4.9
Data privacy compliance for eCommerce analytics
Consent architecture and tracking audits for the data your store collects, configured by the same analytics team that builds the tracking itself.
Trusted by 700+ leading brands worldwide
Trusted by 700+ leading brands worldwide
Where privacy exposure comes from
Most exposure starts in the implementation – even though the cookie banner is in place, and the policy is written, tags keep firing before anyone agreed and nobody has checked what the third parties receive.
Tags before consent
A banner that appears while analytics and marketing tags have already loaded gives the appearance of compliance without the substance.
3rd party vendors
Third-party tags accumulate over years of campaigns, and few teams can produce a current list of who receives their customer data.
No documentation
When legal asks what is collected and on what basis, the answer has to be rebuilt by hand from the tag manager and the CMP every time.
What our data privacy work covers
The starting point is an inventory of what your site collects today and which vendors receive it. Implementation of the tag and consent changes is delivered by our tracking setup team.
Data collection audit
An inventory of every tag, pixel, and API firing on your site, with the data each one sends and the basis it relies on.
Consent architecture
Consent Mode and CMP signals designed so nothing fires before agreement, using platforms including OneTrust, CookieBot, and Amasty.
Vendor and tag review
Third-party recipients identified and documented, and the ones nobody can account for are put to your team for a decision.
GDPR and CCPA frameworks
Collection configured against the defaults of each market, since GDPR starts from opt-out while CCPA starts from opt-in.
Opt-out handling
Tooling set up to respect a visitor's refusal across every downstream platform, and tested against real refusals before handover.
Documentation for audits
A written record of what is collected, why, and where it goes, which your legal team can use when required.
Your setup may already handle part of this list
Why brands choose scandiweb for privacy-compliant analytics
Designed by market
Consent defaults are opposite in the EU and the US, so we design and test your configuration separately for each market.
Same team that built tracking
The specialists auditing your tags are the ones who configure them, which removes the handoff where most findings get lost.
Certified for personal data
Our certifications cover ISO 27001, ISO 27017, and PCI DSS, which means the controls around your data are externally audited.
We work to the standards
Consent signals are handled through IAB TCF 2.0 and platform-native frameworks. Nothing depends on a bespoke workaround.
Legal advice in-house
Where the question turns out to be a policy or contract matter, our legal consultancy team picks it up and advises a solution.
Tested against refusals
Every configuration is checked by refusing consent first, then confirming that the downstream platforms receive nothing.
Steps of a data privacy project
Collection inventory
We record every tag, pixel, and API call the site makes, with the data each sends and the third party on the other end.
Gap assessment
Each item is checked against the consent state it should respect, and anything firing early is listed with the exposure it creates.
Consent design
We specify how signals should pass from your CMP into every platform, market by market, since defaults differ across regions.
Configuration and testing
Changes are applied and then verified by refusing consent, confirming that no downstream platform receives anything.
Documentation and handover
The inventory and the consent design are written up for your legal team, and your own staff are trained to keep both current.
.png)
What clients say about working with scandiweb
.webp)
.png)
Frequently asked questions about privacy and tracking
Do you provide legal advice?
No. We handle the data stack — what is collected, on what consent basis, and which vendors receive it. Policies, terms, and regulatory interpretation come from our legal consultancy team, and the two often work on the same project.
Will consent gating cost us data?
Some, and less than most teams expect. Our published work brought missing orders down from over 15% to roughly 5% while every tag stayed gated behind consent. The loss comes from a poor implementation more often than from the consent requirement.
Can you audit a setup you did not build?
Yes, and that is the common case. The inventory stage records what is firing regardless of who configured it, and the findings are handed over even if the remediation goes elsewhere.
Which consent platforms do you work with?
Platforms including OneTrust, CookieBot, and Amasty, alongside the consent frameworks built into Google and Adobe. The recommendation follows what your markets require and what your team can maintain, and we work with a CMP you already license.
How do GDPR and CCPA differ in practice?
What do we get at the end?
A written inventory of every tag and the data it sends, a consent design per market, the configuration applied and tested, and documentation your legal team can work from. The inventory alone is usually the piece clients did not have.
Talk to a privacy specialist
Tell us which markets you sell into and what consent platform you use today. A specialist will come back with the scope of a collection inventory.
Prefer to talk now? Book a call straight away, or email us at: [email protected]
Related services
Could you list who receives your customer data? Let’s map it out
A specialist will look at what your site collects today and where each item is sent.
