Consent Compliance Audit

Why this matters

Recent US privacy enforcement has shifted from reviewing policies in isolation to testing whether privacy mechanisms actually work. Regulators are checking opt-out flows, Global Privacy Control handling, tracking pixels, contracts with advertising vendors, sensitive-context sharing, and whether companies maintain an inventory of deployed tracking technologies.

The practical takeaway for consent-engine is direct: a report should not stop at "cookies fired." It should map observed network facts to the enforcement pattern they resemble and produce a tracking-technology inventory that privacy, legal, and engineering teams can review.

Enforcement patterns to test

Core Rights

§1798.120 — Right to Opt Out of Sale
California consumers may direct any business to not sell their personal information. The business must:
- Post a "Do Not Sell My Personal Information" link on homepage
- Honor opt-out within 15 business days
- Not sell after receiving a valid opt-out request

CPRA Extension — Sharing for Cross-Context Behavioral Advertising (effective 2023)
Opt-out rights now cover "sharing" — defined as disclosing personal information for cross-context behavioral advertising, even with no money exchanged. This directly covers:
- Passing user identifiers (cookies, device IDs) to ad platforms
- Meta Pixel / Facebook retargeting
- Google Ads conversion tracking
- LinkedIn Insight Tag, TikTok Pixel when fired post-opt-out
- Third-party audience syndication

Key interpretation: A business does not need to receive money for a data transfer to be classified as a "sale." Passing cookies or behavioral data to any ad platform = sale under CCPA/CPRA.

Global Privacy Control (GPC)

CPRA regulations require businesses to honor the Sec-GPC: 1 HTTP header as a valid opt-out of sale and sharing. This is mandatory, not optional.

Enforcement action: The California Privacy Protection Agency (CPPA) has explicitly stated that failure to honor GPC is an enforceable violation without requiring prior notice to the business.

States that mandate GPC: California, Colorado, Connecticut, Texas, Montana, Oregon.

If an advertising pixel fires after receiving Sec-GPC: 1 from a California user → confirmed CPRA violation, per-consumer fine exposure.

Overview

As of 2026, 20+ U.S. jurisdictions enforce comprehensive consumer privacy laws. All share a common thread: consumers have the right to opt out of sale or sharing of personal information for targeted advertising. Businesses must honor that right.

Targeted advertising (consistent definition across all state laws): displaying ads based on personal data obtained from the consumer's activities across non-affiliated websites. This directly covers Meta Pixel retargeting, Google Ads remarketing, LinkedIn Insight Tag, TikTok Pixel.

States with GPC Mandate (Critical for Audits)

The following states require honoring the Global Privacy Control (Sec-GPC: 1) as a valid opt-out:

Audit rule: If Sec-GPC: 1 is detected AND the user's IP resolves to any GPC-mandate state AND an advertising pixel fires → confirmed violation, per-consumer fine exposure.

What It Is

The Global Privacy Control (GPC) is a browser-level privacy signal transmitted as an HTTP request header:
Sec-GPC: 1

When present, it signals that the user does not want their data sold or shared for targeted advertising. It is a machine-readable, universal opt-out mechanism.

Legal Status by State

Regulatory Actions

Disney — California AG, February 11, 2026 — $2.75 million (largest CCPA settlement)
- Opt-out mechanism was device-by-device and service-by-service — not account-wide
- User who opted out on Disney+ still tracked on ESPN+, Hulu, different devices
- CA AG: CCPA requires a universal opt-out, not per-device fragmentation
- Principle established: Opt-out must be honored across all services and devices associated with a consumer's account. Per-service opt-out = violation.
- Audit relevance: Any site/platform requiring repeated opt-out per device or service is non-compliant.

Tractor Supply — CPPA (California Privacy Protection Agency), September 30, 2025 — $1.35 million
- First major CPPA enforcement action (CPPA is separate from and acts independently of the AG)
- Violations: GPC signal not honored, inadequate privacy notice, job applicant rights not disclosed, personal data shared with third parties without proper data processing agreements
- Principle established: CPPA enforces independently — GPC non-compliance is a standalone CPPA violation, not just AG enforcement.
- Audit relevance: GPC + advertising pixel firing = citable CPPA enforcement precedent alongside Sephora.

Tilting Point Media — CPPA, July 2025 — $500,000
- Mobile-game publisher; allowed collection of children's personal information without obtaining parental consent or applying COPPA-required age-screening controls before sharing data with advertising SDKs
- Failed to honor opt-out preference signals (GPC) for users in California
- CPPA order required implementation of an age-screening mechanism, COPPA-aligned consent flow, and quarterly compliance reports for three years
- Principle established: Children's privacy under CCPA is a CPPA enforcement priority and overlaps with FTC's COPPA jurisdiction. Mobile games and any site with mixed-age users carry heightened risk.

Honda (American Honda Motor Co.) — CPPA, March 2024 — $632,500
- First CPPA settlement after the agency stood up its enforcement division
- Violations: required California consumers to verify their identity to submit opt-out and limit-use-of-sensitive-data requests (CCPA prohibits verification for these specific rights), required excessive personal information for authorized agent requests, asymmetric cookie-banner design favoring "accept" over "reject"
- Principle established: Opt-out requests must be one-click and may not require identity verification. Authorized-agent processes that demand extra documentation beyond CCPA's text are independent violations.
- Audit relevance: Any opt-out flow that asks for email confirmation, account login, or additional ID fields = direct Honda precedent.

DoorDash — California AG, February 2024 — $375,000
- DoorDash participated in a marketing co-op that exchanged customer personal information (names + addresses) with other businesses' lists in return for promotional access to those lists
- AG: this exchange constituted "sale" of personal information under CCPA, requiring opt-out disclosures DoorDash did not provide; also constituted "sharing" under CalOPPA and the federal CAN-SPAM Act
- Principle established: Non-monetary exchanges of personal information for "valuable consideration" (access to mailing lists, partner audiences, lookalike-modeling capacity) are CCPA sales requiring opt-out disclosure.
- Audit relevance: Lookalike-audience uploads to Meta or Google = same legal theory. Customer-match audiences are not exempt.

Todd Snyder — CPPA, May 2024 — $345,178
- Direct-to-consumer apparel retailer; CMP banner technically present but the opt-out link landed on a page that required users to fill in a five-field form (including driver's license upload) before any opt-out was honored — and even when submitted, opt-outs were intermittently ignored due to a misconfigured cookie banner that erased the user's choice within 40 days
- Principle established: Cookie-banner misconfiguration that fails to persist opt-out choices is a CCPA violation in its own right, separate from any disclosure or pixel-firing issue. Excessive verification on the opt-out path is a violation per Honda.
- Audit relevance: Any audit where the CMP exists but opt-out persistence is broken or where reject-flow requires more than email = direct Todd Snyder precedent.

Google — Texas AG, May 2025 — $1.375 billion
- Largest single-state privacy settlement in US history
- Location tracking persisted in Incognito mode; biometric data (voiceprints) collected without consent
- Statutes: Texas Data Privacy and Security Act (TDPSA) + Capture or Use of Biometric Identifier Act (CUBI) + DTPA
- Principle: State AGs outside California now pursue billion-dollar settlements. Texas, Florida, Washington have aggressive enforcement posture.

Sephora — California AG, October 2022 — $1.2 million
- First CCPA enforcement action
- Selling consumer data to advertising partners via pixel sharing without disclosing it as a "sale"
- Failing to honor GPC opt-out signals
- AG's complaint specifically cited Meta Pixel and Google Ads pixel-based data sharing as constituting "sale" of personal information
- Principle established: GPC = legally valid CCPA opt-out. Non-compliance = per-violation fine.
- Key insight: Money need not change hands for a pixel data transfer to be classified as "sale."

Tillamook County Creamery — California AG, 2022
- Settlement and corrective action required
- Advertising pixels continued firing after GPC signal received
- Part of AG's first GPC enforcement sweep
- Significance: Demonstrates GPC enforcement applies to mid-market brands, not just large tech

FTC v. Epic Games (Fortnite) — September 2022 — $275M + $245M
- $275M COPPA: default-on voice and video collection for minors
- $245M: dark UX patterns tricking children into in-app purchases
- Principle: Interactive entertainment with children requires opt-in consent; dark patterns carry FTC enforcement risk

Class Action Litigation

Disney / Entertainment Sector — 2023–2025
- Class action lawsuits against Disney, NBC Universal, Hulu
- Allegations: Meta Pixel + similar tracking on health-adjacent and subscription content without disclosure
- Disney specifically: Pixel tracking on disneyplus.com and theme park booking pages alleged to share viewing habits with Meta
- VPPA cited alongside CCPA in streaming contexts
- Settlement exposure per action: $25–$100M range

Aspen Dental — FTC/State AGs
- Settled for $18.5M
- Used Meta and Google tracking tools transmitting sensitive health data without consent
- Multi-statute: California Confidentiality of Medical Information Act + CCPA + HIPAA-adjacent
- Established: health-adjacent content + advertising pixels = maximum exposure category

Overview

Live US privacy enforcement data from federal court dockets (CourtListener) and FTC press releases.
Covers CCPA, CIPA (California wiretap), VPPA, COPPA, and FTC Act privacy enforcement actions.
Last refreshed: 2026-04-22.

Key Enforcement Principles (Always Cite First)

These are established by settled cases — use these in every US audit report:

The Litigation Explosion

In 2024, nearly 4,000 online privacy lawsuits were filed — up from ~200 in 2023. The primary vehicle: plaintiffs' attorneys repurposing antiquated statutes to target standard web analytics. This is the most immediate financial threat to businesses using digital analytics, exceeding regulatory fines in urgency.

California Invasion of Privacy Act (CIPA)

CIPA is a 1960s wiretapping statute now weaponized against web tracking. No actual damages required — $5,000 statutory penalty per violation. A single misconfigured pixel on a high-traffic site can generate tens of millions in theoretical liability within hours.

Three CIPA Theories

§ 631(a) — Wiretapping / Interception
- Target: Google Analytics, Meta Pixel, Hotjar session replay, any third-party analytics
- Theory: Third-party vendor code "intercepts" communications (clicks, keystrokes, form fills) between user and site without explicit prior consent
- Status: Extremely active. Courts divided on whether vendor = "tape recorder" extension of first party vs. independent eavesdropper

§ 632.7 — Cellular Eavesdropping
- Target: Mobile web browsing, integrated chat widgets
- Theory: Internet communications from smartphones = cellular communications under the statute
- Status: Active. Frequently filed alongside § 631(a) to multiply settlement pressure

§§ 638.50–.51 — Pen Register / Trap-and-Trace
- Target: IP address trackers, HTTP request headers, basic network routing analytics
- Theory: Software captures routing/signaling information = illegal trap-and-trace device
- Status: Emerging in 2026. Courts divided on applying 1990s telecom concepts to HTTP

CIPA Audit Implication

CIPA lawsuits specifically exploit the gap between a site's privacy policy and the actual behavior of asynchronous JavaScript tags. If a policy says "we don't share data with unauthorized third parties" but a misconfigured Meta Pixel transmits a user's unhashed email or behavioral payload — the technical error fulfills the plaintiff's burden of proof automatically.