Shocking Privacy Noncompliance: Are Your Favorite Websites at Risk?

Despite privacy being a major concern for both marketers and consumers, 75% of the most visited websites in the U.S. and Europe are not compliant with two major privacy regulations, according to recent research from Privado.ai. In the U.S. alone, the most visited websites share personal data with an average of 17 third-party advertisers, while in Europe, that number is significantly lower at six third-party advertisers.

“The consequences for privacy noncompliance range from zero to major financial and reputational damages. Many companies with privacy risks today have not been fined, but the ones that do get fined face lengthy legal battles, costly ongoing oversight, and lose valuable consumer trust,” said Vaibhav Antil, CEO and co-founder of Privado.ai.

The Privacy Landscape

The privacy landscape in the U.S. remains highly fragmented, especially with a persistent lack of a federal privacy law. The California Privacy Rights Act (CPRA), while a California law, serves as the standard for privacy compliance in the U.S. A staggering 76% of the top 100 websites visited in the U.S. do not honor CPRA opt-out signals. Additionally, 75% of these websites share user data with third parties even when users opt-out.

Media and ecommerce sites are the biggest offenders regarding CPRA compliance. Despite media comprising 53% of the top 100 websites, 79% of these websites are noncompliant. In the ecommerce sector, 79% of websites are also noncompliant, although they make up only 19% of the top 100.

“Marketers should know that once personal data is shared with an advertising third party, it may be shared and used throughout the digital advertising ecosystem. Even if a marketing team doesn’t plan to use their audience data for retargeting, just sharing the data without proper consent puts the advertiser at risk,” added Antil.

The Risk of Noncompliance

Noncompliance poses a significant risk for marketers, primarily in the form of monetary fines and penalties. With budgets already tight, fines could worsen a company’s economic outlook, alongside the reputational damage it may face. Since 2022, at least 10 companies have been fined in the U.S. for not complying with various privacy laws. Notably, Amazon was fined $888 million in Europe for targeting users without proper consent.

To avoid penalties, marketers can collaborate with partners who specialize in and prioritize privacy. Specialized tools such as artificial intelligence can also help increase compliance and minimize risk.

“Marketers should be aware of the potential privacy risks when setting up new advertising partners or technologies. With the fast-paced nature of marketing, risks can occur easily, but implementing guardrails to minimize risk while executing successful campaigns is not overly difficult,” said Antil. “It’s critical for marketing, privacy, and engineering teams to create clear processes for adding new advertising partners and changing data flows for existing partners.”