Privacy law compliance starts the moment you collect a customer’s email address or track their browsing behavior. A recent class action lawsuit against Five Below alleges the retailer secretly shared users’ shopping data with third parties without consent, a violation that many small and mid-sized businesses unknowingly commit every day. If you run an e-commerce site, accept online payments, or use marketing analytics, you’re sharing customer data. The question is whether you’re doing it legally.
What does privacy law compliance actually require from small businesses?
Privacy law compliance means following a patchwork of state and federal rules that govern how you collect, use, and share customer information. At minimum, you need explicit customer consent before sending personal data to third parties, a privacy policy that accurately describes your practices, and systems to honor opt-out requests.
The Five Below lawsuit centers on a common problem: the company allegedly used tracking technologies that transmitted customer shopping behavior to third parties for advertising purposes without obtaining proper consent. The plaintiffs claim this violates California’s Invasion of Privacy Act and similar statutes in other states.
For SMBs, this matters because the same tracking pixels, analytics scripts, and retargeting tools that power your marketing also create compliance exposure. When you install a Facebook pixel, a Google Analytics tag, or a Shopify app that promises to increase conversions, you’re often sharing customer data. Most business owners have no idea how much information flows out.
State privacy laws like the California Consumer Privacy Act (CCPA), Virginia’s Consumer Data Protection Act, and similar regulations in Colorado, Connecticut, and Utah require you to disclose these data flows in plain language. You must name the categories of third parties, describe the business purpose for sharing, and in many cases, provide an opt-out mechanism before the sharing occurs.
How do businesses accidentally violate privacy law compliance requirements?
The path to a privacy lawsuit usually starts with good intentions. You want to understand your customers better, so you add a heatmap tool. You want to recover abandoned carts, so you install a retargeting pixel. You want to measure ad performance, so you integrate with a marketing platform. Each decision is rational. Together, they create a compliance gap.
Here are the five most common ways SMBs break privacy law compliance rules without realizing it:
Hidden third-party data sharing. Your website likely contains JavaScript from a dozen vendors: payment processors, chat widgets, email capture tools, analytics platforms. Each one can collect visitor data and send it to their own servers. Your privacy policy may say “we don’t sell your information,” but legally, sharing data with a marketing partner often counts as a sale under state law. If your policy doesn’t name these partners or explain what data they receive, you’re out of compliance.
Consent obtained after the fact. Many businesses show a privacy policy link in the footer and assume that’s enough. It’s not. Privacy law compliance requires affirmative consent before you share sensitive data, not a passive link visitors might never click. For professional services firms handling client matters or healthcare practices covered by HIPAA, the bar is even higher.
Outdated privacy policies. You wrote a privacy policy when you launched your website three years ago. Since then, you’ve added a CRM, switched payment processors, started using a new email platform, and integrated with social media advertising. Your policy still lists the old vendors. This disconnect becomes evidence in a lawsuit: you promised one thing and did another.
No mechanism to honor opt-out requests. State laws give consumers the right to opt out of data sales or sharing. If your website doesn’t offer a “Do Not Sell My Personal Information” link (or an equivalent mechanism under other state laws), you’re violating the law in California, Virginia, Colorado, Connecticut, and Utah. Even if you operate in Texas or Florida, customers from regulated states can visit your site and trigger compliance obligations.
Third-party vendors you don’t control. When you hire a marketing agency or use a SaaS platform, they often add their own tracking tools to your website. You remain legally responsible for those tools, even if you didn’t install them yourself. A compliance audit reveals the full list of domains your site contacts. Most business owners are shocked by how long it is.
What are the actual costs and risks of privacy law non-compliance?
Class action lawsuits are the most visible risk. Plaintiffs’ attorneys actively search for websites that share data without proper consent, file suit on behalf of a class of users, and seek statutory damages that can reach thousands of dollars per violation. When you have 10,000 website visitors, the math gets ugly fast.
Beyond lawsuits, state attorneys general can investigate and fine businesses for privacy violations. California’s attorney general can assess civil penalties of $2,500 per violation or $7,500 for intentional violations. A pattern of non-compliance across hundreds or thousands of customer interactions creates exposure in the hundreds of thousands to millions of dollars.
The business costs are often worse than the legal ones. When news of a privacy lawsuit or investigation goes public, customer trust evaporates. For small businesses that depend on repeat customers and referrals, a reputation as a company that mishandles data can be fatal. Professional services firms lose clients. Retailers see conversion rates drop. The intangible cost of lost trust dwarfs the settlement check.
Insurance often won’t cover privacy violations. Your general liability policy excludes cyber and privacy claims. Your cyber policy may cover a data breach but not a compliance failure. You’re paying defense costs and settlements out of pocket, at the same time revenue is falling because customers no longer trust you.
How can SMBs achieve and maintain privacy law compliance?
Start with a privacy audit. You need to know exactly what data you collect, where it’s stored, and who else receives it. This means inventorying every tool, plugin, and integration on your website, your mobile app (if you have one), and your backend systems. For most SMBs, this reveals a dozen or more third-party data flows nobody documented.
Once you know what’s happening, update your privacy policy to reflect reality. Use plain language. Name the specific third parties. Explain what data each one receives and why. If you share data with Google for advertising, say so. If your email platform can see customer purchase history, disclose it. Vague statements like “we work with trusted partners” don’t satisfy the law.
Implement a consent mechanism that works for your business model. For e-commerce, this often means a cookie consent banner that blocks non-essential tracking until the visitor agrees. For professional services, it might mean a consent checkbox on your contact form. The key is obtaining consent before sharing data, not after.
Add a “Do Not Sell My Personal Information” link in your website footer and create a process to honor those requests. This can be as simple as a form that feeds into a spreadsheet, as long as you actually stop sharing data for users who opt out. Document every request and your response.
Review your vendor contracts. Your agreements with SaaS providers, marketing platforms, and analytics tools should include data processing addendums that clarify their role (processor vs. controller), limit how they can use your customer data, and require them to delete data on request. If a vendor won’t sign a compliant agreement, find a different vendor.
Conduct quarterly privacy reviews. Technology changes. You add new tools, sunset old ones, and shift marketing strategies. Your privacy practices need to keep pace. A quarterly review catches drift before it becomes a compliance gap. This doesn’t require a law degree. It requires discipline and attention.
Do small businesses really need the same privacy law compliance as large retailers?
Yes. State privacy laws don’t exempt small businesses based on revenue or employee count in most cases. The CCPA originally had a revenue threshold, but its private right of action for data breaches applies to businesses of any size. Other state laws have varying thresholds, but if you operate online and sell to consumers in multiple states, you likely meet them.
More important, the customers visiting your website have the same rights regardless of your company size. A shopper in California doesn’t lose her opt-out rights because she’s buying from a 10-person company instead of a Fortune 500 retailer. The law follows the customer, not the business.
Plaintiffs’ attorneys don’t filter by company size when searching for violations. They use automated tools to scan thousands of websites for missing privacy notices, non-compliant cookie banners, and undisclosed data sharing. A three-person e-commerce shop is just as likely to receive a demand letter as a national chain, and less able to absorb the defense costs.
The good news is that privacy law compliance is more accessible for SMBs than it seems. You don’t need a dedicated privacy officer or a six-figure consulting engagement. You need accurate documentation, honest disclosure, and systems to honor customer rights. Many of the same tools that created your compliance risk (website analytics, marketing automation, CRM platforms) now include privacy features to help you comply.
How does privacy law compliance intersect with other regulations SMBs face?
If you handle payment card data, PCI DSS requires you to protect cardholder information and limit who can access it. Privacy law compliance adds a layer: you must also disclose who receives that data and obtain consent where required. The two frameworks overlap but aren’t identical. You can be PCI compliant and still violate privacy law if you share transaction data with advertisers without disclosure.
For healthcare providers, HIPAA already restricts how you use and share protected health information. State privacy laws generally defer to HIPAA for covered entities, but they still apply to non-PHI data you collect (website analytics, marketing data, administrative information). A medical practice that shares appointment scheduling data with a third-party booking platform needs both HIPAA compliance and privacy law compliance.
Financial services firms face overlapping requirements from the Gramm-Leach-Bliley Act, which requires privacy notices and opt-out rights for financial information sharing. The FTC Safeguards Rule adds data security requirements. State privacy laws layer on top, creating a compliance stack that requires careful mapping to avoid gaps.
The common thread is transparency and control. Every regulatory framework demands that you know what data you hold, protect it appropriately, disclose your practices honestly, and give customers a voice in how their information is used. Privacy law compliance isn’t a separate silo. It’s the connective tissue that runs through your entire data governance program.
What should a business owner do first to address privacy law compliance?
Open your website in an incognito browser window and watch the network traffic as it loads. Use your browser’s developer tools (F12 in most browsers, then click the Network tab) or a privacy scanner tool. You’ll see every third-party domain your site contacts. Make a list.
Now read your privacy policy. Does it name every company on that list? Does it explain what data each one receives? Does it describe how visitors can opt out? If the answer to any question is no, you have a compliance gap that needs closing.
Talk to your IT provider or web developer about implementing a cookie consent solution. Free and paid options exist. The key features are: blocking non-essential cookies until consent is given, logging consent decisions, and providing an easy way for visitors to change their preferences later.
Review your data retention practices. Privacy laws often require you to delete personal data when it’s no longer needed for the purpose you collected it. If you’re storing customer email addresses from a 2019 promotion you’re not running anymore, delete them. Less data means less risk.
Schedule a compliance assessment with someone who understands both the technology and the law. An MSP with compliance experience can inventory your data flows, identify gaps, and help you build a remediation roadmap that fits your budget and timeline. This isn’t a nice-to-have for businesses serious about sustainable growth. It’s table stakes in a world where privacy violations make headlines and customer trust is currency.
Keep reading
Sources
Source: Five Below accused of secretly sharing users’ shopping data with third parties
Researched and drafted with AI. Published before TC3 added human review in October 2026; questions go to a human at [email protected].