Building a website is exciting. You pick your colors, write your pages, maybe drop in a Google Analytics tag or a Meta Pixel to see how many people are visiting. Everyone does it, right? Except there’s a legal side to this that almost nobody talks about — and ignoring it can cost you.
Those tracking tools aren’t just counting visitors. They’re collecting personal information about your users and sending it to Google, Meta, and others — often without those users knowing. That’s the part that gets people in trouble.
The Federal Trade Commission has made it clear that companies using tracking pixels that impermissibly share personal information with third parties may be violating the FTC Act and other state and federal laws — plus whatever privacy promises you’ve already made to your users. (Note: laws like HIPAA apply specifically to healthcare-related websites and companies, not to general websites.)
And it’s not just the FTC watching. There’s been a wave of real class action lawsuits — mostly targeting larger companies so far, but the legal arguments apply more broadly. Lawyers are going after websites that use the Meta Pixel specifically, arguing that sharing user data with Meta — without proper consent — violates wiretapping and privacy laws. Some of those lawsuits have targeted the Video Privacy Protection Act (VPPA), which requires that users give informed, written consent before their video-watching behavior gets shared with anyone. Courts have suggested that, in the VPPA context specifically, burying this disclosure in a general privacy policy probably isn’t enough.
The legal picture also varies by state. California, for example, has its own strict privacy law (CCPA) that gives users rights over their data. Other states have similar laws. Where your users are located can matter as much as where you are.
So what does this mean for you practically? If you’re running any website and you’re using analytics or ad tracking tools, you need a real privacy policy that tells users what you’re collecting and who you’re sharing it with. Depending on what your site does, you might need to let users opt out. A basic privacy policy generator isn’t always enough — the law has specific requirements about how consent is given and what it has to say, especially if your site streams video content.
The lawsuits making news started with bigger players, but the legal exposure isn’t limited to large companies. If you’re collecting data without proper disclosure, size doesn’t protect you.