Combine work on GDPR, CCPA, and CIPA compliance and accessibility all at once by preventing non-essential tracking before consent, honoring opt-outs and privacy choices, and make the entire consent and privacy implementation WCAG 2.1 AA conformant.
Here are the key steps to take:
- Block non-essential cookies and tracking technologies where consent is required. This addresses European consent requirements and provides a conservative approach to CIPA tracking risk.
- Add the CCPA layer where applicable: provide the required privacy choices, including the ability to opt out of sale or sharing, and automatically honor qualifying opt-out preference signals such as Global Privacy Control.
- Make your cookie banner / entire consent and privacy-rights implementation WCAG conformant
- Manually verify everything on the live website: confirm tracking is actually blocked, privacy choices are honored, and the installed consent banner is accessible.
- Maintain documentation and use record-keeping best practices: timestamped screenshots, screen recordings, independently issued documentation are all crucial if authorities or plaintiffs’ lawyers allege you’re in violation of a law or regulation.
- Rigorously filter any new installations, third-party integrations, services etc. on your website. You don’t want to complete all of this work and then have a marketing company install Meta tracking pixels without your knowledge.
If you’d like help with implementation, manual testing, documentation, and record-keeping, send us a message. We’d be happy to have you as a client and ensure you’ve not only satisfied privacy and tracking compliance requirements, but implementation of your banner and consent / opt-out options is fully WCAG 2.1 AA conformant.
| Step | What to do | What’s involves |
|---|---|---|
| 1. Inventory tracking | Identify every technology that collects, stores, or transmits visitor information | Review analytics, advertising pixels, session replay, chat, embedded media, tag managers, apps, plugins, and other scripts across the live website |
| 2. Classify what should be blocked | Determine which technologies are necessary and which require consent or other privacy controls | Document each technology, its purpose, what information it receives, when it activates, and whether it can operate before consent under the applicable rules |
| 3. Control tracking before consent | Prevent non-essential tracking from operating before consent where consent is required | Configure the consent system so applicable cookies, pixels, scripts, and third-party technologies remain inactive until the visitor makes the required choice |
| 4. Add California privacy controls | Implement applicable CCPA opt-out rights and preference signals | Provide the required privacy-choice mechanism, honor qualifying signals such as Global Privacy Control, and allow visitors to change their privacy choices |
| 5. Make the entire implementation accessible | Make sure every privacy and consent control can be understood and operated by people with disabilities | Manually test the banner, preference center, links, buttons, toggles, dialogs, and related pages for keyboard access, screen reader operation, focus, names and states, contrast, zoom, and mobile accessibility |
| 6. Manually verify the live website | Confirm that the privacy system actually controls tracking and that the accessible experience actually works | Test before consent, after rejection, after acceptance, after changing or withdrawing a choice, with Global Privacy Control enabled, and from different regions when your configuration is location dependent |
| 7. Document and re-test | Preserve evidence of the implementation and verify it again when the website changes | Save dated test results, screenshots, and screen recordings, and re-test after adding or changing plugins, apps, tags, themes, marketing tools, or website code |
How an All-In-One Setup Addresses Multiple Privacy Requirements
The laws do not impose identical requirements, but much of the website implementation can be combined into one technical framework.
In Europe, Article 5(3) of the ePrivacy Directive generally requires consent before storing information on, or accessing information from, a user’s device unless an exception applies, such as when the technology is strictly necessary to provide a service requested by the user. When consent is required, the GDPR defines consent as freely given, specific, informed and unambiguous, expressed through a clear affirmative action. Silence, inactivity and pre-checked boxes do not constitute valid consent.
CIPA, California’s wiretapping law, presents a different and still-developing area of website privacy law. California Penal Code § 631(a) addresses interception of communications without the consent of all parties. In the Ninth Circuit’s unpublished decision in Javier v. Assurance IQ, the court concluded that consent obtained after the alleged interception was too late for the § 631(a) theory before it. The decision did not resolve every issue surrounding CIPA and website tracking, but it illustrates why allowing third-party tracking to begin before consent creates unnecessary risk.
The CCPA, as amended by the CPRA, works differently. It gives California consumers rights that include the right to opt out of the sale or sharing of personal information. Covered businesses must honor qualifying opt-out preference signals such as Global Privacy Control, and in most instances businesses that sell or share personal information must also provide a clear privacy-choice mechanism such as a “Do Not Sell or Share My Personal Information,” “Your Privacy Choices,” or “Your California Privacy Choices” link. The California Privacy Protection Agency and its current CCPA regulations provide the applicable requirements.
Blocking non-essential tracking until consent therefore gives you one conservative technical foundation for European consent requirements and CIPA-related tracking risk. It does not, by itself, satisfy every CCPA requirement. CCPA-specific rights and disclosures still need to be layered on top, including applicable opt-out mechanisms and recognition of opt-out preference signals.
Why Accessibility Is Part of the Privacy Implementation
Privacy rights are exercised through interfaces: consent banners, preference centers, privacy-choice links, toggles, forms, dialogs and privacy policy pages. Accessibility therefore applies to the entire implementation, not merely the appearance of the cookie banner.
California’s own privacy regulations expressly address this. Section 7003 of the CCPA regulations requires covered disclosures and communications to be reasonably accessible to consumers with disabilities and specifically identifies the Web Content Accessibility Guidelines as a generally recognized industry standard for online notices.
A privacy tool can have an accessible-looking banner while the actual implementation still fails. A preferences dialog may not work by keyboard. A toggle may not expose its name, role or state to a screen reader. Focus may move unpredictably or become trapped. A privacy link may be obscured or difficult to operate. The site’s own scripts, theme, popups or other applications may also interfere with the consent interface after the privacy tool has been installed.
The installed experience therefore needs to be evaluated against WCAG. Controls must work by keyboard, interactive elements need appropriate accessible names, roles and states, text and controls need sufficient contrast, focus order must remain logical, and modal dialogs must manage focus appropriately. See the W3C’s guidance on keyboard accessibility, focus order, and name, role and value.
Installation Is Not Verification
Installing a WordPress cookie plugin, Shopify privacy app, consent management platform or other third-party tool does not mean your website is compliant and it isn’t proof that your website is compliant. The software may display a banner while trackers continue transmitting data in the background. Analytics, advertising pixels, session replay software, chat tools, embedded media, tag managers and scripts added through themes or other apps may load outside the consent tool’s control.
This is why the implementation must be manually tested on the live website. Before consent, verify that non-essential tracking that should be blocked is actually blocked. Reject tracking and verify it remains off. Accept it and confirm the appropriate technologies start only after the choice is made. Test the opt-out process, Global Privacy Control handling, preference changes and regional behavior where geographic targeting is used. The goal is to verify what the website actually does, not what the plugin dashboard says it is configured to do.
The accessibility implementation also needs manual testing. Automated accessibility scans can identify some problems, but the W3C states that no evaluation tool alone can determine whether a website meets accessibility standards and that knowledgeable human evaluation is required. Keyboard testing, screen reader testing, focus behavior and the operation of the actual consent and privacy controls all need to be checked after installation.
A plugin or app can make implementation easier. It cannot replace verification. Without testing the finished website, a website owner can have a polished consent banner and a dashboard full of green indicators while tracking still occurs before consent or people with disabilities still cannot use the privacy controls.
What You Need To Do
Inventory every tracking technology on your website: analytics, advertising pixels, session replay, chat, embedded video, newsletter tools, tag managers, applications and legacy scripts nobody remembers adding.
Configure blocked-by-default consent where required. Non-essential tracking should not begin until the visitor has made the required affirmative choice. Strictly necessary functions such as shopping carts, security and load balancing can continue where the applicable rules permit them.
Add the CCPA layer where applicable: provide the required privacy notices and opt-out mechanism, honor qualifying opt-out preference signals such as Global Privacy Control, and make sure a visitor can change a privacy choice after it has been made.
Test the entire consent and privacy experience for WCAG conformance as installed on the live website. Test with a keyboard and screen reader and evaluate the actual preference center, buttons, links, dialogs and controls rather than relying on the privacy vendor’s demo.
Verify actual tracking behavior on the live website. Load pages without consenting and confirm prohibited non-essential tracking does not occur. Decline and confirm it remains blocked. Accept and confirm the appropriate tracking begins only after consent. Test applicable CCPA opt-outs and Global Privacy Control. If your configuration changes by region, test from California and applicable European locations as well.
Document the results and re-verify when your website changes. New apps, plugins, tags, themes, marketing tools and code changes can introduce tracking or accessibility problems that did not exist when the consent system was first installed.
Summary
When you’re working on compliance with the various privacy and tracking laws and regulations, combine the efforts into one vs. working on them over time.
The banner is only the visible part. What matters is what happens behind it: whether tracking is actually prevented when it should be, whether opt-outs are actually honored, whether every visitor can operate the controls, and whether you have verified the implementation on the live website.
Accessible.org offers privacy and accessibility as one all-in-one service. We will implement your cookie and tracking banner and manually test to verify opt-outs are honored and privacy, tracking (or non-tracking), and accessibility are all in place. Contact us to learn how we can help with privacy and tracking compliance.
“`
