What makes website tracking illegal?

A tag is not illegal because it exists. It becomes a legal problem when it does one of a few specific things.

It fires before consent. In the EU, storing or reading information on a visitor’s device needs consent first unless it’s strictly necessary. In California and most US states with privacy laws, advertising use of personal data is opt-out instead, so there the problem is a tag that ignores an opt-out.

It ignores an opt-out. When a visitor declines, or their browser sends an opt-out signal, tags that keep firing turn a consent banner into a display that does nothing.

It shares personal data with a third party. Analytics and advertising tags routinely send data to platforms like Google, Meta, TikTok, and LinkedIn. When that data identifies a person, or reveals something sensitive such as a health condition, sharing it without consent or a contract in place is the basis of many enforcement actions and class actions (see Enforcement Watch).

It captures more than anyone intended. A pixel placed on a checkout, a registration form, or a health intake page can pick up an email address, a diagnosis, or a payment detail from fields it was never meant to read.

PII here means personally identifiable information: names, email addresses, phone numbers, device identifiers, or anything else that can single out a person. PHI is protected health information, the health-specific data that HIPAA covers.

Which laws apply to your tracking tags?

Five laws cover most of what a US marketing or analytics team needs to worry about. Each one is explained in full on its own page. Here is what each one asks of your tags.

Two more signals sit alongside these laws and come up on almost every page. Global Privacy Control (GPC) is a browser setting that broadcasts an opt-out, which 12 US states require businesses to act on: nine directly, including California, Colorado, Connecticut and Oregon, and three, including Texas, through a browser setting that acts as the consumer’s authorized agent. Google Consent Mode is the mechanism Google uses to adjust how its tags behave based on consent. Both have their own explainers. Global Privacy Control · Google Consent Mode v2

Which market are you in?

Which privacy rules apply to your tracking depends on where your visitors are, so we keep a compliance hub for each primary market. Each one covers the laws that apply there and links to the enforcement actions regulators and courts have brought.

Does a consent banner make my tracking legal?

Not on its own. A consent management platform, or CMP, shows visitors their choices and records what they pick. It does not physically stop a tag from firing. Tags that were hardcoded onto a page, added outside the tag manager, or piggybacked by another script can run regardless of what the banner recorded.

This is a common way a compliant-looking site turns out not to be compliant. The banner displays the right options, the visitor opts out, and a back-end tag keeps sending data anyway. Enforcement actions have repeatedly involved companies that had a banner in place. Enforcement Watch: consent banner enforcement cases.

A banner is a promise. Whether your tags keep it is a separate question, and it is one you have to test.

Is a specific platform compliant? Quick answers

Short answers to the pairings we get asked about most. Each links to a fuller treatment where one exists.

How do you know if your website tracking is legal?

You check what your tags actually do, in each consent state, on the pages that matter. That means confirming three things: that nothing fires before a visitor consents, that tags stop when a visitor opts out or sends a GPC signal, and that no tag is sending personal or health data it should not.

This is what DataTrue is built to verify. We run your site the way a real visitor would, in a real browser, in each consent state, and record exactly what every tag sent and when. A Coverage test crawls the whole site and reports what is tagged on every page, including tags added outside your tag manager. A Simulation test walks a specific journey, a checkout or a registration, step by step, and checks what each tag transmitted at each step. Sensitive Data Detection watches those payloads for personal and health data using fictitious personas, so we can test for a leak without ever putting a real customer’s data at risk. GPC is tested by loading your site with a GPC signal switched on and confirming the tags that should stop actually stop.

The result is a timestamped record of what fired, what it sent, and under which consent state. That is the evidence a privacy or legal team needs to show a regulator, and the earliest warning a marketing team gets when a tag starts doing something it should not.

See how consent verification works