Your consent banner is configured.
Your tracking infrastructure isn’t.

U.S. privacy tracking compliance is the technical enforcement of state-level opt-out rights inside your analytics and advertising stack. When a user opts out of targeted advertising or data sale and sharing, your tracking tags — GA4, Google Ads, Meta Pixel, LinkedIn, and any other scripts on your site — must stop collecting and transmitting data for that user.

A cookie banner alone does not achieve this. The banner captures preference; the enforcement layer applies it. That layer lives in your tag manager logic, your server-side configuration, and your CMP integration.

The free tier gives you 3 audit scans per 30-day window, dashboard access, and partial compliance reports. No credit card required. It’s designed to let you see what the engine finds in your stack before deciding whether to upgrade.

Free tier does not include the Opt-Out Mode™ GTM template, AI remediation briefings, or compliance certificates. Those unlock at Tier 1.

Tier 1 self-serve is built for teams that have someone — in-house or via an agency — comfortable in Google Tag Manager and Consent Mode v2 configuration. The Opt-Out Mode™ template ships pre-built, but it still needs to be installed in your GTM container, connected to your CMP, and tested.

If your team doesn’t have that capacity, Tier 2 Guided is the right fit. Trackture engineers handle GTM, sGTM, and CMP integration end to end. You review and approve. The platform itself is identical — the difference is who performs the implementation.

Tier 1 and Tier 2 accounts run monthly automated re-scans by default, plus unlimited on-demand scans whenever you want to verify a change. Tier 3 Enterprise supports custom scan cadences — weekly, bi-weekly, or aligned to your release cycle.

QA certification scans, which issue the time-bound compliance certificate, are limited to 3 per 90-day window on Tier 1 and Tier 2.

Certificates are valid for 90 days from issuance. Re-certification requires running a fresh QA scan that confirms zero violations across all covered laws. Each certificate is publicly verifiable via a unique cert ID and QR code.

The 90-day window reflects the reality that tracking stacks change — new tags get added, vendors update, CMPs are reconfigured. A short validity window forces re-verification rather than a one-time stamp that drifts out of date.

None. The scanner runs from Trackture-controlled headless browser environments, not from your visitors’ sessions. It simulates an opt-out flow, observes which tags fire, classifies the network requests, and records vendor behavior. No real user data, no PII, no session data is involved.

Scan results contain technical metadata about your tracking stack — tag names, vendor classifications, cookie inventories, network call destinations — not customer data.

The platform enforces the technical components of CPRA’s Do Not Sell/Share signals and targeted advertising opt-outs through event-level suppression, GA4 Restricted Data Processing, and Google Ads Limited Data Use.

Legal disclosures, privacy policy language, and regulatory filings remain the responsibility of your legal team. Trackture is not a law firm and does not provide legal advice.

Yes, in California, Colorado, Connecticut, and Montana. These four states require businesses to honor Global Privacy Control signals as a valid opt-out of data sale or targeted advertising.

Opt-Out Mode™ detects and enforces GPC signals automatically as a hard block, overriding in-page preferences where GPC takes legal precedence.

The platform is built for incremental expansion. As new states enact privacy legislation, the enforcement ruleset extends without changes to your analytics or advertising infrastructure.

CTLA — the Compliance Tracking Layer Architecture behind the engine — was designed specifically for this. You don’t re-implement every time a new bill passes.

GDPR uses an opt-in model — no tracking until the user consents. U.S. state laws use an opt-out model — tracking is allowed by default until the user opts out.

Consent Mode v2 was designed for GDPR’s opt-in model and does not correctly handle U.S. opt-out requirements. Applying GDPR logic to U.S. markets results in either over-suppression (losing valid measurement data) or under-suppression (non-compliant tracking).

Yes. The Opt-Out Mode™ template ships as a GTM container import. CTLA enforcement runs at both the client-side GTM layer and inside server-side GTM, where suppression cannot be bypassed by browser extensions, ad blockers, or client-side script interruptions.

For teams already running sGTM, the platform adds compliance enforcement as a first-class layer rather than a downstream destination. Your measurement stack stays intact — what changes is what’s allowed to fire and what gets minimized.

No. Consent Mode v2 is designed for EU and EEA markets under GDPR, which uses an opt-in model. U.S. state laws use an opt-out model — fundamentally different enforcement logic.

Companies operating in both regions run Consent Mode v2 for EU traffic and Opt-Out Mode™ for U.S. traffic. The platform engineers both layers so they coexist without conflict.

A CMP is not legally required for U.S. state compliance, but most organizations run one for operational consistency and to surface opt-out preferences to users. Opt-Out Mode™ functions with or without a CMP.

Native CMP adapters ship for OneTrust, Cookiebot, Usercentrics, Osano, and Termly. Custom adapters for any other CMP are available as a one-time add-on.

Minimal impact on aggregate reporting. For opted-out users, identifiers and advertising signals are minimized or suppressed as required. GA4 Restricted Data Processing keeps measurement stable, and server-side enforcement preserves accurate event delivery for compliant traffic.

For most organizations, a proper Opt-Out Mode™ implementation actually improves data quality by removing contaminated events from users who opted out but were still being tracked due to missing enforcement logic.

Tier 1 and Tier 2 are per-domain subscriptions. The base plan covers one primary domain with unlimited audit scans and unlimited team seats. Additional domains are $39/month each, billed annually.

Tier 2 Guided adds a one-time setup fee of $2,500 to $5,000 depending on tracking complexity — tag count, vendor footprint, CMP configuration. Quoted after the kickoff call. Tier 3 Enterprise is proposal-based for multi-domain portfolios and operators with custom requirements.

Subscription fees on Tier 1 and Tier 2 are refundable within 14 days of initial purchase. After that, you can cancel auto-renewal anytime and retain access through the end of your paid term, but partial refunds are not issued for the unused portion.

Implementation and setup fees on Tier 2 Guided are non-refundable once kickoff occurs, since the engineering work begins immediately. Tier 3 Enterprise terms are negotiated per contract.