Your ad pixels are the compliance risk, not your privacy policy
The gap between what a privacy policy promises and what the tag manager actually does is where enforcement happens. A practical audit.
Kicker · June 15, 2026
Most businesses treat privacy compliance as a documentation exercise. Someone buys a policy generator, pastes the output at /privacy, and considers the matter handled.
Meanwhile the tag manager is loading eleven third-party scripts on page one, before any consent interaction, three of which are recording form field contents.
The policy is not the risk. The gap between the policy and the behavior is the risk, and in a marketing-driven business that gap is almost always advertising technology.
Where the actual exposure is
Pixels firing before consent. A consent banner that appears while the scripts have already loaded and transmitted is decorative. The banner must gate the loading, not merely record an opinion about it. This is the single most common failure we find, and it is present on a majority of sites that display a cookie notice.
Session replay on sensitive forms. Replay tools capture keystrokes. On an intake form, an application, or a patient inquiry, that is a recording of information the person believed they were sharing only with you. Whether it is exposure under HIPAA, 42 CFR Part 2, a state privacy statute, or a wiretapping theory depends on the facts — but the tool almost never needs to be there in the first place.
Identifiers in URLs and event payloads. A confirmation page at /thank-you?service=detox&email=... sends both fields to every analytics and advertising vendor on the page, in the referrer, in the clear.
Remarketing audiences built from sensitive behavior. Building an audience of “people who visited the treatment admissions page” and targeting them across the web means telling an ad platform something specific about identifiable individuals. In regulated verticals this is not a gray area.
A twenty-minute audit you can run today
- Open your site in a private window with the network tab recording.
- Do not touch the consent banner. Note every third-party domain contacted.
- Anything transmitting before you clicked accept is your finding.
- Now load your most sensitive page — intake, application, checkout — and repeat.
- Read the query string on your confirmation URL out loud. If it contains anything you would not put on a postcard, fix it.
What good looks like
Consent-gated tag loading, where the container genuinely does not inject until a choice is made. Server-side tagging for the events you truly need, which reduces what third parties see. First-party, event-level analytics on sensitive paths with no cross-site identifiers. No replay tooling anywhere near a form that collects health, financial, or legal information. And a privacy policy that was written after the audit rather than instead of it.
The reason we care about this more than most marketing shops is straightforward: we install the pixels. If we are the ones putting the tracking in, we are the ones responsible for it being defensible.