If you run a small to mid-sized business, there’s a decent chance your website is quietly breaking a privacy law you’ve never heard of.
We’re not trying to scare you. But we do want to make sure you know what’s going on, because a few of our clients have already run into it firsthand.
Wait, what law?
You’ve probably heard of GDPR (Europe) and CCPA (California). For years, most business owners could shrug those off, since they only apply if you’re operating in or actively targeting customers in those regions. Statistically, most companies don’t.
But there’s a newer one worth paying attention to: CIPA, the California Invasion of Privacy Act. Unlike its predecessors, CIPA is catching businesses that never thought twice about privacy law, and the lawsuits are already showing up.
Here’s the trigger: if your website runs Google Analytics (or any similar tracking tool) before a visitor has the chance to say yes or no to cookies, that’s a violation. Doesn’t matter if you’re based in California or not. If a Californian visits your site and gets tracked before they’ve consented, you’re exposed.
Some of these lawsuits lean opportunistic. That doesn’t make them any less real, or any less something you have to respond to.
Why a basic cookie banner isn’t quite enough
You’ve seen the pop-ups: “This site uses cookies,” with an Accept button. Most businesses already have something like this. The problem is that a lot of these banners are decorative. They show up, they look official, but the tracking scripts start running the moment the page loads, consent or not.
What you actually need is a full Consent Management Platform (CMP). The good news is that most modern cookie banners can act as a CMP; they just need to be installed and configured correctly so that tracking is genuinely paused until a visitor opts in. Skip that step, and you’ve got a banner that looks compliant but isn’t.
The trade-offs, and there are a few
Nothing here is free, so let’s be straightforward about the costs:
- Some tools have a price tag. Many are free or low-cost, but not always.
- Setup takes time. Getting it configured correctly (not just installed) is what actually matters.
- Visitors will notice it. A pop-up is a pop-up. It adds a small bit of friction to the experience.
- Your Analytics will look different. Once tracking only starts after consent, some portion of your visitors will decline, and your traffic numbers will dip. Your site isn’t losing visitors. You’re just seeing more honest data.
Consider these the cost of doing business on the internet in 2026, not a reason to skip it.
Subtle or obnoxious? That’s actually your call
Here’s a wrinkle Mickey explored recently that’s worth thinking about once the CMP is in place: how loud should the banner be?
A subtle banner tucked at the bottom of the screen keeps the experience clean, but plenty of visitors will simply ignore it, which means plenty of visitors won’t be tracked. A bigger, more central banner gets more people to click “Accept,” which means better analytics, but a slightly more annoying first impression.
There’s no universally right answer. If clean data (like tracking ad spend) matters most to you, lean toward the more obvious banner. If you’d rather protect the visitor experience and can live with a smaller data set, keep it subtle. The important part isn’t which one you pick. It’s that you actually make the decision instead of leaving the default settings in place.
What to do about it
If your site is currently running analytics with no real consent gate in front of it, it’s worth a few minutes to get squared away, or a quick email to whoever manages your website.
If you’re a current GreenMellen maintenance client, we can review and correctly configure a Consent Management Platform on your site at no extra cost. If we’re not currently supporting your site, we’re happy to take a look and get you set up properly.
Reach out to us today, and we’ll help you cross this off the list, so you can get back to running your business with a little more digital peace of mind.
