Nearly Half of Top Websites Are Misconfigured on Google Consent Mode. Here Is What Founders and Small and Mid-Sized Businesses Need to Know.

If you run a business website, you are probably using Google Analytics. You may also be running Google Ads. If so, a change Google quietly made on June 15, 2026 may have put your business out of compliance with privacy laws in dozens of jurisdictions, and you probably have no idea it happened. The problem centers on something most founders and business owners have never heard of: Google Consent Mode.

TL;DR

Google removed a privacy setting on June 15, 2026 that was acting as a safety net for businesses with broken consent configurations. Google Consent Mode is now the only thing controlling whether your visitors' data gets sent to Google Ads for cross-device remarketing. If your setup is broken, visitors who opted out of tracking are still being tracked.

A new report from Privado AI found that 48% of the top 250 websites have at least one Consent Mode misconfiguration, and 90% failed at least one CCPA or GDPR compliance test.

Most business owners have no idea what tools are running on their websites, what data those tools are collecting from visitors, or where that data is going. Add AI chatbots and third-party integrations to the mix, and the exposure gets worse. Twenty U.S. states now have comprehensive privacy laws in effect, twelve require businesses to honor Global Privacy Control signals, and the EU AI Act starts requiring chatbot disclosure on August 2, 2026. Penalties range from $2,663 per violation in California to 20 million euros or 4% of global revenue under the GDPR.

Your consent banner may look fine on the surface. That does not mean it is working. If not, your business could be in violation of regulations governing its online presence and activities. Test your setup, audit your AI tools, and make sure your privacy policy actually reflects what your website is doing. If you need help figuring out where you stand legally, I offer free consultations at leveragelegalgroup.com.

What Is Google Consent Mode?

Google Consent Mode is a feature built into Google's tag infrastructure that controls how Google Analytics, Google Ads, and other Google products behave based on a visitor's consent choices. When someone lands on your website and interacts with your cookie consent banner, Consent Mode is the layer that is supposed to translate that choice into actual behavior across Google's tools.

Think of it as your consent banner being the front door to your website and business. It asks the visitor whether they are okay with tracking. But the banner itself does not control what Google Analytics or Google Ads actually do with that answer. Consent Mode is the wiring behind the wall that captures and carries the visitor's answer to every Google tag on your site and tells each one whether to collect data normally, collect limited data, or stop collecting entirely.

Consent Mode works through a set of parameters, the most important being "ad_storage" and "analytics_storage." When a visitor accepts cookies, those values are set to "granted," and Google's tools operate normally. When a visitor declines, those values should be set to "denied," which tells Google's tags to restrict or stop data collection.

The problem is that this system has to be set up correctly for it to work, and most business owners have no idea it even exists, let alone whether it is working properly on their website. Someone had to configure it, whether that was a web developer, a marketing agency, or whoever installed a company's Google Analytics and consent banner. And based on the data, a surprising number of them got it wrong. If the wiring is broken, a visitor can click "reject all" on a company's consent banner, see a confirmation that their choice was recorded, and walk away believing they opted out. Meanwhile, behind the scenes, Consent Mode never received the "denied" signal, and Google's tools keep collecting and sharing data as if consent was granted.

That gap between what the visitor sees and what is confirmed to them and what actually happens is where the hidden compliance risk lives.

A new report from Privado AI tested the top 250 websites by traffic across California, France, and the United Kingdom, and the results are striking. Nearly half of those websites, 48%, have at least one Google Consent Mode misconfiguration. That means those sites are sending personal data to Google Ads for cross-device remarketing without proper user consent.

And the broader picture is even worse. Ninety percent of the websites tested failed at least one privacy compliance test under CCPA or GDPR. Only 10% passed everything.

These are not obscure technical violations. They are the kinds of failures that trigger regulatory fines, class action lawsuits, and enforcement letters.

Whose Data Are We Talking About, and How Is It Being Collected?

When we talk about "personal data" in this context, we are not talking about the business owner's data, or their employees' information, or the files sitting in their Google Drive. We are talking about the data of every person who visits your website, uses your app, fills out your contact form, browses your products, takes your quiz, reads your blog, or interacts with your business online in any way. Your customers. Your clients. Your prospective leads. The person in France or England or Brazil who landed on your homepage from a Google search at 2 a.m. and never came back.

Under most privacy laws, "personal data" is defined broadly. It includes anything that can identify a person or be linked to them. That obviously covers names, email addresses, and phone numbers. But it also covers things most business owners never think about: IP addresses, device identifiers, browser fingerprints, cookie IDs, location data, browsing behavior, purchase history, and the unique advertising identifiers that Google and other platforms assign to users across devices. When Google Consent Mode is misconfigured and sends the full signal to Google Ads for cross-device remarketing, it is sending exactly these kinds of identifiers tied to a visitor's Google account, enabling Google to track that person across their phone, laptop, tablet, and any other device where they are signed in.

The uncomfortable truth is that most businesses are collecting far more personal data than they realize. If your website runs Google Analytics, you are collecting data about every visitor's browsing behavior, device type, location, and session duration. If you run Google Ads, Facebook Pixel, or any retargeting tool, your website is placing tracking cookies and firing network requests that transmit visitor data to third-party advertising platforms. If you use a live chat widget, an email signup form, a scheduling tool, or an embedded video player, each of those may be setting its own cookies and sending its own data to its own servers. Every plugin, every integration, every embedded script on your site is potentially collecting and transmitting personal data from your visitors without your knowledge and without any action on their part beyond loading the page.

Most business owners did not set these things up themselves. A web developer built the site. A marketing consultant added the tracking pixels. Someone installed a WordPress plugin three years ago and forgot about it. The business owner may not even know which tools are running on their site, let alone what data those tools are collecting and where that data is going.

And even if everything was configured correctly at the time, the tools themselves have changed since then. Software vendors update their products. They revise their privacy policies and terms of service. They change default settings with new releases, like Google just did. They add features that collect additional data or share it with new third parties. They have started using AI tools as a way to collect user's data and actions on your website.

A tracking tool that was compliant when your developer installed it in 2023 may have pushed an update six months ago that turned on a new data-sharing feature by default, and nobody on your team noticed. The Google Consent Mode change on June 15 is a perfect example of this: Google removed a setting that many businesses were relying on, and the companies affected were not individually notified that their compliance posture had changed. The tool changed. The risk changed with it. And the business owner might never know (which is why I wrote this article).

The AI Layer Makes This Worse

Now add AI to the picture, because tens of thousands of businesses have done exactly that in the last two years without thinking through the data implications.

If you have added an AI chatbot to your website, embedded an AI customer service agent, integrated an AI-powered scheduling assistant, or deployed any conversational AI tool that interacts with your visitors, that tool is collecting personal data. Every message a visitor types into a chatbot is data. Every question they ask, every piece of information they share in a conversation, every name, email address, phone number, account detail, or health concern they mention in a chat window is being captured, processed, and in most cases transmitted to a third-party AI provider's servers.

Do you know where that data goes? Most business owners do not. The AI chatbot vendor you installed with a few lines of code may be sending your visitors' conversation data to servers in another country. It may be storing complete transcripts of every interaction indefinitely. It may be using those conversations to train its own AI models, which means your customers' personal data could be feeding a system that serves your competitors. It may be routing conversations through human review teams for quality assurance, which means real people at a company you have never heard of are reading your customers' private messages. And your ignorance of what is happening with your visitors'/customers' data is not a defense to potential violations and liability.

A 2024 study found that only 27% of users understood how chatbot providers handled their data, and 76% were unaware that AI chatbots stored and analyzed their conversations. Your visitors are sharing information with these tools under the assumption that they are talking to your business. They do not know they are also talking to OpenAI, or Google, or whatever AI vendor is powering the widget in the corner of your screen.

And here is a question most businesses have never considered: can your visitors opt out of interacting with AI on your website? If someone does not want their data processed by an AI system, is there a way for them to decline? In most cases, the answer is no. The chatbot just appears. There is no consent screen, no opt-out button, no disclosure that the visitor is interacting with an AI system rather than a human.

The consent mechanisms that do exist on most websites are not much better. Take a close look at the cookie pop-up on your own site. If the toggle switches or checkboxes come pre-selected to "accept" or "opt in," that is a problem. Under the GDPR, pre-checked consent boxes are not valid consent. Consent has to be a clear, affirmative action by the user, which means the default state must be off, not on.

If your cookie banner loads with tracking already enabled and asks the user to opt out rather than opt in, you are collecting data before you have permission to do so. A huge number of websites still operate this way, either because the consent banner was configured incorrectly from the start or because a platform update changed the default behavior without the business owner realizing it. The visitor sees a pop-up that looks like it is asking for permission. In reality, the decision was already made for them before the page finished loading.

And this does not only apply to companies based in Europe. This applies to every business with a publicly accessible website. The GDPR applies to any organization that offers goods or services to people in the EU or monitors their behavior, regardless of where the company is headquartered, which means a solo practitioner in Texas or a startup in Toronto with a website that an EU resident can access is subject to these requirements. If your site is publicly accessible on the internet, it is accessible to EU residents, and that is enough to bring you within scope.

That is about to become a much bigger problem. On August 2, 2026, the EU AI Act's Article 50 transparency obligations become enforceable. Any operator running a chatbot or AI-powered conversational interface must disclose to users, at the start of each interaction, in plain and accessible terms, that they are communicating with an AI system. Penalties for noncompliance can reach 15 million euros or 3% of a company's worldwide annual revenue, whichever is larger. The Act applies to providers placing AI systems on the EU market wherever they are established, and to providers and deployers in third countries where the output of the system is used in the EU. That means if your website is accessible to European visitors, and your AI chatbot does not clearly identify itself as AI, you are in violation.

In the United States, the regulatory picture is developing along similar lines. The FTC warned in 2024 that deploying AI tools without proper consent constitutes unfair and deceptive data practices. A proposed federal law introduced in March 2026 would regulate AI chatbot impersonation of licensed professionals like doctors, lawyers, and therapists. Several states are already addressing AI-specific disclosure and consent requirements in their privacy frameworks.

The core problem is the same one that drives the Google Consent Mode failures, just amplified. Businesses are deploying tools that collect and process visitor data without fully understanding what those tools do, where the data goes, who has access to it, and whether their visitors have any ability to say no or demand deletion of their data.

The Privacy Policy Gap

And the problem compounds because the vast majority of small businesses use templated privacy policies and terms of use on their websites. They downloaded a template from a legal document service or use the one their website site host provided (like Shopify or Squarespace), filled in their company name and contact information, and published it. That template may say the site collects "certain information" and uses "cookies and similar technologies," but it almost certainly does not accurately describe the specific data being collected, the specific third parties receiving it, the specific purposes for which it is used, or the specific rights visitors have to opt out. It does not mention Google Consent Mode. It does not explain how GPC signals are handled. It does not list the advertising networks that receive visitor data from the site. And it almost certainly says nothing about the AI tools now operating on the site, what data they collect from conversations, where that data is stored, whether it is used for model training, or whether conversations are subject to human review.

A privacy policy that does not match your actual data practices is not just unhelpful. Under many of the privacy laws now in effect, it is itself a violation. If your privacy policy says you honor user opt-out choices but your Consent Mode configuration does not actually translate those choices into denied tracking, you have a gap between what you told your visitors and what your website is actually doing. If your privacy policy says nothing about AI data processing but your visitors are sharing personal information with a chatbot that transmits it to a third-party provider, you have another gap. Regulators and plaintiffs' attorneys look for exactly these kinds of gaps.

The people whose data is at risk here are not abstract. They are the real people visiting your website every day, people who may have explicitly opted out of tracking through their browser settings or your consent banner, and whose choices are being silently ignored because of a technical misconfiguration they will never see. They are the customers typing sensitive questions into your AI chatbot without knowing where those words are going. They are relying on your business to handle their data responsibly, and in many cases, that trust is not being honored.

What Google Changed on June 15, 2026

On June 15th, Google removed a setting in Google Analytics that previously allowed companies to limit the personal data sent to Google Ads for cross-device remarketing. That setting, called Google Signals, acted as a secondary safety net. If your Consent Mode configuration was broken, Google Signals could still prevent some of the worst data-sharing outcomes.

That safety net is gone now. Google Consent Mode is the only control left. If your website is not correctly translating user privacy choices into Consent Mode values, Google Ads will receive the full "signal" of personal data for cross-device remarketing tied to a user's Google account.

To put that in plain language: if a visitor to your website opts out of tracking, and your Consent Mode setup is broken, Google is still receiving that person's data. And Google does not just use it to serve ads. Once that data flows into Google's ecosystem, it becomes part of a much larger machine. Google uses collected data for ad targeting and cross-device remarketing, for building and refining audience profiles based on browsing behavior, shopping habits, location history, and app usage, for personalizing search results and content recommendations, and for training its AI models, including Gemini. Google quietly updated its privacy policy in mid-2026 to expand the scope of user data it ingests for AI training purposes, including media such as images, files, audio, and video recordings uploaded through its services. Your visitors' behavioral data, the pages they viewed, the products they clicked on, the patterns of how they move through your site, feeds into profiling systems that follow them across the web. That data can also flow to Google's advertising partners through real-time bidding and audience exchange networks, where it is packaged, sold, and resold to companies your visitors have never heard of and certainly never consented to share their information with.

Your visitor clicked "reject." Your consent banner confirmed their choice. And none of that mattered, because the wiring behind the wall was broken. Their data went to Google anyway, and from there it went everywhere Google's policies, partnerships, and business model allow it to go.

Why This Creates Serious Legal Exposure

A broken Consent Mode configuration is not just a technical problem. It is a compliance problem that can trigger violations across a growing patchwork of privacy laws in the United States and around the world.

The scope of the legal exposure is broader than most founders realize, because privacy regulations do not care whether you intended to violate them. They care whether your website gave your user a meaningful choice and whether your company and website actually honored the user's choice. If the answer is no, you have a huge problem.

In the United States, the regulatory landscape has expanded rapidly. Twenty states now have comprehensive privacy laws in effect as of 2026, and enforcement is intensifying. As of January 1, 2026, twelve states require businesses to recognize and honor Global Privacy Control signals: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas. That means if a visitor from any of those states sends a GPC opt-out signal through their browser, your website is legally required to stop selling, sharing, or using that person's data for targeted advertising. If your Consent Mode setup ignores that signal and keeps sending data to Google Ads anyway, you are violating the law in every one of those states simultaneously.

California's CCPA and CPRA remain the most aggressive enforcement frameworks in the US. Penalties run up to $2,663 per violation and $7,988 per intentional violation or violation involving a minor. The $1.55 million Healthline settlement in July 2025 centered partly on failure to honor GPC signals. Sephora paid $1.2 million in California, partly for the same reason. So clearly, these are not hypothetical risks.

But California is no longer the only state where this exposure exists. Indiana, Kentucky, and Rhode Island all went live with comprehensive privacy laws on January 1, 2026, with civil penalties up to $7,500 to $10,000 per violation. Cure periods, the grace windows that used to give companies time to fix problems before facing penalties, are expiring across multiple states. Delaware's cure period ended in December 2025. Montana's expired in April 2026. New Jersey's expired mid-2026. The buffer is gone.

And these laws apply to any business that meets the state's applicability threshold and processes data from that state's residents, regardless of where your company is physically located. If your website has traffic from these states, you are subject to their laws.

In Europe, the situation is equally serious. The GDPR allows fines of up to 20 million euros or 4% of global annual turnover, whichever is higher, for violations related to consent and data processing. The ePrivacy Directive adds a separate layer of cookie-specific regulation. European enforcement has been aggressive on consent failures specifically. The Privado AI report notes enforcement actions against Google (325 million euros), Shein (150 million euros), and Amazon (35 million euros) for cookie consent violations alone. Unlike many GDPR obligations, ePrivacy enforcement is not governed by the one-stop-shop mechanism, which means multiple European regulators can pursue action against the same company independently. The United Kingdom has its own parallel framework under UK GDPR and the Privacy and Electronic Communications Regulations, recently amended by the Data (Use and Access) Act 2025.

Internationally, the trend is the same direction. Many non-European jurisdictions now operate comprehensive GDPR-inspired laws, including Brazil's LGPD, South Africa's POPIA, China's PIPL, and India's DPDP. Brazil's Lei Geral de Protecao de Dados requires a lawful basis for processing personal data, including consent, and applies to any organization that processes data of individuals located in Brazil. South Africa's POPIA follows an opt-in consent model similar to the GDPR. India's Digital Personal Data Protection Act is beginning enforcement, and China's Personal Information Protection Law imposes strict consent requirements with penalties that can reach 5% of annual revenue for serious violations. Canada classifies most cookies as "computer programs" requiring user consent before installation under the Canadian Anti-Spam Law, and PIPEDA requires express consent for anything sensitive or unexpected. Quebec's provincial privacy law goes further, requiring express opt-in for cookies.

The practical problem is that all of these laws apply based on where the visitor is located, not where your business is headquartered. If your website is accessible to users in California, the EU, Brazil, and Canada, you are simultaneously subject to all of their consent requirements. A single broken Consent Mode configuration that fails to translate a user's privacy choice into an actual denial of tracking can create violations across multiple jurisdictions at once.

For a solo practitioner running a law firm website, a founder with an e-commerce store, or a creator monetizing through advertising, this kind of multi-jurisdictional exposure might feel abstract. It is not abstract. Regulators are testing whether consent mechanisms exist and whether they actually work. And a consent banner that looks right on the surface but fails to stop tracking behind the scenes is exactly the kind of failure that enforcement actions, penalties and fines are built on.

Where the Failures Are Happening

The Privado AI report identified three primary failure points, and they are worth understanding even if you are not a developer, because they map directly to the legal exposure your business faces.

The most common failure, affecting 40% of the websites tested, is a California-specific problem. When a user's browser sends a Global Privacy Control (GPC) signal, which is a legally recognized opt-out under the CCPA, many websites simply ignore it. The consent banner may work fine, but the GPC signal never gets translated into a Consent Mode denial. The result is that California users who have opted out of tracking are still being tracked.

The second failure is a European default-state problem. Twenty-eight percent of websites initialize Consent Mode in a "granted" state before the user has done anything at all. Under GDPR, tracking should not begin until the user affirmatively consents. If your Consent Mode starts in "granted," data flows to Google Ads the moment the page loads, regardless of what the user does next.

The third failure involves the "reject all" button in Europe. Nineteen percent of websites recorded the user's rejection but never actually changed the Consent Mode value to "denied."

Why This Hits Small and Mid-Sized Businesses Hard

Large companies have dedicated privacy teams, compliance budgets, and engineering resources to catch these kinds of issues. Most founders, sole proprietors, and small and mid-sized businesses do not. If you set up your website's cookie consent banner two years ago and have not touched it since, or just relied on your hosting site's default, there is a real chance your configuration has drifted out of compliance without you knowing.

The Privado AI report makes an important point about this: consent implementations are not static. Every time a marketing tag is added, a vendor changes, a container is updated, or a new script is deployed, there is a chance something breaks. A configuration that was compliant six months ago may not be today.

When GM pays $12.75 million or Disney pays $2.75 million in CCPA penalties, those companies absorb it and move on. They have in-house privacy counsel, compliance departments, and legal budgets built for exactly this kind of exposure. A solo founder running a Shopify store, a ten-person agency with a WordPress site, or a creator monetizing through ads does not have that cushion. A single enforcement action at even a fraction of those amounts could wipe out a year of revenue, force layoffs, or shut the business down entirely. The per-violation penalty structure is the same whether you are a Fortune 500 company or a one-person LLC. For a small business, even a fraction of those penalties could be devastating.

What You Can Do Right Now

If you use Google Analytics or Google Ads on your website, here are the steps you should take.

First, check whether your website actually honors Global Privacy Control. Open your site in a browser with GPC enabled (Firefox supports it natively, and there are browser extensions for Chrome) and see whether tracking stops. If advertising cookies are still being set or third-party network requests are still firing after a GPC opt-out, you have a CCPA problem.

Second, verify that your Consent Mode initializes in a denied state. If you are in a jurisdiction that requires opt-in consent (which includes any website accessible to European users), Consent Mode should start with all values set to "denied" and should only switch to "granted" after the user affirmatively accepts. If it starts in "granted," your site is sharing data with Google before the user has given permission.

Third, test your reject-all flow end to end. Click "reject all" on your own consent banner and then check whether cookies, analytics beacons, and advertising pixels actually stop. The Privado AI report found that on a significant percentage of websites, clicking reject all does nothing to stop non-essential tracking behind the scenes.

Fourth, audit your setup after any website changes. New marketing tags, updated plugins, vendor swaps, platform migrations: all of these can break consent configurations. If you are not re-testing after changes, you are assuming compliance rather than verifying it.

Fifth, talk to whoever manages your website. Whether that is a web developer, a marketing agency, or a platform like Squarespace or WordPress, ask them directly: is our Google Consent Mode configured correctly? Is our consent banner actually enforcing user choices across all tracking technologies? If they cannot answer with specifics, that is a sign you need a deeper audit.

Sixth, audit your AI tools. If you have added a chatbot, AI assistant, or any conversational AI to your website, find out where the conversation data is stored, whether it is used for model training, whether human reviewers can access it, and whether your visitors are clearly informed they are interacting with AI. If you serve European visitors, you need that AI disclosure in place before August 2, 2026.

Seventh, review your privacy policy against what your website actually does. Compare every cookie, every tracker, every third-party integration, and every AI tool running on your site against what your privacy policy discloses. If there is a gap, close it. A templated privacy policy that does not reflect your actual data practices is a liability, not a shield.

For a visual checklist of these steps, go here:

This Is Part of a Bigger Pattern

This Google Consent Mode issue is not happening in isolation. It is part of a broader trend where Google rolls out changes that shift compliance burdens onto businesses, often without adequate notice or transparency.

I wrote about another example of this just today. Google is rolling out a new feature in the Gemini app that allows users to create AI-generated avatars using their own face and voice, and as of July 16, 2026, this feature is turned on by default for every eligible Google Workspace customer. If you manage a Workspace account for your business, your employees can now hand Google a biometric profile of their face and voice unless you take action to disable it before August 4. I covered the details, the risks, and the step-by-step instructions for turning it off in this article on my Substack.

The common thread is that Google consistently opts users into new data collection and sharing features by default and puts the burden on administrators and business owners to opt out. Whether we are talking about consent mode configurations, analytics settings, or biometric AI features, the pattern is the same: the feature ships turned on, and it is your job to turn it off.

For founders and business owners who are already stretched thin, this approach creates real risk. You cannot protect your customers and your business if you do not know what has changed. And Google is not making it easy to keep up.

The Ongoing Work for Businesses

Privacy compliance is not a one-time project. It is an ongoing responsibility, and it requires attention every time your tools, your vendors, or your platform providers make changes.

If you have not audited your website's consent and tracking setup recently, now is the time. The June 15 change to Google Consent Mode has removed the safety nets that previously masked broken configurations, and most businesses have no idea whether their setup is compliant or not. Here is a pdf of this checklist for quick reference: https://mailchi.mp/leveragelegalgroup/privacy-checklist

Take 30 minutes this week to check your setup. Talk to your web developer. Test your consent flows. Look at what your AI tools are actually collecting. And if you are not sure what you are looking at, or you suspect there are problems you do not have the technical knowledge to diagnose on your own, reach out.

I offer free consultations for founders, small and mid-sized businesses, and creators who want to understand their actual compliance exposure. As a lawyer who works at the intersection of AI, data privacy, and digital regulatory compliance, I can help you identify where your legal risks are, whether your privacy policy reflects what your website is actually doing, and what obligations you have under the patchwork of U.S. state and international privacy laws that apply to your business. If there are gaps between what your website promises visitors and what is happening behind the scenes, I will tell you exactly what needs to change, how urgently it needs to happen, and what to ask your web developer or technical team to fix.

You can schedule a free consultation at https://calendly.com/jemlawtrademark/30-minute-free-consultation-llg.

Do not wait for a regulator or a plaintiff's attorney to find these problems before you do.

Sources

Privado AI, "The State of Google Consent Mode Report," June 16, 2026

Google, "Updates to Google Analytics Data Controls," Google Analytics Help Center (https://support.google.com/analytics/answer/17016975)

Google, "Google Ads Terms & Conditions," Google Advertising Policies Help Center (https://support.google.com/adspolicy/answer/54818)

IAPP Westin Research Center, "US State Privacy Legislation Tracker," updated June 29, 2026 (https://iapp.org/resources/article/us-state-privacy-legislation-tracker)

MultiState, "20 State Privacy Laws in Effect in 2026: Key Dates & Changes," May 1, 2026 (https://www.multistate.us/insider/2026/2/4/all-of-the-comprehensive-privacy-laws-that-take-effect-in-2026)

Didomi, "Global Privacy Control (GPC) in 2026," December 4, 2025 (https://www.didomi.io/blog/global-privacy-control-gpc-2026)

Forbes Technology Council, "Navigating New U.S. State Data Privacy Laws in 2026," March 5, 2026 (https://councils.forbes.com/blog/navigating-new-u.s.-state-data-privacy-laws-in-2026)

Clym, "What Is Global Privacy Control (GPC)?" June 1, 2026 (https://www.clym.io/blog/what-is-global-privacy-control-the-opt-out-signal-12-us-states-now-require-you-to-honor)

Chatboq, "AI Chatbot Privacy Concerns: Risks, Data Collection, and Compliance," April 10, 2026 (https://chatboq.com/blogs/ai-chatbot-privacy-concerns)

EU Artificial Intelligence Act, "The EU AI Act's Transparency Rules: A Practical Guide to Article 50" (https://artificialintelligenceact.eu/transparency-rules-article-50/)

TechTimes, "EU AI Act Enforcement Is Here: Chatbot Rules Live, High-Risk AI Delay Now Binding Law," July 10, 2026 (https://www.techtimes.com/articles/320101/20260710/eu-ai-act-enforcement-here-chatbot-rules-live-high-risk-ai-delay-now-binding-law.htm)

Secure Privacy, "US State Privacy Law Tracker (2026): Enforcement Updates & Compliance Playbook" (https://secureprivacy.ai/blog/us-state-privacy-law-tracker-2026)

VaultJS, "U.S. Privacy Laws (and Key Provisions) That Take Effect or Become Enforceable in 2026," February 26, 2026 (https://vaultjs.com/resources/us-privacy-laws-and-key-provisions-that-take-effect-or-become-enforceable-in-2026/)

Forcepoint, "Tracking Global Data Protection Laws in 2026," May 12, 2026 (https://www.forcepoint.com/blog/insights/tracking-global-data-protection-laws-2026)

Jessica Eaves Mathews, "Google Just Turned On AI Face and Voice Cloning for Your Company's Workspace Account. Here's How to Turn It Off," Substack, July 16, 2026

Jessica Eaves Mathews is an award-winning attorney, AI governance expert, and founder of Leverage Legal Group, a trademark, copyright, AI, and digital regulatory compliance law firm focused on protecting founders, startups, small and mid-sized businesses, and independent creators. She writes about trademark law, copyright, AI, and brand protection at leveragelegalgroup.com and on LinkedIn.