YouTube nocookie: what privacy-enhanced mode does, and what it doesn't
YouTube nocookie embeds explained: what privacy-enhanced mode changes, what still loads before and after Play, and how to hold videos until consent.
The Casebook
Field guides
Practical guides you can follow for your own site.
How to remove a Google review, and what you're not allowed to do
How to remove a Google review as a business owner: what Google takes down, how to report and appeal, and the review rules your own site has to follow.
Data processing agreement: what it is and which of your tools need one
A data processing agreement in plain words: what Article 28 asks, which website tools need one, where vendors keep theirs, and how to check your own.
Security headers: what they do and how to add them to your site
Security headers for site owners: HSTS, CSP, X-Frame-Options and the rest, where to set them on your host, and how to check yours in a minute.
ADA compliance checklist for a small business website
An ADA compliance checklist for a small business website, built on WCAG 2.1 AA: alt text, keyboard use, contrast, focus, forms, captions and headings.
CCPA compliance checklist for your website
CCPA compliance for a website in one checklist: thresholds, the Do Not Sell or Share link, Global Privacy Control, the notice at collection and the policy.
GDPR compliance checklist for your website: 15 things a visitor can see
A GDPR compliance checklist for a company website: the 15 things a visitor's browser can see, from cookies and consent to rights routes and trader details.
Types of cookies on websites and which ones wait for a yes
Session, persistent, first and third party, strictly necessary, functional, analytics, marketing: the types of cookies on websites and which need consent.
What is personal data? Examples from an ordinary website
What is personal data? GDPR and UK GDPR examples from a real website: IP addresses, cookie IDs, form fields, support emails, and what your notice lists.
Privacy policy example for a small company website, section by section
A privacy policy example you can read in five minutes: sample wording for each section, plus what EU, UK and US rules add. Written for a small company.
Right to be forgotten: what it means for a small company's website
The right to be forgotten lets people ask you to delete their data. When it applies, when it doesn't, and what your website should say about it.
Tracking pixel: what it is and how to spot one on your site
A tracking pixel is a tiny image or script that reports a visit to an outside server. What it collects, what regulators did about it, and a phone check.
What is a DSAR and what to do when one arrives
A DSAR is a request for a copy of someone's personal data. What it covers, the one-month clock, what to leave out, and how to set up a route on your site.
How to check website cookies on your own site, with no tool
How to check website cookies and tracking requests on your own site with a phone or your browser, and what to look for before and after the banner.
Cookie consent examples: banners that work and banners regulators flagged
Cookie consent examples in words: equal buttons, pre-ticked boxes, cookie walls and legitimate interest toggles, with what EU and UK regulators said.
Is cookie consent required in the USA? What to show instead of a banner
Is cookie consent required in the USA? Mostly no banner, but California asks for an opt-out link and a working Global Privacy Control. Here's what to show.
Cookie policy template: what to say, section by section
A cookie policy template you fill in from your own site: each cookie or tool, its purpose, how long it lasts, who sets it and how to switch it off.
Google Analytics and GDPR: what the regulators decided, and what to do now
Google Analytics GDPR, from the regulators: the 2022 Austrian, French and Italian decisions, the 2023 Data Privacy Framework, and what to do now.
Google consent mode v2: what it does, and what it leaves to you
Google consent mode v2 in plain words: basic versus advanced, what it changes in Google's tags, what it leaves to you, and a phone check for your own site.
Opt in vs opt out: what each means for your emails and your trackers
Opt in vs opt out, explained for a small company: GDPR consent, the UK soft opt-in under PECR, CAN-SPAM's opt-out, and a phone check for your own forms.
Drip pricing: what it is and how to show your full price
Drip pricing adds mandatory fees late in checkout. See what the UK and US rules say, two 2026 CMA decisions, and a five-minute check for your own site.