Privacy concerns continue to be at the forefront of discussions between marketers and consumers alike. Despite the heightened focus on privacy, a significant portion of the most visited websites in both the U.S. and Europe are still not fully compliant with essential privacy regulations. A recent study by Privado.ai sheds light on the state of privacy compliance and the potential risks marketers face when navigating this complex landscape.
A Startling Lack of Compliance
According to the research, a staggering 75% of the top 100 most visited websites in the U.S. and Europe are not fully compliant with two major privacy laws: the California Privacy Rights Act (CPRA) in the U.S. and the General Data Protection Regulation (GDPR) in Europe. The study, conducted in September 2024, found that these websites shared personal data with third-party advertisers, with U.S. sites averaging 17 third-party data shares, while European sites averaged six.
Vaibhav Antil, CEO and co-founder of Privado.ai, highlights the significant risks of noncompliance: “The consequences for privacy noncompliance range from zero to major financial and reputational damages.” He notes that while many companies have not yet faced fines, those that do often endure lengthy legal battles, costly ongoing oversight, and a loss of consumer trust.
The Privacy Landscape: Fragmented and Risky
The privacy landscape in the U.S. remains particularly fragmented due to the absence of a comprehensive federal privacy law. The CPRA, though a state-level regulation in California, has become the de facto standard for privacy compliance in the U.S. However, a large portion of websites are still not following it. In fact, 76% of the top 100 websites in the U.S. fail to honor CPRA opt-out signals, and 75% share user data with third parties even when users opt-out.
The study also identifies that media and ecommerce sites are the biggest offenders in terms of privacy noncompliance. Despite media websites making up 53% of the top 100 sites, 79% of them are noncompliant. Similarly, 79% of ecommerce sites fail to meet privacy standards, even though this category only makes up 19% of the top 100 websites.
Understanding the Risk of Noncompliance
For marketers, the stakes are high when it comes to privacy noncompliance. In addition to potential monetary fines and penalties, brands risk facing reputational damage, which could significantly impact their bottom line. Since 2022, at least 10 U.S. companies have been fined for violating privacy laws. In Europe, Amazon was hit with an $888 million fine for targeting users without proper consent—a powerful reminder of the financial repercussions for privacy violations.
Furthermore, marketers should be aware that once user data is shared with third-party advertisers, it can easily spread across the entire digital advertising ecosystem. Even if a marketing team doesn’t intend to use the data for retargeting, sharing it improperly puts the advertiser at risk.
How Marketers Can Mitigate Privacy Risks
To reduce the risk of noncompliance and its associated consequences, marketers can take several proactive steps:
- Partner with Privacy-Focused Experts: Work with partners who specialize in privacy compliance to ensure all practices align with legal requirements.
- Leverage Technology: Implement specialized tools, such as AI-driven solutions, to enhance compliance and minimize risk.
- Establish Clear Processes: It’s critical for marketing, privacy, and engineering teams to work together and establish clear procedures when adding new advertising partners or modifying existing data flows.
As Antil advises, “It’s not too difficult to implement guardrails to minimize risk and still execute successful campaigns.”
Conclusion
The state of website privacy remains a challenge for both marketers and consumers, with a large proportion of top websites still not adhering to key privacy regulations. Marketers must be aware of the risks they face when handling consumer data and prioritize compliance to avoid costly penalties and protect their brand’s reputation. By working with specialized partners and using the right tools, brands can navigate the complexities of privacy laws and continue running effective, data-driven campaigns without falling into legal pitfalls.