Website privacy: What businesses need to know

October 29, 2026

Alert

Businesses use a range of technologies on their websites to monitor user activity, analyze traffic, improve functionality, and support marketing efforts. Although these tools serve legitimate purposes, businesses may not fully appreciate the scope of information being collected, what information is shared with third parties, or how those third parties may use it.

In our recent webinar, Website Privacy: From the Playbook to the Field, McDonald Hopkins attorneys Jared Brown and Christa Kumming discussed common website privacy risks and what businesses can do to address them.

One of the key takeaways

A business’s website practices should match what its privacy policy says. Cookies, advertising pixels, session replay software, and chat features can all create privacy concerns if they collect or share information without appropriate notice, consent, or functioning opt-out mechanisms.

What should businesses watch for?

Website tracking tools: Identify the technologies operating on your website, including server-side connections, what information they collect, and where that information goes.
Privacy policies: Ensure your policies accurately reflect what personal information your website collects, how it is used, who receives it, whether it is sold or shared, and how consumers can exercise their privacy rights.
Consent and opt-outs: Verify that cookie banners, opt-out links, and Global Privacy Control signals function as represented and comply with applicable law. Avoid dark patterns and obtain affirmative consent for sensitive data where required.
Third-party vendors: Understand what information third-party vendors receive and how they use it before information is shared.
Ongoing reviews: Regularly scan your website and update your privacy policy at least annually and whenever new technologies, vendors, or data uses are introduced.

Why does it matter?

Regulatory scrutiny of website privacy practices continues, and private litigation remains a significant risk. Consumers continue to pursue individual claims, class actions, and mass arbitration demands under federal and state wiretapping and privacy laws, including the Electronic Communications Privacy Act (ECPA), the California Invasion of Privacy Act (CIPA), and the Florida Security of Communications Act (FSCA). These claims frequently target widely used technologies, including advertising pixels, chat tools, and session replay software.

Even routine website practices can generate legal exposure when tracking technologies operate contrary to a business’s disclosures or collect and transmit information in ways that implicate applicable privacy laws. Misconfigured consent banners, undisclosed tracking technologies, and outdated privacy policies can increase the risk of regulatory investigations, settlement demands, and litigation.

Steps businesses can take

Businesses can help reduce risk by reviewing their website tools, collecting only the data they need, testing consent settings, updating privacy policies, and coordinating among legal, marketing, and IT teams.

The bottom line

Know what information your website collects, understand where it goes, and ensure your actual practices align with your privacy disclosures and applicable legal requirements.

There was no criminal hacker, no ransomware, and no alleged identity theft – an employee at a health plan administrator inadvertently emailed a spreadsheet to the wrong people. That spreadsheet, holding sensitive information, was enough to let impacted individuals bring a class action in federal court.

McDonald Hopkins' Annslee Perego, along with Nick Reese from Triantha LLC are the developers of a one-of-a-kind workshop 'Strengthening Research Security in Arctic and High-Latitude Environments Training Series: International Research Partnerships and Agreements.'

Researchers tracked over 400 shoppers across four U.S. cities and found that nearly three-quarters of grocery items were offered at different prices to different customers, even when those customers were ordering from the same store at the same time.