Compliance How-To: Practical, Step-by-Step Guides

Ask “is HubSpot GDPR compliant?” and you’ll get a reassuring “yes, with the right settings.” That’s true for one half of the picture — the CRM and email side, where HubSpot ships genuinely good tooling. But there’s a second half most guides skip, and it’s the one that actually draws regulator attention: the moment a visitor lands on your site, HubSpot’s tracking code sets cookies before anyone has consented — and HubSpot’s own banner doesn’t stop it. This guide separates the two problems cleanly, then walks through the specific consent gaps EU and UK sites have to close in 2026.

WooCommerce runs on WordPress, so you’d think consent works the same way — but a store has more at stake. Conversion pixels, checkout tracking, and session-replay tools cluster on exactly the pages carrying the most personal data. This guide covers how to set up a WooCommerce cookie banner that blocks those trackers before consent — and why the checkout page is where the real GDPR and CIPA risk lives.

Adding a cookie banner to WordPress is easy — there are dozens of plugins. Getting one that actually blocks trackers before consent, rather than just showing a notice, is the part that matters. This guide covers how to add and configure a WordPress cookie banner, how to tell a real blocker from a notice-only plugin, and the US litigation angle most WordPress tutorials skip.

Webflow gives you total design control — and ships with no built-in cookie consent at all. Every tracker you add loads through custom code, which means your GA4, Meta Pixel, and Hotjar fire the moment a visitor lands, before anyone accepts anything. This guide covers how to add a Webflow cookie banner properly: where the code goes, how to block scripts before consent, and the US litigation angle most Webflow tutorials skip.

Shopify has a built-in cookie banner and a Customer Privacy API that, set up correctly, blocks its own analytics until a shopper consents. But the moment you add a Meta Pixel, GA4, or Hotjar through theme code instead of Shopify’s pixel system, those scripts fire regardless of the banner. This guide covers both halves: enabling and configuring the native banner, and closing the tracking gap it leaves — the one that carries real GDPR and CIPA risk.

Complianz is one of the most trusted consent plugins in the WordPress world — but it’s WordPress and Shopify only, and it gates the compliance basics behind Premium. If you’re outgrowing that, here’s the current 2026 guide: 8 Complianz alternatives ranked on what actually matters — platform reach, price, GDPR depth, US state law, CIPA coverage, and Google Consent Mode v2.

Getting the banner size for Squarespace right is where most people start — format, placement, text size — and Squarespace gives you real control over all three. But a well-sized banner isn’t the same as a compliant one. This guide covers both: how to size and set up the cookie banner, and how to make sure it actually blocks trackers before consent.

Setting up a Wix cookie banner in 2026 isn’t one decision — it’s three. Wix’s own native banner, the Usercentrics app Wix now recommends, or an independent tool: each covers a different amount of what privacy law actually requires. Here’s how to set one up, and how to tell which trackers your banner is really blocking.

A clear, current guide to what CCPA compliance actually requires in 2026 — who it applies to, every obligation (including California’s new January 2026 rules that most guides haven’t caught up to), the penalties, a practical checklist, and how to comply without drowning in legal jargon.

OneTrust cookie consent pricing now starts at a roughly $10,000/year minimum — with no public price list and renewal increases some buyers report at several hundred percent. This is the real 2026 cost picture across eight consent management platforms, the billing models that quietly inflate your bill, and the one cost most pricing pages ignore entirely.

If you live in California, you have the strongest data-privacy rights in the United States — the right to know what companies collect, delete it, correct it, and stop them selling or sharing it. This is a plain-English guide to every California consumer right under the CCPA and CPRA in 2026, how to actually use each one, and — if you run a website — exactly what you have to do to honor them.

There’s a tidy answer and a true answer, and they’re not the same. The tidy one is “at least once a year” — which is a real legal floor. The true one is “whenever your site changes what it does with data” — which happens far more often than annually, and is where policies quietly go out of date. You need both cadences. Here’s how they work.

A data processing agreement sounds like enterprise legal machinery, but the rule behind it is simple: if a vendor handles your users’ personal data on your instructions, you need a DPA with it. That sweeps in far more tools than most businesses realise — and you’ve probably already signed a few without noticing. Here’s the plain-language version: what a DPA is, exactly who needs one, and what’s still on you.

Google won’t let you run AdSense without a privacy policy — but “have a privacy policy” isn’t the real requirement. Google is specific about what it must say, and for EU traffic there’s a second requirement most publishers underestimate: your ad cookies have to actually wait for consent. Get both right and you protect your account and your ad revenue. Here’s exactly what’s required.

People usually ask this hoping for a clean yes or no. The honest answer is more interesting — and more useful: a privacy policy isn’t always a contract, but it’s almost always an enforceable promise. And that flips how you should think about it: your policy isn’t a shield that protects you by existing. It’s a set of statements the law can hold you to.

Adding the policy to Shopify takes about two minutes — the setting lives under Settings → Policies, and Shopify links it in your footer automatically when you save. The part that actually matters takes a little longer: making sure the policy describes your real store, not a generic template. Here’s the full process, both halves.

Google Consent Mode v2 is what keeps Google Ads and GA4 working for your EEA/UK visitors — but Joomla’s built-in Privacy and cookie extensions don’t set its signals. Here’s the exact setup, where the code goes in your template, and how to verify it’s actually firing.

To opt out is to refuse or withdraw permission for something that would otherwise happen by default. To opt in is the reverse — nothing happens until you actively say yes. That one-line difference decides how cookie banners, marketing lists, and data-sharing work, and — depending on where your users are — which model the law actually requires. Here’s the full picture for 2026.

At its simplest, consent means a clear, informed agreement — and cookie consent is how a website asks permission before it tracks you. But whether that permission is legally required, and what “valid” consent actually looks like, depends entirely on where your visitors are. This is the plain-English guide to how cookie consent works in 2026, US-first.

Getting marketing consent right is mostly about two things: the exact words next to the checkbox, and proving later that someone actually ticked it. Here’s the wording that holds up, copy-ready examples, and the rules behind them — GDPR, CAN-SPAM, and CASL.

“Consent” doesn’t only mean cookie banners. In US recording law, it decides whether you can legally record a call — and the answer depends on your state. Here’s the full 2026 map of one-party and two-party consent states, the specific answers people search for, and how this ties back to the same wiretap law behind website lawsuits.

Usercentrics is one of the most capable consent management platforms on the market — a Google Gold Tier CMP with IAB TCF 2.3, multi-surface consent across web, app and CTV, and audit-grade governance. For a large publisher running programmatic advertising, it is a defensible choice worth what it charges.

Google Consent Mode is a technical framework that tells Google’s tags how to behave when a visitor has not consented to analytics or advertising cookies. Rather than simply blocking Google tags when consent is declined — which causes complete data loss — Consent Mode allows Google tags to run in a restricted, cookieless mode, collecting minimal non-identifying signals that feed Google’s modelling algorithms.

A banner shows intent. It isn’t evidence. In a CIPA-era privacy review, the question that matters is what fired in the browser, on which page, before consent — and whether you can prove it. Compliance is moving from screenshots to a continuous evidence trail.