Your website may be tracking people before they agree to it.
Most Squarespace sites load Google tags the moment a page loads, before anyone has touched the cookie banner. If your privacy policy says otherwise, your site is contradicting it on every visit. We find every tag that fires early, document it, and fix it.
Request an auditWhy this is showing up now
Demand letters citing privacy statutes like California's CIPA are arriving at ordinary businesses: restaurants, professional firms, medical practices, retailers. The claim is usually the same. The website recorded visitor activity and sent it to Google or Meta before the visitor consented to anything.
Here is the uncomfortable part. On a standard Squarespace setup, that claim is often true. Squarespace's built-in cookie banner displays a notice. By default it does not block the analytics and advertising tags the platform itself injects, and Squarespace's own documentation recommends a specialist tool for consent management. So a site can have a banner, a privacy policy, and a well-meaning owner, and still be transmitting data before consent on every page load.
We know because we've run the captures. We've watched Google Analytics fire two seconds into a page load with the banner untouched, on sites whose privacy policies promised the opposite.
What the audit covers
We record your site the way a plaintiff's expert would, then hand you the findings in plain English.
Network capture across consent states
We load your site with consent unanswered, accepted, and declined, and record every request it makes in each state.
Every tag that fires before consent
With timestamps: Google Analytics, legacy Universal Analytics properties that never got removed, DoubleClick, Meta Pixel, chat widgets, embedded fonts and players.
Banner behavior
Whether your banner blocks anything or only displays a notice.
Privacy policy against reality
Line by line, does your policy describe what the site does? A policy that promises "analytics only after consent" while the capture shows otherwise is a finding in itself.
A written report
One you can hand to your attorney, with each finding rated by severity and a specific fix for each.
Starting at $850
Delivered within one week of access. The price scales with what the capture finds; a site carrying years of accumulated tags is a bigger job than a clean one.
The fix
If the audit finds problems, we remediate. This is the second phase, scoped per site after the audit, because the fix depends on what we find.
- Remove the platform-injected analytics and any legacy tags entirely.
- Install a consent tool that blocks tags until the visitor answers, in place of one that only shows a notice.
- Re-inject your analytics behind Google Consent Mode v2, so you keep your data on visitors who say yes.
- Honor Global Privacy Control, the browser setting that declines for the visitor automatically.
- Publish a privacy policy that describes what the site now does.
- Re-run the full capture and deliver it as proof the site behaves the way the policy says.
You lose nothing you'd want to keep. Analytics still runs for consenting visitors. What changes is that the site now waits to be asked.
What we are and what we aren't
What we are
A design and web studio. We work on Squarespace every day as a Squarespace Platinum Partner and a top-level expert on the Squarespace Marketplace, and what we provide is the technical record that lets your attorney answer the legal question, and the implementation work once they have.
What we aren't
A law firm. Nothing on this page or in an audit is legal advice, and whether your site's behavior satisfies the law in your state is a question for your attorney. When there's already counsel involved, we work at their direction and deliver to them. That's how these engagements go best.
Who this is for
You got a demand letter, or your industry peers have.
Your attorney or insurer asked what your website collects and you don't know the answer.
You run ads or analytics on a Squarespace site and you've never verified what fires before consent.
You're on another platform with the same question. The method is the same; the audit isn't limited to Squarespace.
Questions we get
Doesn't the Squarespace cookie banner handle this?
It shows a notice and manages some third-party cookies. By default it does not block the Google tags Squarespace injects, and Squarespace's documentation says a specialist tool is the answer for full consent management. That gap between what the banner looks like and what it does is where most of these findings come from.
What is CIPA?
The California Invasion of Privacy Act, a wiretapping statute now being cited in demand letters to website owners. The argument is that recording a visitor's activity and transmitting it to a third party without consent is an illegal interception. Whether that argument holds is contested and state-specific, which is exactly why the answer belongs with your attorney. Our job is making sure the technical facts are on your side.
Will I lose my analytics?
No. Analytics runs for visitors who consent. You'll see fewer total visitors in your reports because you're no longer counting people who declined, and that's the point.
My site was built by someone else. Does that matter?
No. We audit sites we didn't build all the time, and the report doesn't assign blame. It records what the site does today.
How fast can this happen?
The audit is delivered within one week of getting access. Remediation is usually done within two weeks of approval.
Find out what your site is doing before someone else does.
Starting at $850, one week, a report your attorney can use.
Request an audit