Privacy compliance engineering for CCPA and GPC
Most privacy problems are engineering problems. A consent banner says one thing while ad and analytics tags keep firing. I built the scanning engine behind Privisy, which checks for exactly that, and I help teams find and fix these gaps on their own sites.
I built Privisy’s scanning engine
Privisy audits websites for CCPA, GPC, and tracker compliance. It detects third-party ad and tracking domains that keep loading after an opt-out signal, checks cookie consent behavior, and produces a weighted compliance score.
See Privisy →When this is a fit
Trackers keep loading after a visitor opts out
Tag managers, pixels, and embedded scripts often ignore consent state. It’s a common failure, and it’s visible to anyone who inspects your network traffic.
Your site doesn't honor Global Privacy Control
California’s CCPA regulations require covered businesses to treat a GPC signal as a valid request to opt out of the sale or sharing of personal information. Many sites never check for it.
Your consent tool is installed but not wired up
The consent management platform is on the page, but tags aren’t mapped to consent categories, or the default states are wrong.
You don't know what's running on your site
Years of marketing tags, agency scripts, and third-party embeds add up to data flows no one has documented.
What I do
Outside-in compliance scan
Load your site the way a California visitor would, with and without GPC, and record every third-party request. You get a list of what loads, what shouldn’t, and why.
Consent and tag remediation
Fix consent management, tag manager, and pixel configuration so an opt-out actually stops data from being sent.
GPC implementation
Detect the signal in the browser and on the server, apply it to tags and data flows, and keep a record that you did.
Ongoing monitoring
Scheduled scans that catch regressions when someone adds a new tag.
Evidence for your counsel
I handle the technical side and give your legal team clear evidence of what your site does before and after.
Questions
What is Global Privacy Control?
GPC is a browser signal, sent as an HTTP header and exposed to JavaScript, that tells a site the visitor doesn’t want their personal information sold or shared. Browsers such as Firefox, Brave, and DuckDuckGo support it, along with several privacy extensions.
Is honoring GPC required?
Under California’s CCPA regulations, covered businesses must treat GPC as a valid opt-out of sale or sharing. Several other states have similar rules for opt-out preference signals. Your counsel can confirm what applies to you.
How is this different from a consent management platform?
A consent management platform collects choices. It doesn’t guarantee your tags respect them. I test what your site actually does after a visitor opts out, then fix the gap.
Do I need consulting or just Privisy?
Privisy runs automated scans and scores the results. Consulting covers what comes after: tracing each violation to its source and fixing it in your stack.
I’m an engineer, not a lawyer. This work covers technical implementation and evidence, not legal advice.
Let's talk about where you're stuck
Tell me what you're working on and what's in the way. I'll tell you honestly whether I can help.
Email [email protected]