How “Elite” Companies Ignore Privacy Laws and Cookies
A digital strategist warned his employer about privacy violations, got dismissed, and later watched regulators take his complaint seriously. This is what happens when companies treat compliance like a pop‑up.
When “being elite” means “We Didn’t Read the Privacy Law”
Some companies spend fortunes on branding. Carefully crafted names, glossy logos, corporate values about trust and integrity. And then there’s the other kind of company: the one that calls itself “elite” while treating the law like an annoying cookie pop‑up.
From late 2024 to 2025, a friend of mine worked as a digital marketing strategist for one of those hidden gems. Her unforgivable sin was simple: pointing out that if you’re going to stalk half the internet with Google Tag Manager, analytics, pixels and session‑replay tools, you might want to comply with basic privacy rules and ask for consent first.
Months later, the regulator that oversees those laws read the complaint and decided it was serious enough to send to their enforcement team. They played games with cookies; now they get to find out what happens when the grown‑ups walk in.
Chapter 1: The Compliance Cosplay
The story actually starts well. At one point, the company implemented a real consent solution: cookie banner, categories, opt‑in, the whole package. Analytics and marketing tags waited nicely until the user said yes. Nothing revolutionary — just the bare minimum if you don’t want to wake up to an enforcement letter.
Then came a shiny new website build.
New design. New layout. New marketing copy about “trust” and “innovation”. And, somehow, during that heroic push to “move fast”, the cookie banner vanished. Not by accident: the tracking container stayed right there, happily firing GA4, Meta, LinkedIn, Hotjar, Klaviyo and friends on first page load. Consent? That got refactored out.
The privacy statement, of course, still sounded responsible. It told users they could “configure their browser to refuse cookies” as if the burden was on the visitor rather than the business spraying trackers around without asking. Translation: We’ll do what we want; you go fight with your settings.
Compliance as costume: looks good in the mirror, collapses the second you step outside.
Chapter 2: The No‑Reason Exit
Eventually, the inevitable “no‑cause” termination arrived. Nice wording, nice paperwork, less than ideal severance. No mention of the privacy concerns she had raised, no reference to the fact that a working consent system had existed and then conveniently disappeared in the migration.
The message was crystal clear:
-
the cookie banner was inconvenient,
-
the strategist talking about privacy law was even more inconvenient.
Problem solved, as long as nobody ever checks the source code. If you don’t have the link to the URL it is hidden, right? Right?
Chapter 3: The Letter Nobody Expected
Fast‑forward a few months.
A detailed complaint lands on the regulator’s desk: tracking fired before consent, no cookie banner, no clear “do not sell or share” mechanism, a privacy statement that doesn’t match the actual behavior of the site.
After their initial review, the agency sends a letter: the complaint raises issues within their jurisdiction and is being referred to the Enforcement Division for additional review.
In plain language:
-
someone actually looked at the details,
-
they didn’t laugh it off,
-
and it now sits in the pile that can turn into real enforcement.
Most complaints never get that far. This one did.
Chapter 4: Brand vs. Source Code
The funniest part is the branding gap.
On the front end, this company sells expertise, sophisticated analytics, world‑class solutions, a culture of trust. Behind the curtain, the reality is:
-
a consent system implemented and then removed,
-
multiple third‑party trackers firing without any prior user choice,
-
a privacy statement that reads like fiction.
This isn’t a stray bug hiding in a corner. It’s a culture: performance first, law later — if ever.
The timeline says everything:
-
Consent banner in place.
-
New site build.
-
Banner gone, tracking intact.
-
Glossy copy about “protecting your data” still sitting there, untouched.
If you tried that in any other context, people would call it what it is: misrepresentation.
Chapter 5: What “Powerless” Actually Looks Like
On paper, the individual strategist in this story is the weakest player.
-
Former employee.
-
No access to systems.
-
Bound by a standard exit agreement drafted to keep things quiet.
And yet, one well‑documented, technically precise complaint was enough to push the case past the first filter and onto an enforcement desk.
That doesn’t magically turn into fines or headlines. Regulators move slowly, quietly, and they do not send you progress updates like a food‑delivery app. But somewhere in a case file, there is now a record that this company was warned — internally, then externally — and chose to keep playing dumb.
Chapter 6: Lessons for the Digital Trenches
If you work in digital, you’ve seen this movie:
-
Everyone wants better tracking,
-
nobody wants friction,
-
and “legal” is a checkbox that appears once a quarter in a slide deck.
A few uncomfortable truths for our side of the fence:
-
If you see a blatant privacy violation and say nothing, you are part of the problem.
-
If you speak up and get sidelined, that says more about them than about your skills.
-
The fact that you don’t have a litigation budget doesn’t mean you have zero leverage.
Sometimes your only real weapons are:
-
a clear conscience,
-
a good memory,
-
and the ability to describe exactly what you saw in a language regulators understand.
It’s not glamorous. It doesn’t come with LinkedIn applause. But it’s how you quietly ruin the day for people who thought they could turn compliance into a decorative checkbox.
Acuna’s Angle
This isn’t a heroic whistleblower epic. It’s something simpler and more uncomfortable:
When a company removes the cookie banner but keeps every tracking pixel, it’s not a mistake — it’s a confession.
The next time you see a site bragging about ethics and trust, do it a favor: open the source, pop open the tag manager, and see who’s actually in charge — the legal team, or the vp of marketing who thinks the law is just another pop‑up to “dismiss and continue”.
And if you ever wonder whether it’s worth filing a complaint when the odds look terrible, remember this: executives can ignore the strategist who raised the issue. They can’t ignore the email that says “your case has been referred to Enforcement. Regards, CCPA”
