10 Mar 2026 Search

This is a general version of an answer to a question about a marketing compliance project. A niche company has the option of either doing all the conventional compliance stuff around a conventional adtech/martech surveillance stack, or switching to post-creepy marketing, to the point of being able to accurately say we do not sell or share your personal information even by the CCPA definition of “sell.”

A lot of advice about how to do conventional compliance is coming out because many in the corporate privacy compliance scene have takes on the recent Ford and PlayOn cases.

Neither company was doing anything out of the ordinary. Ford made the old mistake that GDPR compliance doesn’t get you CCPA compliance, and put the opt out of sale process through an email verification step. But opt outs are not verifiable, so they were out of compliance. PlayOn was doing pretty standard “best practices” tracking, probably straight from the recommendations at Meta and other companies, but opt‑out mechanisms—a toll-free phone number and an email address—were functionally disconnected from the actual data flows created by tracking technologies, and Global Privacy Control wasn’t hooked up correctly.

Plenty of advice is available on how to avoid being the subject of a case like one of these. But any company that goes with that conventional approach to compliance is signing up to pay three kinds of taxes to the compliance complex.

  • lawyer hours: A lot of the questions on how to configure tracking service X to work correctly in state Y are hard.

  • compliance SaaS: Yes, there is software to keep track of this stuff, and add “compliance” doo-dads to sites and apps. Another SaaS vendor, another license, another bill. (See below for some news from California. More money and drama for age estimation SaaS coming soon—for companies that choose the conventional approach.)

  • developer time: Mostly the company is going to pay in opportunity costs, the revenue that would have been earned if developers had been working on other tickets.

Generally the company has to hire a privacy compliance manager to handle those, kind of like the tax preparer for the compliance taxes, so there is another layer of overhead. And depending on how you look at it, the taxes may not be the worst of it. Two other problems.

  • If the company serves an early adopter, high-privacy customer base, management’s OODA loop now has a gap of unknown size. Decisions will be made based on the actions of the highly surveillable, atypical, subset of the customers, not those of the typical customers.

  • If the company is in a market where typical customers are less privacy-protected and more surveillable, it’s on the losing end of the customer acquisition cost crunch as Google and Meta continue to capture a larger fraction of every sale. (As big-time growth stocks in a small-time growth economy, they have to.)

Is there a better way? No, I don’t mean use a chatbot for compliance and plan to pay the fines. At the beginning of CCPA, fines were cheaper than hiring a compliance manager and paying the costs they identify, but fines are going up. Is there a path to escape the CAC crunch, make better decisions, go tax-free? (There is the whole not participating in surveillance dystopia slash mental health crisis thing, but David Nyurenberg and Brian Jacobs already explained that.)

Update 12 Mar 2026: The Ninth Circuit, in today’s NetChoice v. Bonta opinion which partially vacates a preliminary injunction against the California Age-Appropriate Design Code Act,writes,

Accordingly, we vacate the preliminary injunction as to the age estimation provision and remand to the district court to consider this question in the first instance. However, we also emphasize that § 1798.99.31(a)(5) allows a covered business to avoid age estimation altogether if it defaults to “apply[ing] the privacy and data protections afforded to children to all consumers.” On remand, the parties and the district court may wish to consider the effect of that opt-out language on any burden on expression that may arise from the age estimation requirement.

Businesses operating a web site that might reach children in California can either (1) pay yet another compliance tax to the operators of some age estimation SaaS along with the usual compliance costs or (2) just turn off creepy mode for everybody instead of trying to classify children and adults and putting only the adults into creepy mode. Sounds like a good opportunity to lose the whole “compliance” stack and put the budget into something win-win instead. (More on the case in Ninth Circuit Deals Another Blow to Big Tech’s Campaign for Broad Immunity from Regulation, Allows Parts of California’s Design Code to Go into Effect from the Electronic Privacy Information Center.)

More: Have you filed your compliance taxes?