What Is Actually Happening · Right Now · On Your Website
A Visitor Opens Your Website. Before They Read a Single Word, Their Data Is Already Gone.
The moment a browser loads your website — before anyone clicks, before anyone scrolls, before anyone fills out a form — data is already being collected. Silently.
Your dog could accidentally step on the keyboard and open your page. The data is gone before the dog lifts its paw.
The page opened. The data left. That’s it.
Here is what happens in the first 300 milliseconds:
Meta Pixel fires
Captures IP address, device type, browser, screen size. If the visitor has a Facebook cookie active in their browser — their full identity is captured. Name. Profile. Interests. Sent to Meta’s servers before they’ve read your headline.
YouTube embed activates
Logs that a specific person — identified by their Google account — viewed a specific video. Under the VPPAVideo Privacy Protection Act — 18 U.S.C. §2710. Federal law, enacted 1988. Whether website video viewers qualify as VPPA “consumers” is being decided at the U.S. Supreme Court (Salazar v. Paramount Global, cert. granted Jan. 26, 2026. Oral argument: Oct. 14, 2026)., that is a recordable viewing event. Whether website video viewers qualify as VPPA “consumers” is before the U.S. Supreme Court (Salazar v. Paramount Global, cert. granted Jan. 26, 2026. Oral argument: Oct. 14, 2026).
Google Analytics records the session
Pages visited. Time on page. Where they came from. Where they went next. Device fingerprint. Stored on Google’s servers for 2 months by default, up to 14 months if configured — attached to a profile they’ve been building on that visitor for years.
Who is tracked
Every visitor.
Any age. Any device.
No action required.
Any age. Any device.
No action required.
What is collected
Identity. Location.
Behavior. Device.
Video history.
Behavior. Device.
Video history.
When it happens
Page load.
Background. Silent.
No consent asked.
Background. Silent.
No consent asked.
The organization that owns the website did not authorize this in any meaningful sense. Their web team installed standard tools. Their marketing agency added pixels. Nobody read 47 pages of Terms of Service. Nobody knew they became a data controllerA "data controller" is the legal entity responsible for deciding how personal data is collected and used. Under GDPR, CCPA, and CIPA — you own the website, you are the controller. Regardless of who installed the tracker. the moment those tools went live.
“If everyone is using it, it must be safe.”
The LA Times paid $3.85M to find out otherwise.
It does not matter who installed it. The site is yours, so the trackers on it are yours to know about. Every visitor. Every page load.
The Most Common Misreading
“Everyone Does It. We’ve Seen Bigger Companies With the Same Tools.”
Yes. Everyone does it. That is exactly the problem.
Automated scanning does not look for outliers — it looks for the same handful of tools, on any site. Using what everyone uses is exactly why a site turns up in a sweep.
Being typical is not the same as being checked. The only way to know is to look.
Meta made the headlines. The businesses using Meta’s tools became the next targets.
Google and Meta built tracking infrastructure at global scale. They distributed it through free tools — GA4, GTMGoogle Tag Manager — a tag container that fires any configured tracker on every page load without touching the code. One install creates a permanent backdoor for unlimited future trackers., Meta Pixel, YouTube embeds — that businesses and organizations trusted and installed without question. CRM systems came bundled with it. Website templates had it pre-installed. Plugins activated it silently.
The organizations that adopted those tools became unwitting proxy distributors of surveillance infrastructure. They didn’t know. The brand name was Google. The tool was free. Nobody guarding the small business, the school, the nonprofit said stop.
Privacy class action attorneys don’t need another billion-dollar case. They look for the same handful of tools on many sites at once, which is why ordinary organizations turn up in a sweep at all. no idea the lawsuit was coming.
Most sites are running at least one of these. Knowing which is a 60-second answer.