What your tags actually do: building a tracking inventory

The lawsuits target the gap between what the privacy policy says and what the site does. Most companies have never measured the second half. Whether any given tag is lawful for you is counsel's call — this is how you find out what's actually firing.

The theory these suits run on

A wave of California cases argues that common marketing technology — session-replay scripts that record cursor movements and keystrokes, chat widgets whose transcripts route through a vendor, advertising pixels that forward page views and form inputs — amounts to intercepting a communication or installing a tracking device without the visitor's consent, under the state's wiretapping and pen-register statutes. Courts are split on much of it; demand letters don't wait for the splits to resolve. What makes a target attractive is rarely the tag itself — it's a privacy policy that doesn't mention the tag, and a site that fires it before anyone could consent.

Ground truth beats the tag manager's opinion

The inventory is measured on the live site, not read out of the tag manager — because tags inject tags, platform apps add pixels nobody remembers approving, and "paused" campaigns leave scripts behind. The measurement is a recorded browsing session with the network log open: every third-party request, keyed to the vendor behind it, what identifiers and form data ride along, and — the load-bearing column — when it fired: before any consent interaction, after, or regardless of what the visitor chose.

What the inventory contains

• The roster. Every third-party script and pixel: vendor, purpose, what page types it runs on.
• The payloads. What each one actually transmits — URLs, identifiers, email or form values, replay data, chat content.
• The timing. What fires pre-consent. On most storefronts this column is the whole story.
• The policy diff. The privacy policy's claims, side by side with observed behavior: trackers it never mentions, categories it denies, a consent banner the tags ignore.

The fix, once you can see it

With ground truth on the table the remediation is mechanical: remove what nobody can justify (there's usually some), condition what remains on actual consent — wired so the tags genuinely wait, not just the banner — and bring the disclosure in line with reality, in plain words. Then a dated record of the corrected state: the roster, the timing, the policy as amended. If a demand letter arrives later, the difference between that file and nothing is the difference between a short conversation and a settlement negotiation.

Contact

Email [email protected]. You'll get a reply from me — usually the same day, always from a person.