Free website privacy scan · Vancouver, WA
They clicked Reject. Your site kept sending their data anyway.
In California, a visit like this is now $5,000 of exposure. Most owners never knew the trackers were there.
Fifteen minutes. We’ll tell you what we’d look at, what it would cost, $650 or $900, and whether your site even warrants it. If it doesn’t, we’ll say so.
Every tracker on your site by name, and how many keep firing after Reject. About a minute, no email.
- $0
- per website visitor, in California
- ~0
- businesses sued so far
- $0
- up to, in Washington
This is not hypothetical
This is hitting businesses like yours, not just big companies.
The law is CIPA, California's Invasion of Privacy Act. It is from 1967 and was written about phone wiretaps, but plaintiffs are now pointing it at the tracking pixels on business websites. The damages are $5,000 for every website visit, and nobody has to prove they were harmed. A reform group counts around 3,000 businesses sued, and it is not slowing down.
HVAC · Folsom, CA · Feb 2026
Folsom Lake Heating & Air
Folsom Lake Heating and Air was served in early 2026 over the standard analytics on its website. The owner thought she was running normal tools. Her whole exposure was calculated at $5,000 per visitor.
$5,000 per visitor
Electrician · Sonoma County · 2026
Element Electric
Element Electric's owner got hit a few months later, then found the same person had already sued three other local businesses with the exact same complaint, word for word. A defense attorney who has handled over 500 of these said the demand letters are so identical they are “almost automated.”
3 more businesses · same complaint
The part that stings
“They are tracking me. They are not getting sued, I am.”
One owner put it plainly: the big platforms are the ones doing the tracking, but she is the one getting sued, not them.
Washington, the one that reaches you here
Washington's My Health My Data Act lets people sue directly, stacks damages up to $25,000, and defines “health data” so broadly it can catch a site with no obvious health angle. A Seattle retailer was sued in 2025 just for pixels sending purchase and appointment details to Google. If your site touches wellness or appointments, this is the one to watch.
Oregon
As of January 2026 the state can enforce directly, your site has to honor universal opt-out signals, and you cannot sell precise location data.
We’re not here to scare you into anything, and none of this is fully settled law. But it’s real, it’s spreading toward small local businesses, and the demand letters are cheap to send. Knowing what your site does is the cheap side of this. Finding out in an envelope isn’t.
The part owners never see
The banner is often just for show.
Most people assume a cookie banner means they are covered. Usually it is the opposite. On a lot of small-business sites the tracking pixels are hardcoded to load the moment the page opens, so the Meta Pixel, Google Analytics, a session recorder like Hotjar or Microsoft Clarity, all of it fires whether the visitor clicks Accept, clicks Reject, or never touches the banner. The Reject button changes nothing. That data still travels out to ad platforms and brokers like LiveRamp and Acxiom, and the banner sitting on top of it can make things worse, because now the site is promising a choice it does not keep. This is almost never on purpose. It is usually a plugin someone installed a year ago and forgot.
They click Accept
cookie banner- Meta Pixelstill sending
- Google Analyticsstill sending
- Microsoft Claritystill sending
- TikTok Pixelstill sending
Everything fires, as expected.
They click Reject
cookie banner- Meta Pixelstill sending
- Google Analyticsstill sending
- Microsoft Claritystill sending
- TikTok Pixelstill sending
Everything fires anyway.
The free tool
Start with the free Exposure Scan. It is genuinely free and genuinely useful.
It takes about a minute, and it gives you a plain-language read on three things most owners have never seen:
- Every third-party tracker your site loads, by name and count.
- How many of those keep firing after a visitor clicks Reject.
- Whether your privacy policy actually names the trackers you’re running, or says nothing about them.
That is a real snapshot of where you stand, yours to keep. Most people are surprised by the number alone.
The scan lives on its own page now, so you can send it to someone without sending them a sales pitch.
Run your free Exposure ScanNo login, no access to your site, no call required.
See a real sample
This is what comes back.
The first result is this site, scanned honestly, findings and all. Switch to a typical site to see the result most owners get.
If you want the full picture
The paid audit, when the free scan raises questions.
The Exposure Scan shows you the headline. The paid audit is the whole story, done by a person, not a robot. We go through every tracker, document what fires before consent, look at whether your banner is designed to mislead, find the gaps between what you run and what your policy admits to, and flag where each finding creates technical exposure in California, Washington, or Oregon. You get a short report you can actually read: a plain summary, findings ranked high, medium, and low, the fix for each, and a clear line on anything worth taking to your attorney. If you want the problems handled instead of just named, we can do that too, quoted from what the audit finds.
$650 for most small-business sites. Wider coverage, up to 10 pages and two consent or booking flows, is $900 after a quick fit check. Fixes are quoted from what the audit finds.
Paid in full before work starts, and we need written permission to scan your domain. Running an automated scan against someone’s property without asking is the kind of thing that should require asking.
The honest boundary.
We audit what your site actually does with visitor data and how your consent experience is designed. We flag where that creates legal exposure and tell you what to bring to an attorney. We don’t give legal advice or certify compliance. That line is the whole point. You get a clear read of what’s happening and what to do about it, from people who work in websites, not billable hours.
It is also a narrow job on purpose. If tracking turns out not to be your worst problem, the rest of what the studio builds is published with the prices on it.
Who this is for
If your site runs Google Analytics, a Meta or TikTok pixel, a booking or quote form, or a chat widget, it is running trackers, and this applies to you. It matters most in Washington, and for any site touching health, wellness, or appointments, where the rules are strictest and the exposure is highest.
Questions
Straight answers.
Genuinely free
Start with the free Exposure Scan.
See every tracker your site loads, how many ignore a Reject, and whether your policy names them. Yours to keep, in about a minute.