies that don't think of themselves as brokers.
Updated
In a single week, CalPrivacy fined two out-of-state data brokers a combined $168,890 — LocateSmarter $116,490 in the Agency's first action under both the CCPA and the Delete Act, Cybba $52,400 for never registering. The data-minimization holding reaches far beyond brokers. Here's what changed and who's exposed.
Step-by-step implementation: detecting and honoring opt-out signals, and testing what fires before a visitor chooses.
A DevTools walkthrough for finding out which trackers your own site contacts before a visitor touches your consent interface: the exact steps, what a failure looks like on the wire, and the false negatives a manual check quietly produces.
Honoring Global Privacy Control means three things: read the signal, suppress the sale and sharing that follows, and say so on the page. Here is how each one lands in Google Tag Manager, in server-side code, and in a consent platform.
GPC travels two ways at once: a Sec-GPC request header and a navigator.globalPrivacyControl property in JavaScript. Here is what each one carries, what a correct response from your site looks like, and what the .well-known resource is for.
What the CCPA, CPRA, and neighboring California laws require, explained in plain language with the statute cited.
Connecticut's second round of Data Privacy Act amendments takes effect October 1, 2026. Selling precise geolocation data is banned, purpose limitation tightens, and data brokers must register. Here is what changes on your website.
Governor Newsom signed AB 883 and AB 2561 on September 27, 2026. Data brokers get 30 days instead of 45 to work DROP deletion requests, and apps and operating systems can no longer quietly reset a privacy setting a user turned on. Both take effect January 1, 2027.
Governor Newsom signed SB 923 on September 27, 2026. From January 1, 2027, a CCPA deletion request reaches personal information a business got from third parties, and online-only businesses must offer a web form for privacy requests, not just an email address.
Where a consent platform's configuration and a site's production behavior drift apart, and how to verify it independently.
Consent Management Platforms have a fundamental blind spot. Here's what they're not telling you about the trackers firing on your site.
Updated
Client-side consent tools share the same structural blind spots. Here's what OneTrust, Cookiebot, and TrustArc can't see, and why.
Original benchmarks and audits built from real scans, with the methodology published alongside the numbers.
A scan of 1,019 commercial domains found 466 still loading marketing trackers after receiving a Global Privacy Control signal. Here is the benchmark methodology, the three recurring failure modes, and the remediation steps.
Updated
A $50M revenue e-commerce company thought they were compliant. Our audit revealed a very different story.
Updated
Archive
25 articles, newest first.
Put it to work
The free check sends a real GPC signal to one URL and shows whether marketing trackers stop. The full audit runs free from our homepage with no account; paying unlocks its evidence.