Came across a site offering GDPR compliance tools — and it drops tracking cookies without consent. No cookie banner. No opt-out. No visible privacy policy. Just silent data slurping.

Under GDPR (Articles 6, 7, 13) and the ePrivacy Directive, this is a textbook violation: consent must be informed, explicit, and prior. Even worse, the site’s entire pitch is about compliance and information security management. Hypocrisy aside, this could expose clients to regulatory risk if they’re trusting this vendor.

If your security tool breaks privacy law by design, what exactly are you securing?