COMPLIANCE FRAMEWORKS
The laws WebSentinel evidence applies to.
One forensic detection engine produces evidence under privacy, data protection, consumer-protection, criminal and environmental law across the EU, the UK, the United States, Asia-Pacific, the Middle East, Africa and Latin America. Every finding is recorded as it happened, attributed to the script and the party responsible, and mapped to the provisions it engages - ready for counsel, a regulator or a court to act on.
LEGAL MAPPING
What WebSentinel evidences under each law.
Each law is mapped to the evidence WebSentinel produces under it and the products that deliver that evidence.
| Framework | What WebSentinel evidences | Products |
|---|---|---|
| European Union | ||
| ePrivacy Directive 2002/58/ECArticles 5(1) and 5(3) | Article 5(1) protects the confidentiality of communications and the related traffic data, prohibiting their interception or surveillance by anyone other than the users without consent. Article 5(3) requires consent, with narrow exceptions, before any storage of, or access to, information on the user's device. WebSentinel evidences the interception and onward transmission of communications - form input, chat, beacons - as well as pre-consent tags, fingerprinting and the storage or reading of information on the device. | |
| GDPRArticles 5, 6, 7, 12 to 14 and 25, and Chapter V | The principles and lawfulness of processing (Articles 5 and 6), the conditions for valid consent (Article 7), transparency and the information people must be given (Articles 12 to 14), data protection by design and by default (Article 25), and transfers of personal data to third countries (Chapter V). WebSentinel evidences the processing that runs, when it runs relative to consent, what the privacy and cookie notices disclose against what actually happens, where the data is sent, and the gap between the stated design and the deployed reality. | |
| EDPB Guidelines 2/2023Technical scope of Article 5(3) of the ePrivacy Directive (v2.0, October 2024) | Article 5(3) covers far more than cookies: tracking pixels, tracked links, local processing such as fingerprinting scripts that read device properties, and any instruction that makes the device send information it holds all count as storing or gaining access to information on the device. WebSentinel evidences each of these techniques as it fires, attributed to the script responsible. | |
| EDPB Opinion 5/2019Interplay between the ePrivacy Directive and the GDPR | Where the ePrivacy Directive governs storing or accessing information on the device, any subsequent processing of the personal data obtained still needs a lawful basis under the GDPR, which continues to apply to everything the ePrivacy Directive does not specifically cover. WebSentinel evidences both layers - the access to the device and the processing that follows it. | |
| CJEU Planet49Case C-673/17 | Consent must be active, and a pre-ticked box is not valid consent. WebSentinel evidences whether processing fired before any active consent signal and whether default-on mechanisms were present. | |
| CJEU joint controllershipWirtschaftsakademie C-210/16; Fashion ID C-40/17 | The administrator of a Facebook fan page is a joint controller with Facebook for the processing of visitors' data (Wirtschaftsakademie, 2018), and a website operator that embeds third-party code is a joint controller with the third party for the collection and transmission of visitors' data, without needing any access to that data (Fashion ID, 2019). WebSentinel attributes every event to the script and the party responsible, so the part played by each joint controller is evidenced. | |
| Environmental Crimes Directive (EU) 2024/1203Unlawful processing with a measurable environmental impact | Unlawful processing at internet scale carries a real and measurable environmental cost. WebSentinel quantifies the energy and carbon cost of unlawful pre-consent processing to an evidentiary standard, alongside the ePrivacy and GDPR unlawfulness it also evidences. | |
| Unfair Commercial Practices Directive 2005/29/ECConsumer protection | Deception where a cookie banner represents that Reject deletes cookies and it does not. WebSentinel evidences the gap between what the banner represents and the third-party cookies that remain on the browser after consent is withdrawn. | |
| Directive 2013/40/EU on attacks against information systemsArticles 3, 4, 5 and 6, as transposed in each Member State (e.g. Malta Criminal Code Article 337C) | Criminal law. Accessing an information system without right (Article 3), interfering with the system (Article 4) or with its data (Article 5), and intercepting non-public transmissions of computer data (Article 6). WebSentinel evidences scripts interrogating the visitor's device without their knowledge, writing surveillance state to it, installing background code on it, and capturing what the visitor types and does on the page. | |
| International | ||
| Council of Europe Convention on Cybercrime (Budapest Convention)ETS No. 185, Articles 2, 3, 4 and 5 | The international criminal-law baseline, ratified well beyond Europe: illegal access (Article 2), illegal interception (Article 3), data interference (Article 4) and system interference (Article 5). WebSentinel evidences the same conduct - unauthorised interrogation of the device, interception of the visitor's interaction, and writing to or running code on the device - attributed to the script and the party responsible. | |
| United Kingdom and EEA | ||
| Privacy and Electronic Communications Regulations 2003 (UK)Regulation 6 and Schedule A1, as substituted by the Data (Use and Access) Act 2025 from 5 February 2026 | Storing information on, or gaining access to information in, a user's device - including collecting or monitoring information the device emits automatically - needs consent unless an exception applies: transmission, strictly necessary, or the new, conditional exemptions for first-party statistics and for appearance and functionality, which require clear information and an easy way to object. WebSentinel evidences every storage, access and emission event, who received the data and whether it took place before consent. | |
| Norway Electronic Communications Act (ekomloven) 2024Section 3-15, in force 1 January 2025 | Storing or accessing information on the user's equipment needs clear information and consent to the GDPR standard, apart from transmission and what is strictly necessary for a service the user asked for. WebSentinel evidences every storage and access event and whether consent preceded it. | |
| United States | ||
| California Invasion of Privacy Act (CIPA)California Penal Code section 631 | The wiretapping provision, applied to session replay, chat interception and third parties reading communications in transit. WebSentinel records what is captured, the destination party, and the consent state at the moment of capture. | |
| California Comprehensive Computer Data Access and Fraud ActCalifornia Penal Code section 502 | Knowingly accessing a computer, computer system or its data without permission. WebSentinel evidences scripts reading the hardware, software and configuration of the visitor's device, and writing to and reading back from its storage, without the visitor's knowledge or consent. | |
| Computer Fraud and Abuse Act18 U.S.C. 1030(a)(2)(C), (a)(5)(A) and (g) | Federal criminal law with a civil action: intentionally accessing a protected computer without authorisation and obtaining information from it, or knowingly transmitting code that intentionally causes damage to it without authorisation. A private claim needs a qualifying harm, for consumers usually loss of at least USD 5,000 in a year, and that loss can be quantified - the difference between the price a profiled visitor was charged and the price they should have paid, the energy the unauthorised processing consumed over a set period, and the cost of professional help to deal with a machine behaving unusually or with the distress of being surveilled. Since Van Buren v. United States (2021), authorisation is a yes-or-no question of whether the person was allowed into that computer, or that part of it, at all. WebSentinel evidences what third-party code read from and wrote to the visitor's device, how often and with what processing load, and that the visitor never gave permission - the factual basis for both the access and the quantum of loss. | |
| All-party-consent wiretap statutesPennsylvania 18 Pa.C.S. 5703 and 5725; Washington RCW 9.73.030 and 9.73.060; Florida Fla. Stat. 934.03 and 934.10; Maryland Cts. and Jud. Proc. 10-402 and 10-410 | Interception of a communication needs the prior consent of every party, with civil damages for each violation. Federal appeal courts have dismissed session-replay claims that showed no concrete injury, so claims now turn on evidence of what personal or sensitive content was actually captured and sent - which is what WebSentinel records, with the destination and the consent state. | |
| Video Privacy Protection Act18 U.S.C. 2710 | Disclosing what a person watched needs their informed, written consent, given separately from other terms, with liquidated damages for every disclosure. WebSentinel evidences video and page identifiers sent to third parties alongside user identifiers. | |
| Washington My Health My Data ActRCW 19.373 | Opt-in consent is required before consumer health data is collected, separate consent before it is shared, and a signed authorisation before it is sold, with a private right of action under the Consumer Protection Act. WebSentinel evidences pixels and trackers on health-related pages and the data they send before any consent. | |
| Illinois Biometric Information Privacy Act740 ILCS 14/15(b) and 14/20 | Written notice and a written release are required before biometric identifiers are collected, with statutory damages for each violation. WebSentinel evidences where a site captures face, voice or other biometric data and where it is sent. | |
| FTC Act section 5Unfair or deceptive practices | Deception where a cookie banner represents that Reject deletes cookies and it does not. WebSentinel evidences the gap between what the banner represents and the third-party cookies that remain on the browser after consent is withdrawn. | |
| CCPA / CPRACalifornia consumer privacy | California consumer privacy rights and signals. WebSentinel evidences the sale or sharing of personal information and whether opt-out signals are honoured in the deployed property. | |
| Asia-Pacific | ||
| India Digital Personal Data Protection Act 2023Sections 4 to 7 and 9(3); DPDP Rules 2025 - consent duties apply from 13 May 2027 | Processing needs consent that is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action after a notice, or a listed legitimate use, and tracking or behavioural monitoring of children is prohibited. WebSentinel evidences the tracking that runs before any consent or notice. | |
| China Personal Information Protection LawArticles 3, 13, 14, 23, 29 and 39 | Consent is the main basis and must be informed, voluntary and explicit, with separate consent to share data with another business, to process sensitive data such as location tracking, and to send data abroad. It applies to businesses outside China analysing the behaviour of people in China. WebSentinel evidences each third party receiving data, and where it is located. | |
| South Korea Personal Information Protection ActArticles 15, 17 and 22 | Collection and provision to third parties need consent, with each matter presented separately, and the regulator's 2024 policy on online behavioural information requires notice, consent and a way to refuse for identifiable tracking. WebSentinel evidences the behavioural collection and the third parties receiving it. | |
| Japan Telecommunications Business Act and APPITBA Article 27-12; APPI Article 31 | Sending user information from the device to third parties needs prior notice, information that is easy to find, or an opt-out, and passing personally referable information to a recipient who will link it to an identity needs confirmed consent. WebSentinel evidences every external transmission and its recipient. | |
| Vietnam Law on Personal Data ProtectionLaw 91/2025/QH15, Article 9 - in force 1 January 2026 | Consent must be voluntary, informed and specific to each purpose, and silence or no response is not consent. WebSentinel evidences the processing that runs before any response to a consent request. | |
| Indonesia Personal Data Protection LawLaw 27/2022, Articles 20 and 22 | Explicit, valid consent for specific purposes is the first lawful basis and must be recorded and clearly distinguishable from other matters. WebSentinel evidences the processing that runs before any consent is recorded. | |
| Thailand Personal Data Protection Act 2019Section 19 | Consent must be obtained before or at the time of collection, explicitly and for a specific purpose. WebSentinel evidences collection that happens before consent. | |
| Middle East, Africa and Latin America | ||
| Turkey Personal Data Protection Law (KVKK)Law 6698, Article 5; KVKK cookie guide | Processing needs explicit consent unless an exception applies, and the regulator's cookie guide requires explicit consent, by an active act, before any non-essential cookie is placed. WebSentinel evidences every cookie and storage write and whether it came before consent. | |
| Saudi Arabia Personal Data Protection LawArticles 5 and 6 | Processing, and any change of purpose, needs consent unless an exception applies, and legitimate interest is not available for sensitive data. WebSentinel evidences the processing that runs before consent. | |
| Nigeria Data Protection Act 2023 and GAID 2025NDPA sections 25 and 26; GAID Article 19 | The controller must prove consent, and cookies and cookie-like tracking tools need free, informed and specific consent with a clear accept or reject choice, every tracking tool disclosed up front and no pre-selected cookies. WebSentinel evidences every tracking tool that runs and whether it ran before a choice was made. | |
| Kenya Data Protection Act 2019Sections 2, 30 and 32 | Consent must be express, unequivocal, free, specific and informed, and processing without it or another listed basis is an offence. WebSentinel evidences processing that runs before consent. | |
| LGPD (Brazil) and ANPD cookie guidanceLei Geral de Protecao de Dados; Guia Orientativo Cookies e Protecao de Dados Pessoais | The regulator's guidance makes consent the basis for non-necessary cookies, off by default, with a reject-all option and no pre-ticked or tacit consent, and says legitimate interest will hardly cover behavioural advertising. WebSentinel evidences the cookies and profiling that run before consent and the categories of data the property collects and transmits. | |
NEXT STEP
Tell us which regime you are working under.
Describe the matter or the property and the regime in play, and we will come back with the right product, the evidence it produces, and a way forward.