The Etalon platform
Privacy laws are active in 20 U.S. states. For covered businesses, honoring opt-outs is a compliance requirement. Etalon Spectra finds marketing tags that keep firing after a visitor opts out. Etalon Opt-Out Mode enforces the choice in Google Tag Manager, and Etalon engineers rebuild measurement so compliant analytics remains useful.
An initial audit takes about 60 seconds.
Questions about your stack? Talk to an engineerIllustrative behavior only. No live site is being scanned.
01 / The enforcement gap
A consent management platform (CMP) records the visitor’s choice. Your analytics and advertising infrastructure must respond to it. Etalon tests that response.
Your CMP, privacy interface, or applicable browser signal records the choice.
Etalon Opt-Out Mode applies the appropriate tracking behavior inside Google Tag Manager.
Etalon audits and verifies this behaviorOnly permitted activity should reach analytics and advertising platforms.
Etalon is a technical privacy enforcement and verification platform for marketing and analytics tracking. It evaluates what actually happens against supported U.S. state privacy rules for organizations subject to those requirements.
02 / The product workflow
An audit shows where you stand. Implementation changes the behavior. QA tests the fix before a certificate is issued.
03 / Etalon Spectra
The initial audit observes tracking before and after a tested opt-out. The report connects the request to its vendor, the evaluated rule, and the next action.
11 Sep 2026 · 17:03 UTC Oregon · OCPA
10 tags identified
5 FAIL2 WARN3 PASSRisk level High
| Vendor / category | Observed destination | Requests | Verdict |
|---|---|---|---|
| Meta PixelAdvertising | connect.facebook.net/…/fbevents.js | 2 | FAIL |
| Google AdsRemarketing | ad.doubleclick.net/ccm/… | 1 | FAIL |
| Google Analytics 4Analytics | analytics.google.com/g/collect | 2 | WARN |
| Google Tag ManagerContainer | googletagmanager.com/gtm.js | 6 | PASS |
The example flags a Meta Pixel request in the post-rejection capture window with a GPC signal active.
| Cookie | Domain | Attributed vendor | Expiry |
|---|---|---|---|
_ga | .example.com | Google Analytics 4 | 16 Oct 2027 |
_gcl_au | .example.com | Google Ads | 10 Dec 2026 |
IDE | .doubleclick.net | Google Ads Remarketing | 16 Oct 2027 |
cookieyes-consent | .example.com | — | 11 Sep 2027 |
A cookie inventory is evidence to review alongside observed requests, configuration, and the the state laws checked. A cookie’s presence alone is not a complete legal determination.
Request counts describe observed traffic. They are not counts of legal violations.
Scan configuration, tag inventory, cookie audit, per-tag findings, rule references, and a remediation roadmap make the result reviewable by your team.
Some findings depend on vendor agreements and data-use configuration. WARN keeps those questions visible instead of treating every request as an automatic failure.
Each report identifies the URL, time, signals, and laws evaluated. A single scan’s scope should not be confused with all available platform coverage.
04 / From finding to fix
Etalon Opt-Out Mode is Etalon’s preconfigured Google Tag Manager enforcement framework for supported U.S. state privacy opt-out behavior.
Paid platform users can download the appropriate GTM configuration or template and implementation documentation for supported CMP environments.
Connect the privacy signal, configure your tags, and test the result. Your team gets an implementation starting point for state-specific enforcement.
Your team can deploy it. Ours can help.Evaluate supported state rules
Apply the appropriate tag behavior
Conceptual outcomes depend on the rule, vendor, and configuration.
Architecture → implementation → verification
Hard-coded scripts
Most sites are a mix: some scripts and cookies hard-coded into the site, some tags in Google Tag Manager. Spectra flags every one that fires after a visitor says no, wherever it comes from. The fix is to strip the hard-coded scripts off the site and redeploy everything through Google Tag Manager. Your whole tracking stack then lives in one standard setup, easier to change and fully controlled by Opt-Out Mode.
05 / Your existing stack
Keep your CMP and your Google Tag Manager environment. Apply enforcement where the tracking decision is made, then verify the what actually happens.
Server-side GTM supported — not required.
Core implementation
CMP / privacy interface
Applicable GPC signal
Enforcement before a tag sends data
GA4 · Google Ads
Meta · LinkedIn · other endpoints
Additional enforcement and routing
The direct client-side route is a complete implementation path. Add sGTM only when your architecture calls for it; testing scope depends on the configured environment.
Supported integrations
Your CMP captures the choice. Etalon Opt-Out Mode applies it in GTM. Etalon checks what happens next.
06 / Validate the fix
A QA scan is the validation step after remediation. It tests applicable tracking behavior again and determines whether the implementation passes the evaluated checks.
Certification follows a passing QA result. If QA finds unresolved issues, return to remediation and validate again.
Separate illustrative QA scan. This is not a before-and-after result for the audit example.
07 / Verifiable technical certification
A successful QA scan can issue an Etalon Compliance Certificate valid for 90 days. It documents the domain, the state laws checked, validation time, and expiration.
A unique certificate ID, verification URL, and QR code connect the issued document to Etalon’s verification system.
The certificate attests to the technical state observed by Etalon at validation. It is not a legal opinion or a guarantee of the organization’s overall legal compliance.
Etalon
Example Companyexample.com
This demo QR opens the example below. It is not a live certificate.
Technical validation at the time of scan.
Etalon is not a law firm and does not provide legal advice.
ETL-2026-8F3A91C2 · example.com
Illustrative status: Etalon Certified. Scope: Oregon OCPA tracking-layer checks. Issued 11 September 2026, 17:01 UTC; expires 10 December 2026, 17:01 UTC.
This is a demonstration record, not an issued Etalon Compliance Certificate or a lookup against the production verification system.
08 / Continuous verification
New tags, vendor updates, CMP changes, redesigns, and new state rules can change tracking behavior. Scheduled re-scans help surface drift between certifications.
A dated record of the validated state.
Review changed tags, vendors, signals, and rules.
Remediate and re-run QA.
Issue or renew technical certification.
An audit re-scan does not automatically renew a certificate. Fresh QA validation is required for re-certification. Scan scheduling depends on your plan.
09 / U.S. state coverage
The engine covers supported state privacy rules for tracking across 20 active states. Etalon monitors legislation, rule changes, and enforcement dates, updates the engine, and adds coverage as new laws take effect.
See every state and corresponding lawUpcoming: Oklahoma, Louisiana, Alabama, and Vermont.
Coverage as of 9 September 2026. Statutory thresholds, scope, and exemptions vary. Florida’s law has a narrower scope; California’s CCPA and CPRA are grouped as one state.
EU, UK and Google Consent Mode
In the EU and UK, tracking needs consent before it starts. Spectra loads your site as an EU or UK visitor and flags every non-essential cookie and script that fires before a choice is made, or after the visitor clicks Reject. Covers GDPR and the ePrivacy rules, plus UK GDPR and PECR.
Google requires Consent Mode v2 for ad measurement and remarketing on EU and UK traffic. Spectra checks that your Google tags receive the right consent signals (ad_storage, analytics_storage, ad_user_data and ad_personalization) before and after every choice, and flags a setup that sends the wrong ones.
11 / Implementation support
Use the platform and Etalon Opt-Out Mode with your own GTM expertise. When you need help, Etalon engineers can configure enforcement, remediate the stack, validate the result, and document the handoff.
Scope depends on containers, domains, tags and vendors, CMP configuration, server-side architecture, and existing technical debt.
12 / Scope and responsibility
Technical verification is one part of privacy compliance. Legal applicability and organizational obligations require a separate legal and governance assessment.
Etalon is not a law firm and does not provide legal advice. A passing scan or certificate does not guarantee that an organization satisfies every legal obligation.
13 / Spectra FAQ
Answers for marketing, engineering, privacy, and legal teams.
Ask about your stackYes. Choose the EU or the UK as the scan location. Spectra checks for tracking before consent and after rejection under GDPR, the ePrivacy rules and UK law, and validates the Google Consent Mode v2 signals your Google tags receive.
Etalon is a technical privacy enforcement and verification platform for marketing and analytics tracking. It audits observed website behavior against supported U.S. state rules, reports enforcement gaps, validates remediation, and can issue time-bound technical certification after a passing QA scan.
It observes tags, cookies, network requests, and vendor behavior around tested privacy opt-outs. The report records the CMP interaction, applicable privacy signals, and the state laws checked so your team can see what occurred during the capture window. A result applies to the recorded scan scope and conditions.
An initial audit discovers gaps and provides findings to guide implementation. QA is a separate scan after remediation: it rechecks the corrected behavior and determines whether the evaluated checks pass. A passing QA scan enables certification; an initial audit does not issue a certificate.
The audit observes and interacts with your website’s privacy interface in a scan session. It does not deploy Etalon Opt-Out Mode or change your published GTM configuration. Your team or Etalon engineers perform implementation as a separate step.
The report includes the target URL, scan time and configuration, laws evaluated, tag inventory, vendor platforms like Google Ads and Meta, request counts, PASS/WARN/FAIL findings, cookie inventory, rule references, and a remediation roadmap. Warnings can identify behavior that needs manual review of configuration or vendor agreements. Report access depends on the platform plan.
Etalon Opt-Out Mode is Etalon’s preconfigured Google Tag Manager enforcement framework for supported U.S. state privacy opt-out behavior. Paid platform users can download the appropriate configuration or template and implementation documentation. It must be configured for the tracking environment and validated after deployment.
The Etalon enforcement layer is Etalon’s reference architecture for where privacy enforcement belongs in the tracking stack. Etalon Opt-Out Mode implements that methodology through GTM logic and templates. Etalon is the platform that audits and verifies the resulting behavior.
Yes. Etalon works with standard client-side Google Tag Manager environments. Etalon Opt-Out Mode can enforce tracking behavior there. Server-side GTM is supported but is not required, and you do not need to migrate to server-side tagging simply to use the platform.
Yes. Etalon can support and validate server-side Google Tag Manager environments when configured. The server-side extension adds enforcement and routing for downstream platforms where your architecture needs it. The implementation and validation scope should reflect the actual client-side and server-side setup.
No. Your CMP or privacy interface captures the visitor’s preference. Etalon Opt-Out Mode connects that preference to GTM enforcement. Etalon then observes and verifies the tracking behavior. These components have different responsibilities and work together.
The supported integration list includes OneTrust, Cookiebot, Usercentrics, Osano, Termly, and CookieYes. The appropriate Etalon Opt-Out Mode configuration connects the supported CMP environment to your GTM implementation.
Etalon Opt-Out Mode can work without a CMP when the implementation receives the appropriate privacy preferences or applicable signals through another supported route. Your team still needs to configure and validate that route. Whether a particular privacy interface satisfies your organization’s legal obligations is a question for your legal team.
No. Consent Mode communicates consent states to Google tags and products. Etalon Opt-Out Mode applies Etalon’s additional state-specific enforcement logic across the supported tracking environment. They can coexist; neither a consent-state setting nor a banner alone proves that the entire stack behaves as intended.
Global Privacy Control (GPC) is a browser signal for communicating a privacy preference. Etalon’s report can record its HTTP and JavaScript presence during a scan and evaluate the observed tracking response against supported applicable rules. Requirements vary by state; the platform’s current coverage should guide implementation, rather than an old fixed list of GPC states.
Review the remaining findings, correct the implementation, and run QA again. Certification follows a passing QA result. A failed validation is an action item for remediation, not a certificate of compliance.
It records the technical state observed by Etalon for a domain and the the state laws checked at the time of successful QA validation. It does not certify every aspect of an organization’s legal compliance, replace legal counsel, or guarantee future tracking behavior.
Certificates are valid for 90 days from issuance. Fresh QA validation is required for re-certification. The issue and expiration dates remain part of the record so a certificate is not treated as permanent evidence.
Use the issued certificate’s verification URL or QR code to open Etalon’s verification record, then match the unique certificate ID, domain, scope, status, and expiry. The certificate shown on this page is an illustration; its link and QR code open a demonstration record, not the production verification system.
A certificate describes the validated state at a particular time. Re-scan after material changes to tags, vendors, CMP configuration, or the site. If the audit finds a gap, remediate and re-run QA. Scheduled audit scans help monitor changes but do not automatically renew certification.
The current coverage register lists 20 active states and their corresponding laws, with four upcoming states listed separately. A scan report identifies which rules were actually evaluated in that run. Statutory thresholds, exemptions, and scope vary, so available state coverage does not mean every law applies to every organization.
Etalon monitors legislation, rule changes, and enforcement dates, updates the engine, and adds state coverage as new laws become active. Upcoming coverage is distinguished from active coverage in the state register.
The scanner runs in a Etalon-controlled browser session rather than monitoring your visitors’ sessions. Its report records technical tracking information such as vendors, tag behavior, cookies, and network platforms like Google Ads and Meta. That scan-session evidence is different from collecting your visitors’ browsing histories or customer records.
The initial website audit observes the site from a browser and does not require a GTM deployment. Installing Etalon Opt-Out Mode is a separate implementation step that requires appropriate access to the GTM environment, whether performed by your team or Etalon engineers.
No. Etalon LLC is not a law firm and does not provide legal advice. The platform handles technical enforcement and verification. Legal interpretation, statutory applicability, policies, disclosures, contracts, rights-request procedures, and overall organizational legal compliance remain with your legal and privacy team.
Yes. Teams with GTM and privacy engineering expertise can configure the downloaded Etalon Opt-Out Mode template, connect their supported CMP or privacy-signal route, remediate the relevant tags, and use QA to validate the result. The template and documentation support implementation; they do not remove the need to configure and test your environment.
Etalon engineers can scope and perform implementation and remediation, including GTM configuration, CMP integration, Etalon Opt-Out Mode deployment, optional server-side work, QA, and technical handoff. Scope depends on your domains, containers, vendors, CMP setup, and existing architecture.
Start with the evidence
