Website Privacy: Policies, Cookies & Best Practice

People link them side by side in the footer, so it’s easy to assume they’re two halves of the same thing. They’re not. In the terms of service vs privacy policy question, one document is a contract you enforce against your users, and the other is a legal disclosure you owe to them — different purposes, different laws, different consequences when they’re wrong. And there’s a third thing neither of them is, which is where most sites quietly get into trouble. Here’s what each document does, which you’re actually required to have, and the line that trips up even careful teams.

US companies are on pace to pay upwards of $1.4 billion in website- and app-tracking privacy settlements in 2026 — up 36% on last year. The uncomfortable detail buried in the data: most of the companies being sued already had a consent management platform in place. They had the banner. They still settled. This is the clearest evidence yet that a consent platform isn’t enough on its own — and a look at the exact gap between showing a banner and actually gating your tags.

Three jurisdictions, three very different statutes — Quebec’s Law 25, Brazil’s LGPD, and Canada’s federal PIPEDA. They read nothing alike, carry wildly different penalties, and yet, for anyone running a website, they converge on a single operational test. This is the 2026 guide to what each one actually requires, who it reaches beyond its own borders, and the one thing that keeps you on the right side of all of them.

Short answer: usually yes — but that’s only half of it. A chat widget quietly loads trackers before anyone even clicks to chat, and if it’s AI, a separate law wants you to say so. Here’s the full picture, fast.

Data enrichment privacy and lead scoring under GDPR is the AI surface most site owners never think about. Before a visitor finishes typing, tools can append who they are, score them, and route them — often with no consent and no notice. Here’s exactly what happens, and where it crosses a line.

The privacy industry just turned consent data into a product — benchmarks that show how your consent rate compares to competitors. It’s a useful marketing tool. But it quietly answers the wrong question for the risk that actually matters: when a wiretapping suit or a regulator asks “did this visitor consent, and can you prove it?”, your consent rate is irrelevant. Your consent proof is everything. This is the difference between the two — and why chasing the metric can even make things worse.

“Tracking cookies” is the phrase most people reach for, but it’s only one piece of how websites watch their visitors. Pixels, tags, fingerprinting, session replay and server-side data flows all track people too — and several of them keep working even after cookies are blocked or deleted. This guide explains every kind of tracker in plain English: what each one does, how cross-site tracking works, how to stop them, and why “going cookieless” doesn’t make the consent problem disappear.

People use “data protection” and “data privacy” interchangeably, but the difference is the whole point of this guide. Start with the data protection and privacy definition that actually matters in practice: privacy is the individual’s right to control their information; data protection is the organization’s duty to safeguard it. This article is about the duty side — which laws reach your business in 2026, and what a real data-protection program looks like once you know they do.

There is still no single privacy law that covers a website. Instead there’s a fast-growing patchwork — and at its center sits the California Consumer Privacy Act, the law that kicked off the modern US era and the one most site owners meet first. This is a plain-English map of what actually applies in 2026: California’s two very different privacy laws, the twenty-state US patchwork, the missing federal law, and the UK, EU and Australian regimes that reach your site the moment their residents visit.

Stuck behind a “please enable cookies to continue” message? Trying to stop ads following you around? This is the complete, current guide to managing cookies — how to enable browser cookies, clear them, view them, and block the tracking kind — in Chrome, Safari, Edge and Firefox, on desktop, Mac, iPhone and Android. Every step is updated for 2026, including what actually changed with third-party cookies this year.

The fastest way to understand what a privacy policy needs is to look at a real one — so we’ll use the most-searched policy on the internet. When people look up the TikTok privacy policy, they’re really asking the same thing every site owner asks: what does a policy actually disclose, and what does mine need to say?