Website privacy notices, analytics, and third-party trackers

Reference article · 6 min read

A privacy notice is a factual statement about what a website does. It usually goes wrong not because the drafting was careless, but because the site changed and the notice did not. A communications office adds a conversion pixel for a vaccination campaign, a program team embeds a video playlist, a vendor switches on session replay to debug a form, and the page now sends visitor data to companies the published notice never mentions.

For a public agency the stakes are different than for a private company. Visitors often have no alternative. Someone applying for benefits, checking a court date, looking up a treatment program, or searching a library catalog cannot take their business elsewhere, and the pages they visit reveal a great deal. The practical order of work is: find out what your pages actually send, fix what should not be there, then write a notice that matches, then build a routine that keeps the two aligned.

Inventory what your pages actually send

Load your own site in a clean browser profile with developer tools open and watch the network requests. Do this for representative page types, not only the homepage: search results, an application or intake form, a payment flow, a document download, the chatbot, and each mobile app screen that transmits data. Record every third-party domain contacted and what triggers it.

• Tag managers. A container can often be edited by staff without a code deployment, which means tags can appear without IT review. Ask who holds publish rights and print the current container contents.
• Analytics. Configuration matters as much as presence: IP handling, retention period, whether data flows into the vendor's advertising products, and whether cross-site signals are enabled.
• Advertising and conversion pixels. These are commonly added for a campaign and never removed. They carry the most risk on health, benefits, legal aid, and library pages.
• Embedded video and maps. Default embeds may set cookies or identifiers before a visitor presses play. Privacy-enhanced embed options exist for several platforms.
• Chatbots and site search. Transcripts and queries can contain names, case numbers, and medical detail. Ask where they are stored, for how long, who can read them, and whether they are used to train models.
• Session replay and heatmaps. These capture screen content and sometimes keystrokes. Form fields need explicit masking, and the default is not always masked.
• Fonts, script CDNs, translation widgets, and accessibility overlays. Each is a request to an outside host that carries the visitor's IP address and the page they were reading.

A content security policy running in report-only mode gives you a standing list of external hosts your pages contact, including ones added after the audit.

Write the notice to match the site

Keep it specific and readable. A notice that hedges everything tells the visitor nothing and gives your own staff no standard to work against.

• Separate what is collected automatically from what a visitor chooses to submit.
• Name the third parties, or at minimum describe them by category and function, and say what each receives.
• State the purposes. Say what you do not do, such as sell data or use it for targeted advertising, only where that is actually true across every property covered by the notice.
• Address retention, and note plainly that submissions and correspondence may be subject to public records law.
• Cover mobile apps separately where behavior differs: device permissions, background location, push identifiers, and the data disclosures you file with app stores.
• Give a contact point, an effective date, and a short change log.

Resist copying a commercial template. Those promise consumer rights you may not be able to grant and skip the public records realities that define government practice.

Know which rules actually bind you

Most state comprehensive consumer privacy statutes are written for businesses and exclude government bodies, either explicitly or by how they define a covered entity. That exclusion is easy to over-read. The binding requirements for agencies usually sit elsewhere: state data practices or public records acts, statewide IT and security policy, agency-enabling statutes, and program-specific federal law such as health privacy rules, education records rules, driver record restrictions, and substance use treatment confidentiality. Several states also impose privacy notice requirements on state agency websites through statute or statewide administrative policy. These provisions change, and their reach to counties, cities, and special districts varies, so confirm the current text with your counsel rather than relying on a summary.

Note one more exposure. Litigation theories based on state wiretap and interception statutes have been aimed at website tracking and session recording. Even where an agency has defenses that a business would not, your vendors may not share them, and the indemnity terms in your contract are what decide who pays.

Put limits in the contract, not just the notice

• Purpose limitation. The vendor processes data only to deliver the contracted service to the agency.
• No secondary use. No sale, no licensing, no advertising or audience building, no product development beyond the agency's instance, and no training of models on agency data without separate written approval.
• Configuration commitments. Write the settings into the agreement: IP truncation, retention period, form field masking, advertising features off, data region.
• Subprocessors. Disclosed in advance, with the same obligations flowed down, and notice before changes.
• Records and litigation. The vendor cooperates with public records requests, preservation holds, and audits, and returns or destroys data at termination with written confirmation.
• Security and breach notice. Timelines that let the agency meet its own state notification deadlines, not the vendor's convenience.
• No unilateral changes. Privacy terms live in the contract, not in a policy the vendor hosts at a URL and edits at will.

Questions to ask before a tag or tool goes live

1. What data leaves the visitor's browser, to which company, and in which country is it stored?
2. Can the tool function with identifiers truncated, anonymized, or disabled, and what is lost if we do that?
3. Does the vendor use our visitors' data for any purpose of its own, including model training or benchmarking?
4. Who inside the agency can add or change this without a code review?
5. What is the removal path if the program ends, and who verifies removal?

Keep the notice true over time

Assign an owner. Put a quarterly scan on someone's calendar, tie tag manager publish rights to a short approval step, and treat any new embedded tool as a change that requires a notice review. Sensitive page types deserve a standing rule: no advertising or replay tooling on benefits, health, legal, elections, or library pages. When the notice changes, date it and keep the prior version available, because residents and oversight bodies will sometimes need to know what the rules were on a given day.

HQT works with state and local agencies on web and application development, cloud and data platform work, and technology advisory services, including privacy and security reviews of public-facing systems.

Frequently asked questions