Resources · Just the Facts
Just the Facts
Straight, sourced answers on website compliance risk — what's real, what's overblown, and what to do about it.
Filter by what you're worried about, or start at the top.
The privacy signal your site is ignoring
A browser setting can tell your website not to sell its visitor's data — silently, in a header nobody ever sees. Ignoring it has already cost companies over a million dollars each, and it fails on nearly every site we scan.
ReadThree real demand letters, eighteen years apart
Every other page here is argument. This one is evidence: three actual demand letters received by real businesses, two of them downloadable in full. Different decades, different laws — and in all three the owner had no idea the exposure existed.
ReadWebsite accessibility is the most-sued thing on the internet
More businesses are sued over their website's accessibility than over every other issue on this page combined. The numbers, who gets hit, and why the same company can be sued in New York and California for two completely different reasons.
ReadWho's Really Suing — CIPA Website-Wiretap Filers
The plaintiff firms and serial filers behind the demand letters, and how courts are actually ruling.
ReadYour cookie banner probably isn't doing anything
Almost every site we scan has a banner. On roughly three in four, the trackers have already fired by the time it appears — which means the banner is decoration, not protection. Here is the one difference that matters.
ReadAnyone can send email as you
The finding furthest from "website" in most people's minds, and the one with the most immediate real-world cost: invoices from your domain that you didn't send, and your own mail landing in spam. Three DNS records, one afternoon, permanent.
ReadCode you didn't write, running on your site tonight
Every third-party script tag is a standing invitation for whoever owns that domain to run code on your visitors — forever, without telling you. Including the fix that most people recommend for it, and why it wouldn't have worked.
ReadCookies without locks
Three settings, one line of configuration each. Most sites set none of them. The shortest article on this page, on purpose.
ReadCopied Content: Plagiarism, Copyright & the Hidden SEO Risk
Why copied text can get you demoted or de-indexed by Google, even with credit.
ReadPasswords, Backups & VPNs: the security that decides whether a breach sinks you
The four operational habits — a password manager, MFA on the accounts that matter, tested offsite backups, and a VPN when it counts — that decide whether a breach is a bad afternoon or a business-ending event.
ReadThe instructions your website isn't giving the browser
The most common finding we produce, and the most jargon-locked. Every page your site sends comes with a short note telling the browser what it's allowed to do. Most sites send a blank note.
ReadThree documents nearly every site gets wrong
Not because they're missing — because they describe a website that no longer exists. A test you can apply to the ones you already have.
ReadVerifying Licensed Images, Fonts & Video
How to make sure your images are licensed and avoid automated copyright demands.
ReadWhat an accessibility statement is actually for
It fails on every site we've ever scanned, it's the lowest-weighted item on the report, and it's the cheapest useful thing you can do all week. It is also not a legal shield, and anyone telling you otherwise is selling something.
ReadHow Real Is the Threat? A By-the-Numbers Risk Assessment
The data: which risks are real lawsuits vs. contested theories vs. Google-visibility issues, with volumes, outcomes and cost-to-resolve.
ReadIs Any of This Actually Real?
The honest, plain-English answer for skeptical owners: what's overblown vs. genuinely real, and why the fix beats the fight.
ReadThe Demand-Letter Economy
How serial litigation turns small compliance gaps into settlements, across ADA, copyright, TCPA and more.
ReadWhen the Court Reins One In: the Vivek Shah Vexatious-Litigant Ruling
A prolific CIPA website-privacy filer was just declared a vexatious litigant. Here's what that does — and, just as important, what it doesn't — for the demand-letter wave.
ReadFun fact: Joe Friday never actually said "Just the facts, ma'am" — that line came from a 1953 parody. Even catchphrases need fact-checking.