Why Privacy Compliance Breaks After the Audit

Most companies treat a privacy implementation like a project. Someone audits the site, the cookie banner gets wired into the tagging systems, and everyone moves on. In our experience, that’s just the beginning of good compliance.

Your website is constantly changing, whether you know it or not

You can only judge compliance at the moment of an audit. Your site never stops changing.

• Someone publishes a new version of the Tag Manager container, and the consent settings are quietly overwritten.
• Someone adds a new tag in Tag Manager without configuring Consent Mode.
• Someone adds a tag directly to the website as an inline script, and it knows nothing about consent.
• A new app gets installed, and it brings its own pixel with it.
• An app you already have ships an update, and now it loads scripts it never loaded before.
• One vendor’s script starts calling another vendor, who calls a third.

This is pretty typical. It’s just how websites work. Good marketing teams are supposed to try new tools.

It’s happened to us more times than I’d like. We fix a site, document everything and hand it back, and a few weeks after a pristine implementation, one small change puts the site right back into a non-compliant state.

Without monitoring, the audit stops being true

An audit is a snapshot.

The moment something changes, that snapshot is out of date. There’s no alarm when a new pixel starts firing before consent, or when a Do Not Sell link stops doing anything. From the outside, the site looks exactly the same. The banner still appears. The buttons still click, but now the data leaks again.

That’s what makes the whole audit process close to useless on its own. You paid to find the problems and fix them, and the fixes have a shelf life nobody’s tracking.

Even the teams that monitor struggle with what they find

Some businesses do scan their sites regularly. The trouble is what comes back.

A finding is usually something like a cookie called _fbp, a request to bat.bing.com, or a storage key with a name nobody recognizes. That means very little to a marketing manager, and often not much more to a developer. A single request can also be the end of a chain: a script loaded by a script loaded by a tag, so the thing you can see isn’t the thing you need to fix.

So findings get left behind, and the site’s compliance slowly goes stale. Nobody owns it, which puts you right back where you started.

Stakeout is our answer to this

To put it simply, you can think of Stakeout as a continuous audit system with all of your decisions about tracking encoded into it.

We built it because we kept running into this problem in our own work.

Stakeout visits your site the way a real visitor would, in a real browser, from inside each jurisdiction you care about. A visit from California is judged against California’s rules, and a visit from the EU against the EU’s. It runs the scenarios that actually matter: a visitor who makes no choice, one who rejects the banner, one who accepts it, one whose browser sends Global Privacy Control, and one who uses your Do Not Sell link.

Every scan records each cookie, storage key and network request, along with the script that caused it. Scans run every day, or more often for sites that change a lot. When something new appears or something breaks, you hear about it by email or webhook, instead of finding out from a demand letter.

With Stakeout, every finding gets a decision

Monitoring is only half the problem. The other half is what you do when you find something.

Every finding can be marked as permitted, prohibited or unsure. A decision can become a rule, so the same thing isn’t flagged again next week. When you think something is fixed, you can test the fix and see the result for yourself.

And when you don’t know what to do with a finding, you can assign it to us. Most teams aren’t going to know whether a particular cookie is a problem, or which of a dozen chained requests is the real cause, and they shouldn’t have to. An assigned finding comes to our team with everything Stakeout recorded about it. We investigate and fix the cause.

Built for brands, agencies and lawyers

• Brands use it to watch their own sites, so the compliance work they paid for stays done.
• Agencies manage every client from one organization, each client with its own account, sites and findings.
• Lawyers get evidence. Every scan keeps the recorded network traffic and timestamped captures, so you can show when a problem started and prove when it was fixed.

An audit is the start, not the finish

A privacy implementation is worth doing, and worth doing well. But on its own it’s a promise about one day.

Continuous monitoring, with an elegant way of handling new findings that cuts out the noise and gives you a way to fix things on all the days after, is what Stakeout is all about. You can see how it works at stakeout.io.

FAQ