Skip to content

Checklist · Last reviewed November 2026 · Educational only, not legal advice

Therapy Website Compliance Checklist: Is Your Site Consent-Safe?

An 18-point checklist and a 5-minute test to check your trackers, cookie banner and forms before a wiretap accusation letter, or a visitor, finds the problem for you.

Most therapy practice owners I talk to are certain their website is fine. Then we open a private window, look at what loads before anyone clicks a thing, and the surprises start. A forgotten pixel. A chat widget. A banner that says "Reject" while the trackers carry on.

This is the preventive version of our guide on website lawsuits and consent banners. That guide is for the day a wiretap accusation letter lands. This one is for the day before, when you can still fix things calmly.

Start with the quick answersJump to the checklist
Brent StutzmanBrent Stutzman, Founder & CEO

Section 01 — Quick Answers

Quick Answers: The Five-Second Website Test

What does "consent-safe" mean?
Your website doesn't send visitor data to analytics or ad companies until the visitor says yes, and a No actually stops it. The banner, the code behind it, your forms and your privacy policy all have to agree.
Does my therapy website need a cookie banner?
If your site loads analytics, ads, session recording or other outside tools, a banner that waits for a yes is the safest setup. If it truly loads none, you may not need one. Most sites load more than their owners realize.
What's the five-second website test?
Open your site in a private window and don't click anything. Is there a banner? Does Reject all sit next to Accept all with equal weight? If either answer is no, keep reading. This is only a first look.
Is a cookie banner enough?
No. A banner that looks right but doesn't stop the trackers is worse than none, because it promises something your site doesn't do. You have to test what actually loads before and after a visitor chooses.
Where do I start?
Run the 5-minute test below, then work down the 18-point checklist. Copy the checklist into a Google Doc or your favorite AI assistant to track it. Re-check monthly and after any website change.

Section 04 — Why It Can Happen to You

Why Small Therapy Practices Get Scanned Too

You might think a solo practice or a small group is too small to notice. Here's the problem with that.

The evidence in these letters comes from automated scans of a website. A scan doesn't know or care whether you have one clinician or fifty. It just records what your site sent to outside companies during a visit.

On our November 4, 2026 webinar, attorney Jamey Davidson of O'Hagan Meyer said that by his own estimate he has handled roughly 500 of these demand letters since 2024. That's his estimate and my paraphrase, and he hasn't reviewed this checklist.

And a therapy site is not a shoe store. A page called "Anxiety Therapy" says more about a visitor than a page called "Shoes" does. That's why the pages where someone is deciding to ask for help matter most.

Section 05 — Your Website Platform

Cookie Consent for WordPress, Squarespace, Wix and Brighter Vision

The right steps depend on where your site lives. WordPress gets the most detail below because it's the most flexible, and so the easiest place for a tracker to hide.

WordPress

  1. 1.List everything your site loads. Check Google Site Kit or MonsterInsights, a Meta Pixel plugin, Tag Manager, your page builder's embeds, form plugins and chat widgets.
  2. 2.Use a consent tool that blocks scripts until a visitor says yes, not one that only shows a banner. Complianz is one option, and our other guide covers what its free and paid versions include.
  3. 3.Hunt down hard-coded scripts. Code pasted into your theme's header or footer, or into a header-and-footer plugin, runs no matter what the banner says. Move it behind consent.
  4. 4.Give YouTube, Vimeo and Google Maps a click-to-load placeholder instead of loading on page view.
  5. 5.Clear your cache and CDN after every change. A caching plugin can keep serving the old page, so test in a private window afterward.
  6. 6.Re-run the 5-minute test and save dated screenshots.

Already got a letter? The repair version is in How to Fix a WordPress Therapy Website After a Tracking Letter.

Squarespace

Squarespace has a built-in cookie banner you turn on in the Cookies & Data Privacy panel. Visitors can Decline all or Manage cookies, and Squarespace says some non-essential cookies are restricted until a visitor acknowledges the banner. It covers Squarespace's own features and some third-party integrations. Code you add yourself through code injection is your responsibility, and Squarespace doesn't support it. So test: if you pasted in a Meta Pixel, a Google tag or a chat widget, check that it waits.

Wix

Wix has a cookie banner that disables non-essential cookies and scripts until a visitor consents, and its help pages name tools such as the Facebook Pixel, Google Ads and Google Analytics. Wix doesn't promise to cover apps from its app market or uncategorized custom code. Run its site scan, categorize any custom code, turn on placeholders for embeds, and then test in a private window. Wix also lets you download a consent log.

Brighter Vision

I couldn't find public documentation of a consent banner on client sites. Their privacy policy covers their own site, not yours. That doesn't mean you don't have one. Ask support in writing which tracking tools your site loads, whether there is a consent banner and whether Reject all blocks them. Then run the 5-minute test yourself and keep their answer with your dated proof.

Section 06 — The Checklist

The 18-Point Website Compliance Checklist

Work down it, or copy it into a Google Doc or your favorite AI assistant to track each item.

Trackers

  1. 1In a private window, before I click anything, my site makes no requests to analytics or ad companies.
  2. 2No tracking cookies (such as _ga, _fbp or _gcl_au) are set before a visitor chooses.
  3. 3No Meta Pixel or other ad pixel runs on my contact, booking or condition pages.
  4. 4No session recording or heatmap tool runs, or it is masked and waits for consent.
  5. 5Search terms and form answers never appear in a page address (URL).

Cookie banner

  1. 6The banner shows Reject all next to Accept all, with equal weight.
  2. 7After Reject all, trackers stay off as I browse several pages.
  3. 8After Accept all, only the tools named in my privacy policy load.
  4. 9If I use Google tags, Consent Mode v2 starts with everything denied.
  5. 10A "Cookie preferences" link in the footer reopens the banner so a visitor can change their mind.

Forms and embeds

  1. 11YouTube, Vimeo and Google Maps show a placeholder until the visitor clicks or consents.
  2. 12Booking, forms and chat load only after consent, or come from vendors my attorney has cleared.
  3. 13My forms tell people not to include health details in free-text boxes.

Policies

  1. 14My privacy policy matches what my site really loads, tool by tool.
  2. 15If I serve California visitors, my privacy policy has a California section, a working opt-out link where it applies, and honors Global Privacy Control browser signals.
  3. 16I've asked my attorney whether Washington's My Health My Data Act means I need a separate consumer health data privacy policy.

Site and monthly checks

  1. 17My site uses HTTPS and sends standard security headers.
  2. 18I test before launch, after any website change, and once a month, and I keep dated proof.

Copy the checklist

Copy it, paste it into a Google Doc or a spreadsheet, or hand it to an AI assistant along with your website address and ask it to walk you through each item. AI tools can miss things they can't see in a real browser, so confirm the results with the test below.

Therapy website compliance checklist

THERAPY WEBSITE COMPLIANCE CHECKLIST (18 points)
Website: [YOUR WEBSITE ADDRESS]
Date checked: [DATE]
Checked by: [NAME]

For each item write Pass, Fail or Not sure, and add a note.

TRACKERS
[ ] 1. In a private window, before I click anything, my site makes no requests to analytics or ad companies.
[ ] 2. No tracking cookies (such as _ga, _fbp or _gcl_au) are set before a visitor chooses.
[ ] 3. No Meta Pixel or other ad pixel runs on my contact, booking or condition pages.
[ ] 4. No session recording or heatmap tool runs, or it is masked and waits for consent.
[ ] 5. Search terms and form answers never appear in a page address (URL).

COOKIE BANNER
[ ] 6. The banner shows Reject all next to Accept all, with equal weight.
[ ] 7. After Reject all, trackers stay off as I browse several pages.
[ ] 8. After Accept all, only the tools named in my privacy policy load.
[ ] 9. If I use Google tags, Consent Mode v2 starts with everything denied.
[ ] 10. A "Cookie preferences" link in the footer reopens the banner so a visitor can change their mind.

FORMS AND EMBEDS
[ ] 11. YouTube, Vimeo and Google Maps show a placeholder until the visitor clicks or consents.
[ ] 12. Booking, forms and chat load only after consent, or come from vendors my attorney has cleared.
[ ] 13. My forms tell people not to include health details in free-text boxes.

POLICIES
[ ] 14. My privacy policy matches what my site really loads, tool by tool.
[ ] 15. If I serve California visitors, my privacy policy has a California section, a working opt-out link where it applies, and honors Global Privacy Control browser signals.
[ ] 16. I've asked my attorney whether Washington's My Health My Data Act means I need a separate consumer health data privacy policy.

SITE AND MONTHLY CHECKS
[ ] 17. My site uses HTTPS and sends standard security headers.
[ ] 18. I test before launch, after any website change, and once a month, and I keep dated proof.

Next steps: list every Fail and Not sure, who owns each one, and the date it will be fixed.
This is an educational checklist, not legal advice. Ask a licensed attorney about your situation.

Section 07 — The 5-Minute Test

How to Test Your Cookie Consent in 5 Minutes

You don't need to be technical. You need a private window and a little patience. Here are the steps.

  1. 1Open a private (incognito) window and go to your homepage. Don't click anything on the banner.
  2. 2Open your browser's developer tools (F12, or Cmd+Option+I on a Mac) and click the Network tab. Reload the page.
  3. 3Look through the list for analytics and ad companies, such as google-analytics, googletagmanager, doubleclick, facebook, clarity, hotjar, tiktok and linkedin. Before a choice, you want none. If you use Google Consent Mode, a Google tag may load in a "denied" state, so ask your webmaster what to expect.
  4. 4Open the Application tab (Storage in Firefox) and look at Cookies. You shouldn't see _ga, _fbp, _gcl_au or similar before a choice.
  5. 5Click Reject all. Visit your contact page, a booking page and a service page. Check the Network and Cookies lists again. They should still be clean.
  6. 6Clear the site's data, reload, and click Accept all. Now confirm that only the tools named in your privacy policy appear.
  7. 7Click "Cookie preferences" in your footer. The banner should reopen and your new choice should stick.
  8. 8Write down what you saw, take dated screenshots, and save them with your checklist.

Two free second opinions

You can also paste your site into the AI scan prompt from our guide for a plain-English first look.

Section 08 — Rethink Your Website Build

Is It Time to Rethink Your Website Build?

If you worked down the checklist and kept finding things, that's worth noticing. It may not be a banner problem. It may be a build problem.

The problem

You want a full caseload and a website that quietly works. But many therapy sites are assembled from themes and plugins, and each one is another place for a tracker to hide.

The guide

We build websites for therapy practices alongside the TheraSaaS CRM, so consent, forms and your intake system are designed to work together from day one.

The plan

1. Check your site with this list. 2. Fix it, or rebuild with consent built in. 3. Test monthly and keep dated proof.

Every website we build follows the same consent-first defaults:

  • Consent banner with a Reject button as easy as Accept
  • Google Analytics (GA4) loads only after a yes
  • Forms, videos and maps load only after a click
  • Browser privacy signals (Global Privacy Control) count as a no
  • No Meta Pixel, TikTok, LinkedIn or session recording by default
  • Google Ads only with approval, for measurement only, never remarketing
  • A privacy policy generated to match what the site actually loads
  • An automated consent check before launch, with dated proof

Our sites are custom-built rather than stitched together from a pile of plugins, and moving forward they're hosted on Cloudflare. Fewer moving parts means fewer places for a tracker to hide. See what that looks like on our premium therapy websites page, or browse a live example, Thrive Counseling.

The honest part: if your current site passes this checklist, you may not need to change a thing. And no website can guarantee you'll never receive a letter. It does mean less to point at, and proof of what you did.

Not legal advice. Talk with a licensed attorney about your situation.

See premium therapy websites

Not sure if it's time to rebuild? Schedule a demo and ask for a free website audit.

Schedule a Demo

40 minutes, no free trial needed

Section 09 — Frequently Asked Questions

Therapy Website Compliance FAQ

Do therapists need a cookie banner on their website?
If your website loads analytics, advertising pixels, session recording or other outside tools, a banner that waits for a yes before loading them is the safest setup, and privacy laws in several places expect it. If your site loads none of those, you may not need one. Most sites load more than owners realize, so test first and ask an attorney.
Does a cookie banner make my therapy website compliant?
No. A banner only helps if the trackers actually stay off until a visitor says yes, if Reject all works, and if your privacy policy matches what the site loads. A banner that doesn't block anything can be worse than none, because it promises something the site doesn't do.
How often should I test my cookie consent?
Test before you launch, after any change to your website, plugins or tracking tools, and once a month. Updates and new plugins can quietly add a tracker. A monthly check, ideally automated, catches that, and dated results give you proof of what you did.
Is it okay to use Google Analytics on a therapy website?
It's a judgment call, and I'm not a lawyer. In my view, Google Analytics is far less concerning with consent in place and the right settings: enhanced conversions and user-provided data off, remarketing off, and nothing sent before a visitor says yes. Google doesn't sign a BAA, so keep it away from forms and portals, and talk to your attorney. See the Google settings that matter.
What if my website fails the checklist?
Don't panic. Most failures are fixable: move a script behind consent, remove a pixel, or switch on the right banner setting. If you already received a wiretap demand letter, don't change anything yet. Call your insurance carrier, then an attorney, and read our guide on the first 24 hours. What to do in the first 24 hours.
Is this only a California problem?
No. Many demand letters cite California's wiretap law (CIPA), but the federal Wiretap Act and other states' wiretap laws can come up too, and a California visitor can reach a practice anywhere. Other privacy laws, such as Washington's My Health My Data Act, add their own rules. Build for every visitor.

Still have a question? Ask it on a demo.

Schedule a Demo

40 minutes, no free trial needed

Section 10 Sources

Section 11 About Brent Stutzman & TheraSaaS

Stop letting client leads fall through the cracks.

See TheraSaaS in action. Book a 40-minute demo and we'll walk you through the entire intake workflow — no free trial needed.

Schedule Demo