The words that show up when your website gets reviewed

Software that asks a website visitor which categories of tracking they will allow, acts on that answer, and records it. On a medical site the acting half matters more than the asking half: a platform that displays a notice without holding the scripts has documented the exposure rather than prevented it.

Preventing a script from executing until permission exists. The tag is held before it runs, so nothing leaves the browser. This is different from instructing a script that has already loaded, and the difference decides whether data reached a third party.

A signalling layer that tells Google products how a visitor answered, using four parameters: ad_storage, ad_user_data, ad_personalization and analytics_storage. It governs how tags behave once loaded. It is not a blocker, and a site running it without gating is still sending data.

Basic withholds tags entirely until consent, so Google receives nothing from a visitor who declines. Advanced loads tags in a restricted state that still sends cookieless pings. Which one a site runs is decided by how the tags were installed, not by a setting anyone chose.

Treating the absence of an answer as refusal. A visitor who has not chosen is a visitor who has not agreed, so nothing non-essential runs. The opposite pattern, assuming permission until refused, is what most pre-consent leaks are built on.

A log where a new decision adds a row and never edits one. Changing an answer writes a second record rather than overwriting the first, so the history of what a visitor was shown and chose on a given date survives. On consential.io UPDATE and DELETE are revoked at the database permission level.

A browser-level signal that communicates a blanket opt-out. Several state laws require controllers to honour it as a valid request, which means a site can be obliged to act before the visitor touches the banner at all.

Individually identifiable health information held by a covered entity or business associate. On a website the same field can be PHI or not depending on context: an IP address alone is an identifier, but an IP address recorded against a page about a specific procedure can carry health inference.

A health plan, a healthcare clearinghouse, or a provider that transmits health information electronically in connection with a HIPAA standard transaction. Most practices are, but it is a determination rather than an assumption, and many have never made it in writing.

A vendor that creates, receives, maintains or transmits PHI on a covered entity's behalf. The status follows the data, not the contract: a vendor becomes a business associate by handling PHI, and the agreement documents a relationship that already exists.

The contract HIPAA requires between a covered entity and a business associate. A vendor that will not sign one cannot lawfully receive PHI, which is the practical reason most general-purpose analytics tools cannot be pointed at patient-facing pages.

Guidance issued by the HHS Office for Civil Rights in December 2022 and revised in March 2024, addressing tracking on covered entities' websites. A federal court vacated part of it in June 2024. What survived matters more than what did not: the Privacy Rule itself was untouched.

Pages behind a patient login versus pages open to anyone. The vacated portion of the OCR guidance concerned unauthenticated pages. Patient portals and any context where a specific individual's care can be inferred remain squarely inside the rule.

An entity-level exemption removes a HIPAA covered entity from a state statute entirely. A data-level exemption removes only the protected health information, leaving the practice's website and marketing data in scope. Thirteen of the twenty comprehensive-law states exempt at entity level; seven do not.

Under most state privacy laws, sharing personal data for monetary or other valuable consideration. The second half is what reaches a medical website: an advertising platform receiving visitor data in exchange for ad services can satisfy it without money changing hands.

A category most state laws treat more strictly, generally including data revealing a health diagnosis. It typically requires opt-in consent rather than a chance to opt out, which inverts the default a site can rely on.

A requirement that controllers recognise a browser or device signal as a valid opt-out request, rather than only a click on the site's own banner. Where it applies, honouring it is not optional and not something the visitor has to repeat per site.

A window after written notice during which a business may fix an alleged violation before enforcement proceeds. Some states sunset it, some do not. A permanent cure period plus an active enforcer is a workable combination for an operator paying attention, and a bad one for an operator who is not.

A separate family from comprehensive state privacy laws, aimed specifically at health data held outside HIPAA. Washington's My Health My Data Act is the widest: it has no size threshold, reaches practices outside the state, and carries a private right of action.

A litigation theory pleaded independently of any privacy statute, alleging that session recording or pixel transmission intercepted a communication. It follows the visitor rather than the practice, so a practice in a state with no privacy law still inherits the strictest framework present in its own traffic.

Any request that leaves a visitor's browser for a third party before the visitor has answered anything. It is measured in milliseconds and is usually complete before a cookie notice finishes rendering, which is why a banner that only announces tracking does not prevent it.

A container that loads other scripts, so one approved snippet can introduce many unreviewed ones later. It is the most common reason the list of trackers a practice approved and the list actually running are two different lists.

Call tracking that swaps the phone number shown to a visitor so the source of the call can be attributed. It raises three separate questions, and only some create exposure: the swapped number, the session identifier tying a caller to a browsing session, and the call recording.

Content embedded from another origin, such as a scheduling or intake form. It sits outside the host page's consent gate, and neither the page nor the widget can reach inside it, so a form can carry its own tracking that the site's banner never governs.

The gradual divergence between the trackers a site declares and the trackers it actually loads, as plugins update and pages ship. It is why a consent configuration is only accurate on the day it was written, and why the check has to repeat.

The conformance level most commonly referenced in website accessibility obligations. It is a set of testable success criteria, not a certificate. Automated tooling can detect roughly a third of the criteria; the rest need human judgement.

A JavaScript widget that modifies a page at runtime rather than repairing its markup. Disability advocacy organisations campaign against them, plaintiff firms track the sites running them, and the FTC has taken action over conformance claims made for one.

The label a screen reader announces for a control. When it is missing, the control is announced by its type alone: button, link, edit blank. A booking button with no accessible name is reachable and unusable at the same time.

The measured luminance relationship between text and its background. WCAG AA requires 4.5:1 for normal text. Colours derived from an alpha value or an opacity setting fail this often, because the failing value never appears in the source as a colour anyone can search for.

Repairing the underlying markup so a defect stops existing. Distinct from monitoring, which finds and dates defects without fixing them. Roughly half of what a scan finds is mechanically repairable; contrast and structure need a design decision.