Audit your website privacy before a litigator does it for you.

Anyone responsible for a website that collects data. Founders, marketing leads, in-house counsel, and compliance teams order for their own sites. Outside counsel, insurers, and agencies order on behalf of clients and policyholders. If your site has visitors and is performing non-essential tracking, this audit applies.

It depends. My audits are most useful when you have a consent management setup to validate, a demand letter with specific claims to assess, or a team or client that needs an external web privacy expert. If you already know you have major gaps, your budget may be better spent addressing them directly. I recommend Captain Compliance, the platform I help build, for privacy technology needs.

It can. The audit highlights your site's vulnerability to exactly the kinds of tests that privacy testers run. That gives you and your counsel a concrete, thoughtful picture to work from instead of guesswork. The audit is informational rather than legal advice, so involve your attorney in the response itself. The 72-hour priority option is intended to support those who are dealing with demand letters.

Yes. Many website wiretapping demand letters cite the California Invasion of Privacy Act (CIPA). Others cite the federal Electronic Communications Privacy Act (ECPA) or laws from other states such as the Florida Security of Communications Act (FSCA) and Pennsylvania's Wiretapping and Electronic Surveillance Control Act (WESCA). These claims usually target analytics plugins, social media pixels, and other common tools. The audit examines how those technologies behave on your website and how your notice and consent mechanisms hold up against the theories these statutes support.

Three deliverables. First, I provide a private link to a video in which I personally review your live website: your tracking and consent experience, your privacy notice, and your consumer-rights mechanisms. Second, I provide a written companion report documenting each finding, its suggested remediation path, and estimated risk exposure, ready to share with your team or counsel. Finally, I host a live remediation review call of up to 30 minutes, bookable within 30 days of delivery. Most clients use it to verify their fixes, but the agenda is ultimately yours.

Automated tools are good at inventory. They can list your cookies, tags, and vendors in seconds, and that list is useful. I use these tools as part of my evaluation process. The audit is much different. I review your site the way a regulator or a plaintiff's firm would, notice when your banner contradicts your notice, catch issues that an automated scanner would never find, and tell you which findings matter most and why. My professional judgment is the difference.

No. The audit examines your public-facing site, which is exactly what your visitors, regulators, and plaintiff's attorneys can see. No credentials or systems access is required, unless you want me to review unpublished websites ahead of go-live.

No. Nothing that I provide constitutes legal advice. The audit is an informational expert review of your site's observable privacy posture. It will make the conversation with your lawyer shorter and better informed, but it isn't a substitute for one, and no attorney-client relationship is created.

The audit is informed by the regimes relevant to your audience, including U.S. state privacy laws (CCPA/CPRA and their siblings), GDPR and international opt-in standards where your traffic warrants it, sector-specific concerns like consumer health data, and the litigation theories currently being tested in U.S. courts. Your qualifying questions at order time tell me which lenses matter most for your site.

The order form collects the essentials before checkout: your site URL, audience regions, any demand letter details you choose to share, and similar. After payment I confirm receipt and your delivery date by email, then review and film. Standard orders arrive within 7 days, and priority orders within 72 hours.

Your order details are used to deliver the audit and payments are handled by Stripe. Nothing about your order or your audit results is shared with Captain Compliance, where I am the Chief Trust & Privacy Officer, without your permission. Full details are in the privacy notice.

This audit is intentionally independent. I show you what's wrong and explain the steps necessary to fix it, and the included remediation review call is where most teams validate their fixes. Where ongoing tooling like consent management or monitoring is appropriate, the video will say so, and I'll note where Captain Compliance solutions are relevant.