Digital compliance
Licences, user consent, GDPR and AI-generated content across a portfolio of websites and channels. For companies that have more sites than people who understand them, and want to be sure that what they publish, they are allowed to publish.
The first conversation is free: 30 minutes online, no preparation and no commitment.
Who this is for
Marketing with a portfolio of sites and campaigns
A dozen websites, landing pages left over from campaigns, social media profiles. Each site has a different cookie banner, a different policy and photos nobody remembers the source of.
Companies that have started using AI for content
Texts, graphics and translations from AI tools go onto sites and into materials. Nobody has decided what is allowed, what has to be labelled, which data may be pasted into a tool and who is responsible.
Organisations after an inspection, a complaint or a change of agency
You received a letter about the rights to a photo, a question about consent, or a new agency asking on what basis the site collects data. You need one place where all of this is written down.
What we usually find
The same gaps come up in most portfolios we review:
- Photos and fonts without a licence, or with one nobody can produce.
- A cookie banner that fires analytics before anyone clicks, or has no option to refuse.
- A privacy policy copied from another company, with that company's name in one paragraph.
- Forms with no information on who processes the data and why, and no defined retention period.
- AI-generated content published without review and without rules on which data may go into the tools.
- Access to advertising and analytics accounts held by people and agencies that stopped working with you long ago.
Most of these are fixed by one review and one pattern for the whole portfolio. Access and analytics connect to what we do in digital products & platforms.
What we work on
Licences and rights to content
A register of photos, fonts, icons, music and code with licences and sources. Rules on where material may be taken from, and what to do with material whose origin cannot be established.
Consent, cookies and GDPR
One pattern for the banner and the policy on every site, consent collected before analytics runs, a record of processing activities, notices in forms, a procedure for handling requests from individuals.
AI-generated content
Rules for the team: which tools, which data may be entered, what needs a human check, what to label and how. Where AI enters a process, we connect it to automation so the rules are built in rather than written in a PDF.
What we have done before
The founders’ experience with portfolios of large brands' websites, run before the company was set up, directly and in cooperation with agencies. More under achievements.
- More than 120 analytics properties and tag containers brought into one consistent pattern of names, structure and permissions.
- Consent and cookies managed from one pattern for whole portfolios of sites, with analytics running only after consent.
- Access for the client, agencies and media houses in one model of roles, granted and reviewed in one place.
- Portfolio standards: licences, user consent and AI-generated content as part of the editorial routine, not a separate project.
- More than 6 years without a security incident on the sites we ran.
Example: a portfolio with no owner of the rules
A typical starting point and what we build from it. The client's name and details are something we discuss in a meeting.
Before
Dozens of sites from different agencies. Each with its own cookie banner, a different policy and photos from unknown sources. Analytics started before consent. A question about the rights to one photo took a week and ended with the photo removed from every site, just in case.
After
One pattern for the banner, the policy and the notices, deployed from one configuration. A register of materials with licences. Rules for working with AI for the editorial team. Access to analytics and advertising in one model of roles, reviewed every quarter.
Result
A change to consent or the policy made once for the whole portfolio. A question about the rights to a material answered in minutes from the register. A new site compliant from day one, because it inherits the pattern.
Three steps, each one you can stop after
Free consultation
30 minutes online. You tell us how many sites and channels you run, who creates them and what worries you. We tell you what is a risk today, what a pattern can fix and where we would start.
Portfolio compliance review
Fixed scope and a fixed price agreed before we start. A review of sites, banners, policies, forms, materials and access. A report with gaps ordered by risk, patterns to deploy and a review session with your team.
Implementation
Patterns deployed on the sites in stages, a register of materials, rules for working with AI and procedures for the team. Each stage has acceptance criteria and a price agreed before it starts. A quarterly review afterwards, if you want one.
What the review covers
- Sites and channels: a list with owner, agency, CMS, hosting and what each one collects from users.
- Consent and cookies: what runs before consent, whether refusal is possible, whether consent is recorded and can be withdrawn.
- Documents: policies, terms, notices in forms, the record of processing activities, data processing agreements with suppliers.
- Materials: a sample of photos, fonts and content with the question of source and licence; rules for AI-generated content.
- Access: who has permissions to the CMS, analytics, advertising and domains, and whether they still should.
This is what a fragment of the report looks like. The figures are illustrative, the layout is real:
| Area | Current state | Recommendation | Risk |
|---|---|---|---|
| Cookie banner | Analytics starts before consent on 9 of 14 sites | One banner pattern, tags conditional on consent | High |
| Privacy policy | 5 versions, one with another company's name | One policy with per-site sections, deployed from one configuration | High |
| Photos on sites | 40% with no established source | Register of materials, replacement or licence for the unknown ones | Medium |
| AI content | Used without rules | Guidelines: tools, data, review, labelling | Medium |
| Analytics access | 31 accounts, 12 inactive, 3 agencies after contract end | Revocation, roles, quarterly review | Medium |
The review is also the basis for a conversation with a law firm: they get written facts rather than a set of guesses.
What stays on your side
Registers, patterns and procedures are yours, in your tools. They do not depend on our access.
- A register of sites, materials and access, with instructions on how to update it with every new site and campaign.
- A banner, policy and notice pattern that new sites use from day one.
- Rules for working with AI and a pre-publication checklist, written for the team and the agencies.
- A procedure for handling requests from individuals and incidents, ready to show an inspector.
Compliance comes from the process
Documents without a process go stale within a month. That is why we build the rules into the places where content and sites are made: the CMS, the consent configuration, the editorial checklist. We are not a law firm and do not replace a lawyer; we prepare the facts, the patterns and the technical implementation, and where a legal opinion is needed we work with your law firm or recommend one we trust.
FAQ
Is this a legal service?
No. We tidy the facts and implement patterns and processes on the sites and in the team. Legal opinions come from a law firm, which we work with when needed.
We have an agency that builds our sites. Why do we need this?
An agency is responsible for its site, not for the portfolio. Consent, access and licences between several agencies have no owner, and that is usually where the gaps are.
Do we have to remove AI-generated content?
No. You have to know which content is AI-generated, which data went into it and whether someone checked it. Rules and labelling where the law or a platform requires it cover most of the risk.
How many sites does the review cover?
As many as you have. For large portfolios we make a full list and a representative sample for the deep review, and deploy the patterns on all of them.
How do you charge?
First consultation: free, 30 minutes online. Review: fixed price. Implementation: stages with acceptance criteria and a price for each stage. Quarterly review: a fixed scope.
What about confidentiality?
We sign a non-disclosure agreement and a data processing agreement before receiving access. Access is personal and revoked when the work ends. How we handle data from the contact form is described in the privacy policy.
Let’s check your portfolio
Tell us how many sites and channels you run, who creates them and what last raised a doubt: a photo, a banner, an access or an AI-generated text. We will propose a time.
The first conversation is free: 30 minutes online, no preparation and no commitment.