Criticaldetector: cookie_consent
Advertising trackers fire before any consent
Evidence: On 14 of 38 pages, three ad/analytics trackers initiated network requests 0.4–1.1s before the consent banner rendered. The site also did not change tracker behavior when the scan presented a Global Privacy Control signal.
Comparable case: In re Sephora USA, Cal. Att'y Gen. (2022), $1.2M
Fix: Gate all non-essential tags behind consent in your tag manager; wire GPC to the same opt-out path. Re-scan to verify firing order.
Criticaldetector: session_replay
Session-replay recorder captures form keystrokes pre-consent
Evidence: A session-replay script loaded on every page including the contact form, with field masking disabled, and began recording before the consent banner appeared.
Comparable case: Javier v. Assurance IQ, 9th Cir. (2022), $1.5M
Fix: Enable consent gating and input masking in the replay tool's settings; exclude intake and checkout paths entirely.
Highdetector: ada
37 images missing alternative text, including product menu
Evidence: axe-core flagged 37 image elements without alt attributes across 12 pages; the main menu is a single image with no text alternative, the exact barrier most ADA web demand letters cite first.
Comparable case: Mendizabal v. Nordstrom, S.D.N.Y. (2021), $18K
Fix: Add descriptive alt text (or empty alt for decorative images); replace the image menu with HTML. Both are theme-level fixes.
Highdetector: auto_renewal
Recurring charge disclosed only after billing details collected
Evidence: The subscription checkout shows '$19/month, renews automatically' on the confirmation step (after the card form), and the cancellation path requires email contact while signup is fully online.
Comparable case: U.S. v. Adobe, DOJ consent judgment (2026), $150M
Fix: Move the recurring-terms disclosure above the billing step; add an online cancellation path symmetrical to signup (ROSCA's core mechanics).