Privacy / Cookie / Consent
Surface Check

Fresh incognito session on both desktop and mobile. Before interacting with the consent banner, the following cookies are already set: _ga, _ga_XXXXXXX (Google Analytics 4), _gid (GA session), _fbp (Facebook Pixel), _fbc (Facebook click tracking), tidio_state_* (2 cookies from Tidio live chat widget). Network tab confirms gtag.js, fbevents.js, and tidio.js all fire and send data before the consent banner is even visible.

Under GDPR Article 5 and the ePrivacy Directive, setting non-essential cookies and transmitting user data to third parties before obtaining informed, affirmative consent is a violation. Any EU visitor to the site triggers this non-compliant behavior. Under CCPA, the issue is less about pre-consent loading and more about the absence of a 'Do Not Sell' mechanism, but the tracking-before-consent pattern creates liability under both frameworks.

The consent banner plugin (CookieYes) is configured in 'notice-only' mode rather than 'opt-in' mode. In notice-only mode, the banner displays but does not block scripts from loading. All tracking scripts are hardcoded in the WordPress theme header rather than managed through a tag manager with consent-gating.

Switch the CookieYes plugin from notice-only mode to opt-in mode. Move all tracking scripts (GA4, Facebook Pixel, Tidio) from the theme header into Google Tag Manager, and configure GTM to fire these tags only after consent is granted for their respective categories. Verify with browser dev tools that no non-essential cookies are set and no tracking network requests are made until the user clicks 'Accept.'

The consent banner displays two options: a prominent green 'Accept All' button and a smaller gray 'Cookie Settings' text link. There is no 'Reject All' or 'Decline' button. The 'Cookie Settings' modal defaults all toggle categories to ON, requiring the user to manually switch each one off before clicking 'Save Preferences.'

GDPR guidance from multiple EU data protection authorities requires that rejecting cookies be as easy as accepting them. A two-click accept path versus a five-click reject path does not meet this standard. Dark pattern design that makes rejection deliberately harder than acceptance is specifically cited in enforcement actions.

The CookieYes plugin supports a 'Reject All' button but it is disabled in the current configuration. The default-on toggle behavior is a plugin setting that can be changed to default-off.

Enable the 'Reject All' button in the CookieYes configuration so it appears alongside 'Accept All' with equal visual prominence. Change the Cookie Settings modal defaults from opted-in to opted-out for all non-essential categories.

After opening Cookie Settings, toggling all categories to OFF, and clicking Save Preferences, the GA4 and Facebook Pixel scripts continue to send network requests. Cookies _ga, _gid, and _fbp persist in the browser. Only the Tidio chat widget is suppressed after consent rejection.

The consent mechanism is decorative — it presents the appearance of user control while taking no actual action on two of the three tracking services. This is worse than having no consent banner at all, because it creates a false impression of compliance. If a regulator or auditor tests the consent flow, the non-functional enforcement is immediately discoverable.

GA4 and Facebook Pixel are loaded via hardcoded script tags in the WordPress theme header.php rather than through the consent-managed tag loading system. Only the Tidio widget is loaded through the CookieYes consent-gated script injection.

Move all tracking scripts into Google Tag Manager and configure consent-mode triggers (as described in Finding 1). After implementation, verify: (1) Reject All results in zero tracking cookies and zero tracking network requests, (2) toggling individual categories on/off correctly enables/disables only the corresponding scripts, (3) consent choice persists across page navigations.

The privacy policy page shows 'Last Updated: March 2021.' The policy does not mention Facebook Pixel, Tidio live chat, or the Calendly booking integration that is present on /book-appointment/. The policy references Google Universal Analytics (UA), which was sunset in July 2023 — the site now runs GA4, which has a different data collection model.

A privacy policy that does not accurately describe the data collection practices actually occurring on the site fails the transparency requirement of GDPR Article 13 and CCPA disclosure requirements. If a patient asks 'what data do you collect about me online and who do you share it with,' the privacy policy cannot answer that question accurately.

The privacy policy was likely written during the original site build in 2021 and has not been updated since. Third-party services were added after the policy was last revised.

Update the privacy policy to accurately reflect all current data collection: GA4 analytics, Facebook Pixel marketing tracking, Tidio live chat (collects visitor data and chat transcripts), and Calendly appointment scheduling (collects patient name, email, phone, appointment preferences). Include data retention periods, third-party sharing disclosures, and contact information for privacy inquiries. Legal counsel review recommended.