Browser Fingerprinting Without Cookies: What GDPR Actually Permits
Canvas, AudioContext, and WebGL fingerprinting bypass cookie consent entirely — but GDPR's reach extends far beyond cookies. Here's where the legal lines sit.
Blog
Expert analysis on GDPR enforcement, dark patterns, tracking forensics, and compliance.
Canvas, AudioContext & WebGL Fingerprinting: Legal Without Consent?
Browser fingerprinting without cookies achieves near-unique identification without storing anything. Here's where GDPR draws the line — and why most deployments are non-compliant.
IAB TCF 2.2: Why the Industry's Consent Framework Still Fails GDPR
TCF 2.2 promised to fix the legal gaps exposed by regulators, but structural flaws in vendor auditing, purpose stacking, and signal integrity leave CMPs non-compliant.
LinkedIn Insight Tag: The Third-Country Transfer Most DPOs Overlook
The LinkedIn Insight Tag runs on 87% of B2B websites — often pre-consent, always with US data transfers. Why it's a bigger GDPR problem than Google Analytics, and what you need to do.
The 10 Most Common CMP Mistakes That Will Be Costly After June 28, 2025
The EAA takes effect on June 28, 2025. We audited 500 consent banners and reveal the 10 configuration mistakes we find most often — with concrete fixes for Cookiebot, Usercentrics, and OneTrust.
Digital Evidence in Court: What Judges Actually Check — and How to Prepare
Screenshots get challenged, PDFs can be manipulated. How does digital forensics survive evidence proceedings? A practical guide with procedural law basics, case examples, and tips for lawyers.
GTM Consent Mode v2: The 5 Most Common Configuration Mistakes — and How to Fix Them
Google Consent Mode v2 has been mandatory for Google Ads since March 2024. But most implementations are flawed. We show the 5 mistakes we find most often in audits — with GTM screenshots and copy-paste fixes.
Pay or OK: How Europe's Data Protection Authorities Ruled in 2024–2026
CNIL, Austrian DPA, Datatilsynet, AEPD — a systematic overview of all regulatory decisions on 'Consent or Pay' models. Who approved, who prohibited, and why.
Case Study: How a German Media Company Deployed Server-Side Tracking — and Heard from the DPA
An anonymized real-world case illustrates why server-side tracking is not a free pass. From GTM server migration to CNIL guidelines to DPA correspondence.
Security Headers in 15 Minutes: Copy-Paste Configurations for Nginx, Apache, and Cloudflare
Got an F-grade on security headers? Here are the exact configurations you can paste into your server config — tested, commented, ready to deploy.
Shell Company Detection in KYC: What FATF Expects from Web-Based Due Diligence
FATF Recommendation 24 demands beneficial ownership transparency that most web-based KYC tools still fail to deliver. Here's the technical and legal gap analysis.
Server-Side Tracking: When First-Party Appearance Masks Third-Party Reality
CNAME cloaking, GTM Server-Side, and first-party endpoint proxying let vendors collect data as if they were your own infrastructure. Here's what that means legally and technically.