Book a call
Emergency supportSend a messageBook a call

Trust

Are we allowed to do this, and can everyone use it?

Area 03 Privacy, consent, accessibility and security, tested on what your site really does, not on what the policy says it does. Policies are very good at sounding confident.

The banner that asks too late

Most sites with a cookie banner also have tags that fire before the banner has loaded. By the time a visitor says no, the analytics, the ads pixel and the session replay have already said yes. It's like asking a guest whether they take milk after you've poured it in (which, for the record, nobody should).

The fix is rarely the wording of the banner. It's the load order, which script runs first, and whether each tag waits for the answer. That's the part I test, one tag at a time.

Read: Consent Management: The What and Why

Load order. Which script runs first. If the tags win, the banner is asking permission for something that already happened.

Fig. 1 — The same page, before and after the fix. The wording of the banner never changed. Diagram: a page loads an analytics tag, an ads pixel and a session replay in its first fraction of a second, and they fire. The consent banner arrives after them, too late to stop them. After the fix, the banner loads first, and the three tags wait for its answer.

The page a screen reader hears

A page can look finished and still be unusable. A screen reader doesn't see the layout; it reads the markup underneath, the HTML scaffolding, and that's where the gaps are: an image with no description, a button that's really a picture of a button, a form field nobody labelled.

An automated scan finds some of these. I also test with a screen reader and a keyboard, because that's how the people who need it will use it. No mouse, no peeking. It's slower, and it's the honest way.

Accessibility tree. The version of the page that assistive technology reads. It's built from the markup, not the pixels.

Fig. 2 — One sign-up box, as it looks and as it's heard. The fix is all in the markup; the page looks exactly the same afterwards. Diagram: a small web page with a logo, a photo, a heading, an email field and a Subscribe button. Beside it, what a screen reader announces. Before the fix: the logo is just "image", the photo is skipped, the field is "edit text" with no name, and the button is only "clickable". After the fix: "link, Acme Outdoors, home"; "image, a tent pitched by a lake at dawn"; "heading level 1, Summer sale"; "edit text, email address"; and "button, Subscribe".

What Trust covers

  • Privacy law in practice

    The Privacy Act, GDPR, CCPA and friends, applied to real sites and apps.

    • Australian Privacy Principles (Privacy Act 1988)
    • GDPR
    • European Union
    • CCPA (California)
    • six years as a DPO consultant

  • Accessibility

    Tested with a screen reader and a keyboard, not only an automated scan.

    • Accessibility
    • WCAG 2.2
    • W3C
    • ADA
    • Lighthouse

  • Security

    Logins, email authentication, and the attacks that ride in on a stolen cookie.

    • 1Password
    • Let's Encrypt
    • Cloudflare
    • passkeys · SPF, DKIM, DMARC

  • Working with regulators

    With regulators and with the organisations they regulate. Alongside your lawyers, never instead of them.

    • European Union
    • United Kingdom (ICO)
    • United States (California, federal ADA)
    • Australia
    • Germany

The rules I keep track of

Privacy law is no longer only privacy law. AI rules now sit beside it, and each place writes its own. I read them from Hobart, a very long way from Brussels, which has never once slowed Brussels down.

I was a DPO (data protection officer) consultant for six years, and I've worked with regulators as well as the organisations they regulate. Where there's legal risk, I work alongside your lawyers, never instead of them.

  • European Union: GDPR. The one most other privacy laws are measured against.
  • California: CCPA. The strongest US state privacy law, with its own regulator.
  • United Kingdom: UK GDPR and the ICO. GDPR's sibling, enforced by the Information Commissioner's Office.
  • Australia: Privacy Act 1988. The Australian Privacy Principles, with the first tranche of reforms passed in 2024.
  • Canada: PIPEDA. Canada's federal privacy law for the private sector.
  • China: Generative AI Measures. Rules for public generative AI services, and labels on AI-made content since 2025.
  • United States: ADA. Federal accessibility law, applied to websites through the courts.
  • South Korea: AI Basic Act. In force since January 2026, with fines from about 2027.
  • Brazil: LGPD. Brazil's general data protection law, close in shape to GDPR.
  • European Union: EU AI Act. Transparency duties from August 2026; high-risk rules from December 2027.
  • Colorado: Colorado AI law. Rules on automated decisions, from January 2027.

Writing on trust

All of it

Who I have worked with

A few of the brands I have worked with, directly or through their agencies.

  • Telstra
  • Subaru
  • Caterpillar
  • Flight Centre
  • L'Occitane
  • Ray White

Not sure your site does what the policy says?

Tell me what you can see going wrong, or what you'd like to be possible. You don't need the technical name for it. I have plenty, and I'm happy to share.

Send me a messageBook a call

Contact

Tell me what the problem is. You don't need the technical name for it: working that out is part of the job. If I am not the right person for it, I will say so. I reply myself, from Hobart, which is ahead of most of the world (by time zone, and in several other ways I am too modest to list).

Goes to Jimmy, in Hobart. Nobody else reads it.