Digital Marketing Privacy Concerns: Nine Privacy Issues in Marketing That Create Legal Risk, and How to Fix Them

Marketing runs on data, and privacy law now regulates almost every step of how that data is collected, shared and used. The most common digital marketing privacy concerns are tracking tags that fire before consent, opt-outs that do not actually stop data sharing, ignored browser opt-out signals, sensitive data flowing to ad platforms, and privacy policies that do not match what the website really does. Each one has produced real fines and lawsuits, and most are fixable with the right process.

This guide walks through the nine privacy issues in marketing that cause the most trouble, shows what regulators have actually penalized, and ends with a practical audit your team can run this quarter.

What are digital marketing privacy concerns?

Digital marketing privacy concerns are the risks that arise when advertising, analytics, email, retargeting and personalization tools collect or share personal information about website visitors, app users and customers. The concern is not that marketers use data. It is that visitors are often not told what happens to their information, cannot stop it, or have it shared with parties they never heard of, while the law increasingly requires notice, choice and honest disclosure.

The nine biggest privacy issues in marketing

1. Tracking tags that fire before consent or after an opt-out

Ad pixels, social media tags and analytics scripts often load the moment a page opens. Where the law requires consent first, or where a visitor has already opted out, that default behavior becomes the violation. A banner that records a choice but does not actually control the tags is one of the most common failures we see.

2. Opt-outs that do not work everywhere

An opt-out has to stop the sale or sharing of data across the whole experience, not just one page or one device. In February 2026, the California Attorney General announced a 2.75 million dollar settlement with Disney over opt-out methods that stopped only some data sharing instead of all of it, including across devices and services tied to a consumer’s account. The lesson for marketers is that your advertising stack and your privacy controls have to be equally capable.

3. Ignoring Global Privacy Control and other opt-out signals

Global Privacy Control, or GPC, is a browser setting that tells every site a visitor visits that they opt out of the sale or sharing of their data. A growing number of states, including California, Colorado, Connecticut and Texas, require businesses to honor universal opt-out signals. California’s first big enforcement case on this issue, against Sephora in 2022, ended in a 1.2 million dollar settlement that included the company’s failure to process these signals. Treat GPC as a requirement to test, not a nice-to-have.

4. Making opting out harder than opting in

California’s regulator has repeatedly penalized unnecessary friction. In 2026 the California Privacy Protection Agency, now called CalPrivacy, fined Ford 375,703 dollars for adding avoidable steps to its opt-out process, and regulators have said an opt-out generally should not require a business to verify the person’s identity first. If your opt-out takes more clicks, more information or more patience than your signup, expect questions.

5. Sensitive, health and children’s data flowing to ad platforms

The highest-stakes mistakes involve information that should rarely reach an advertising vendor at all. The California Attorney General’s 1.55 million dollar settlement with Healthline Media in 2025 involved sharing health-related data and tracking that continued after opt-out. In March 2026, CalPrivacy fined PlayOn Sports 1.1 million dollars over tracking tools, including third-party cookies and meta pixels, used to send targeted advertising to ticket buyers that included students at California schools. If your site serves health, financial, education or youth audiences, review every tag on those pages first.

6. Sharing data with partners, co-ops and data brokers without notice

Marketing partnerships can count as selling or sharing personal information. California’s 375,000 dollar DoorDash settlement in 2024 involved data sold through a marketing cooperative without notice or an opt-out. Every list swap, audience partnership and data purchase deserves a privacy review before launch, including a check on where the data came from.

7. Customer lists, email and text marketing

Uploading customer email addresses or phone numbers to an ad platform for matching can itself be a disclosure of personal information, even when the identifiers are hashed. Email and text marketing add their own consent and opt-out rules on top of privacy law. Decide in advance which customer data may be used for advertising, tell customers, and make sure an opt-out in one system reaches the others.

8. Disclosures that do not match practice

A privacy policy that says one thing while the site does another invites claims of deceptive practices, separate from any underlying tracking issue. Marketing teams add and change tools constantly, so a policy written once a year drifts out of date within weeks. This is the gap that automated monitoring and dynamic policies exist to close.

9. Profiling, fingerprinting and tracking beyond cookies

Privacy compliance has to cover more than cookies. Fingerprinting, identity resolution and server-side tracking can follow people without a visible cookie, and they carry the same notice and opt-out expectations. Do not assume that a technique is outside the rules because it does not use a cookie.

What regulators have actually penalized: a quick snapshot

• Disney (California Attorney General, February 2026): 2.75 million dollars, opt-outs that did not apply across all devices and services.
• PlayOn Sports (CalPrivacy, March 2026): 1.1 million dollars, tracking tools used for targeted advertising to ticket buyers, including students.
• Ford (CalPrivacy, 2026): 375,703 dollars, unnecessary friction in the opt-out process.
• Tractor Supply (CalPrivacy, 2025): 1.35 million dollars, failure to honor opt-out requests and sharing data with ad-targeting third parties.
• Healthline Media (California Attorney General, 2025): 1.55 million dollars, health-related data sharing and trackers that kept firing after opt-out.
• Sephora (California Attorney General, 2022): 1.2 million dollars, undisclosed sale of data through trackers and failure to honor Global Privacy Control.
• DoorDash (California Attorney General, 2024): 375,000 dollars, data sold through a marketing cooperative without notice or opt-out.

The pattern is consistent. Almost none of these cases were about marketing teams collecting data in secret. They were about promises, notices and opt-outs that did not match what the technology really did. This also doesn’t include big headline settlements from privacy lawsuits for what the digital marketing teams setup for their clients. We’re talking settlements like Aspen Dental $18.7 million dollar pixel tracking settlement.

The cookie reality check

Many marketing teams spent years planning for the end of third-party cookies in Chrome. That did not happen. Google reversed course in 2025 and retired most of its Privacy Sandbox technologies in October 2025, and third-party cookies remain available in Chrome with no removal date announced. Other browsers, such as Safari and Firefox, already restrict them by default. The practical takeaway is that nothing is going to remove the need for consent management and opt-out handling on your site. Browsers will not solve this for you, and regulators are looking at what your own tags do.

A six-step marketing privacy audit

1. Inventory every tool. List each tag, pixel, SDK, plugin, email and text platform, ad audience and data partner, with a business owner for each.
2. Map the data. For each tool, record what personal information it receives, from which pages, and where it goes next.
3. Test the choices. Load your site as a first-time visitor, as a visitor who declines cookies, and as a visitor sending a Global Privacy Control signal. Record which tags still fire.
4. Check the whole journey. Confirm that an opt-out carries across devices, logged-in sessions, email, text and ad audiences.
5. Compare words with behavior. Read your privacy policy, cookie policy and banner against your test results and fix every mismatch.
6. Set a cadence. Re-test whenever a campaign launches or a tool changes, and run the full audit at least once a year.

Who should own marketing privacy?

Marketing owns the tools, legal or privacy counsel owns the interpretation, and a privacy operations function, whether in-house or a platform, owns the testing and evidence. Problems usually appear when tools are added by agencies or campaign teams without anyone checking them. The simplest fix is a launch checklist that requires a privacy check before any new tag, partner or audience goes live. For higher-risk situations, such as ad pixels on sensitive pages, bring in an attorney. Our guide on privacy counsel for website ad pixels explains what to look for and what to bring.

Where Captain Compliance fits

Captain Compliance is a privacy compliance software and consulting company, and we are not a law firm. Our tools address the operational problems in the list above.

• Cookie consent management that actually controls which tags load, and honors Global Privacy Control signals. Our consent platform is used on more than 8,000 websites and processes over 50 million consent choices a month.
• Continuous website monitoring that flags new or changed trackers and tags that fire when they should not.
• Patrol, our privacy risk monitoring tool, which surfaces mismatches between what your site does and what you disclose.
• Dynamic privacy policies and vendor disclosures that update as your marketing stack changes.
• DSAR workflows that route access, deletion and opt-out requests so they reach every system.

Frequently asked questions

What are the main privacy issues in digital marketing?

The main issues are tracking before consent, opt-outs that do not work, ignored opt-out signals such as Global Privacy Control, sensitive data reaching ad platforms, undisclosed data sharing with partners, and disclosures that do not match actual practice.

Do small businesses need to worry about marketing privacy rules?

Many state privacy laws apply only above certain thresholds for revenue, number of consumers or share of revenue from selling data, so some small businesses fall outside them. But consumer protection laws on deceptive practices, wiretapping and video privacy claims, and laws like the GDPR for European visitors, can still apply regardless of size. Ask counsel where you stand.

Are third-party cookies going away?

Not in Chrome. Google abandoned its plan to phase them out and retired Privacy Sandbox technologies in October 2025. Other browsers restrict them by default, and privacy laws regulate their use regardless of what browsers do.

What is Global Privacy Control, and do I have to honor it?

Global Privacy Control is a browser or extension setting that sends an automatic signal asking sites not to sell or share a visitor’s data. Several states, including California, require businesses to treat it as a valid opt-out. Test whether your tags actually stop when the signal is present.

Is it legal to use customer email lists for advertising?

It depends on what you told customers when you collected the data, the laws that apply, and how you use the list. Uploading it to an ad platform can count as sharing personal information. Check your disclosures and opt-out handling before you do it.

How can I find out what my website is tracking?

Run a website scan that identifies every cookie, pixel and script, then test the site with consent declined and with a Global Privacy Control signal turned on. Repeat after every marketing change.

Key takeaways

• Most marketing privacy penalties come from broken opt-outs, ignored signals, sensitive data in ad tools and inaccurate disclosures, not from collecting data at all.
• Regulators expect your privacy controls to be as sophisticated as your advertising stack.
• Third-party cookies are not going away on their own schedule, so consent and opt-out handling remain essential.
• Build privacy checks into campaign launches, and test actual site behavior regularly instead of relying on policies alone.