Book a call
Emergency supportSend a messageBook a call

Trust

Are we allowed to do this, and can everyone use it?

Area 03 Privacy, consent, accessibility and security, tested on what your site really does, not on what the policy says it does.

The banner that asks too late

Most sites with a cookie banner also have tags that fire before the banner has loaded. By the time a visitor says no, the analytics, the ads pixel and the session replay have already said yes.

The fix is rarely the wording of the banner. It's the order things load in, and whether each tag actually waits for the answer. That's the part I test.

Read: Consent Management: The What and Why

Load order. Which script runs first. If the tags win, the banner is asking permission for something that already happened.

Fig. 1 — The same page, before and after the fix. The wording of the banner never changed. Diagram: a page loads an analytics tag, an ads pixel and a session replay in its first fraction of a second, and they fire. The consent banner arrives after them, too late to stop them. After the fix, the banner loads first, and the three tags wait for its answer.

The page a screen reader hears

A page can look finished and still be unusable. A screen reader doesn't see the layout; it reads the markup underneath, and that's where the gaps are: an image with no description, a button that's really a picture, a form field nobody labelled.

An automated scan finds some of these. I also test with a screen reader and a keyboard, because that's how the people who need it will use it.

Accessibility tree. The version of the page that assistive technology reads. It's built from the markup, not the pixels.

Fig. 2 — One sign-up box, as it looks and as it's heard. The fix is all in the markup; the page looks exactly the same afterwards. Diagram: a small web page with a logo, a photo, a heading, an email field and a Subscribe button. Beside it, what a screen reader announces. Before the fix: the logo is just "image", the photo is skipped, the field is "edit text" with no name, and the button is only "clickable". After the fix: "link, Acme Outdoors, home"; "image, a tent pitched by a lake at dawn"; "heading level 1, Summer sale"; "edit text, email address"; and "button, Subscribe".

What Trust covers

  • Privacy law in practice

    The Privacy Act, GDPR, CCPA and friends, applied to real sites and apps.

    • Australian Privacy Principles (Privacy Act 1988)
    • GDPR
    • European Union
    • CCPA (California)
    • six years as a DPO consultant

  • Accessibility

    Tested with a screen reader and a keyboard, not only an automated scan.

    • Accessibility
    • WCAG 2.2
    • W3C
    • ADA
    • Lighthouse

  • Security

    Logins, email authentication, and the attacks that ride in on a stolen cookie.

    • 1Password
    • Let's Encrypt
    • Cloudflare
    • passkeys · SPF, DKIM, DMARC

  • Working with regulators

    With regulators and with the organisations they regulate. Alongside your lawyers, never instead of them.

    • European Union
    • United Kingdom (ICO)
    • United States (California, federal ADA)
    • Australia
    • Germany

The rules I keep track of

Privacy law is no longer only privacy law. AI rules now sit beside it, and each place writes its own.

I was a DPO consultant for six years, and I've worked with regulators as well as the organisations they regulate. Where there's legal risk, I work alongside your lawyers, never instead of them.

  • Australia: Privacy Act 1988. The Australian Privacy Principles, with the first tranche of reforms passed in 2024.
  • European Union: GDPR. The one most other privacy laws are measured against.
  • European Union: EU AI Act. Transparency duties from August 2026; high-risk rules from December 2027.
  • United Kingdom: UK GDPR and the ICO. GDPR's sibling, enforced by the Information Commissioner's Office.
  • California: CCPA. The strongest US state privacy law, with its own regulator.
  • Colorado: Colorado AI law. Rules on automated decisions, from January 2027.
  • United States: ADA. Federal accessibility law, applied to websites through the courts.
  • South Korea: AI Basic Act. In force since January 2026, with fines from about 2027.
  • China: Generative AI Measures. Rules for public generative AI services, and labels on AI-made content since 2025.
  • Brazil: LGPD. Brazil's general data protection law, close in shape to GDPR.
  • Canada: PIPEDA. Canada's federal privacy law for the private sector.

Writing on trust

All of it

Not sure your site does what the policy says?

Tell me what you can see going wrong, or what you'd like to be possible. You don't need the technical name for it.

Send me a messageBook a call

Contact

Tell me what the problem is. You don't need the technical name for it: working that out is part of the job. If I am not the right person for it, I will say so. I reply myself, from Hobart, which is ahead of most of the world (by time zone, and in several other ways I am too modest to list).

Goes to James. Nobody else reads it.