Tracking pixels and analytics: what actually makes a classifieds site's visitor data "sensitive" under state privacy law
The pixel you installed for marketing is not the pixel you think it is
A directory operator sets up a Meta pixel to measure which ads bring in advertisers, adds Google Analytics to see which cities convert, and puts a chat widget on the site so visitors can ask questions before signing up. Every one of these is a completely ordinary marketing decision, the kind any small business makes without a second thought. On a furniture store's website, that is exactly what it is: ordinary marketing infrastructure, and the data it produces is just browsing history.
A classifieds directory is not a furniture store, and the difference is not about tone or content policy. It is about what the pages themselves reveal. A visitor who spends time on a page for a specific category, a specific gender, or a specific orientation of listing is not just browsing, and any tool sitting on that page that reports the URL back to a vendor is transmitting more than a page view. It is transmitting an inference about that visitor's sex life or sexual orientation, and in a growing number of US states, that inference has its own legal category with its own rules.
This is not the same rule already covered here for operators handling EU visitors under GDPR's special category data. That earlier piece is about a single EU-wide regime that applies regardless of where the business is based. What follows is the American patchwork: a set of state laws that most operators have never mapped against their own marketing stack, because the document that usually gets attention is the payment processor's onboarding questionnaire, not the snippet of JavaScript a marketing contractor pasted into the site header eighteen months ago.
The reason this deserves its own read, separate from the GDPR piece, is that the American rules work differently in ways that change what an operator actually has to build. Some states only require an opt-out. Others require consent before the tool ever fires. Getting this wrong is not a matter of missing a checkbox on a form; it is a matter of a chat widget or an ad pixel running on a page it should never have been allowed to run on in the first place.
What "sensitive personal information" means, and why a directory sits inside it by default
California's amended privacy law, the CPRA, created a category called "sensitive personal information" that sits above ordinary personal data and carries its own disclosure and opt-out rules. The category includes the obvious items, a Social Security number, a financial account login, precise geolocation, but it also explicitly includes personal information that reveals a consumer's sex life or sexual orientation. That is not a stretched reading or a lawyer's creative interpretation. It is the plain text of the statute, sitting in the same list as racial origin and genetic data.
The condition that turns this from theoretical to automatic is how the law scopes it: the extra obligations attach when the business collects or processes that information for the purpose of inferring characteristics about a consumer. A general retailer's site does not typically infer anything about a shopper's sex life from what they browse, so this category barely touches it. A directory organized into categories by gender and orientation is built entirely around that kind of information. The inference is not a side effect of the business; it is the site's own navigation structure. That is the specific reason this category reaches a classifieds operator by default, in a way it does not reach most other small businesses running the exact same marketing tags.
Virginia's VCDPA and Colorado's CPA take a stricter approach than California's. Where the CPRA lets a business process sensitive data and simply offer consumers the right to limit that use afterward, Virginia and Colorado require the business to get the consumer's affirmative consent before processing sensitive data at all, not after the fact and not through a link buried in a footer. A specific, informed, opt-in action has to happen first. For a site that fires a marketing pixel automatically the moment a page loads, that is the difference between a compliant setup and one that never should have collected the data in the first place.
Roughly twenty states had comprehensive privacy laws of this kind in effect as the year began, and more have been enacted since, each phasing in on its own schedule and each with its own small variations on what counts as sensitive and which model, opt-out or opt-in consent, it follows. An operator does not get to pick which state's visitors show up. A directory serving national traffic is, in practice, building to the strictest rule that applies to any visitor it might get, which in this case means treating the consent model, not the opt-out model, as the baseline to design around rather than the exception to accommodate.
A pixel is "sharing," not "selling," and that distinction does not save you
The most common reason an operator assumes none of this applies to them is a simple one: no money changes hands. Nobody is selling a list of visitors to anyone. That reasoning holds up against an old-fashioned idea of a data sale and falls apart against how the CPRA actually defines the problem. The law created a separate concept called "sharing," specifically covering cross-context behavioral advertising, meaning any arrangement where a third party can use data from your site to target ads to that same visitor somewhere else, whether or not any payment is involved.
A retargeting pixel from an ad platform is built to do exactly that by design. It lets the platform recognize a visitor who was on a specific page of your directory and later show that visitor an ad elsewhere, using exactly the connection the law was written to catch. Calling that "not a sale" is technically accurate and legally irrelevant, because the sharing right exists precisely to reach this arrangement without requiring proof that money exchanged hands.
The practical consequence is a second, distinct disclosure obligation on top of the sensitive personal information rule already described. A business has to give consumers a way to limit the use of sensitive personal information, and a separate way to opt out of the sharing used for behavioral advertising. In practice these are usually combined into one link, commonly labeled "Your Privacy Choices," so a visitor does not have to hunt through two separate footers to exercise either right. Increasingly, states also expect a business to honor a Global Privacy Control signal automatically, meaning a visitor's browser can express that opt-out without them ever clicking anything on the site at all, and a site that only offers a manual link while ignoring the signal is not meeting the current bar.
None of this is limited to advertising pixels specifically. A chat widget that logs transcripts to a third-party vendor, an analytics SDK that reports which listing categories a visitor viewed, and a session-recording tool that plays back a visitor's clicks all move the same kind of page-level data to a vendor outside the business. Each one deserves the same scrutiny as the ad pixel, because the legal trigger is what the data reveals, not which department asked for the tool to be installed.
The lesson from Grindr: the leak is rarely the ad network you were watching
In September 2026, Grindr agreed to pay £26 million to settle a UK lawsuit brought by roughly 12,000 claimants through the law firm Austen Hays in the High Court of England and Wales. The claim was that the app shared users' HIV status, PrEP use, and information about their sex lives or sexual orientation with third-party vendors without adequate consent, covering data practices between 2016 and 2020. Grindr settled without admitting liability, and it has said its privacy program has changed substantially since new ownership took over in 2020.
The detail worth an operator's attention is not the size of the settlement. It is who the vendors were: Localytics and Apptimize, both ordinary product-analytics companies of the kind almost any app or website uses to understand user behavior, not advertising networks anyone would have flagged as high risk on sight. The exposure did not come from a deliberate data sale to a marketer. It came from a standard analytics integration that, on this particular kind of platform, happened to be receiving and forwarding sensitive category data as a routine side effect of normal event logging.
That is the exact shape of the risk described in the sections above, playing out on a real platform with a real dollar figure attached. Nobody at that company sat down and decided to sell sexual orientation data. An analytics SDK was doing its ordinary job on pages where its ordinary job happened to mean transmitting a sensitive inference, and nobody had mapped that connection before it became a two-year legal claim.
The same pattern is visible closer to home in how American plaintiffs' firms are currently suing website operators, not just app makers, under state wiretapping laws like the California Invasion of Privacy Act and under the federal Video Privacy Protection Act, over ordinary chat widgets, session-replay tools, and tracking pixels installed for entirely mundane marketing reasons. This is an active area, not a settled one: the US Supreme Court agreed in January 2026 to hear a case that will clarify how broadly the video privacy law's definition of "consumer" reaches, which means the boundaries of this exposure are still being drawn in real time rather than fixed by a rule an operator can simply read once and file away.
What to actually put in place before the next marketing change
Start with an inventory, not a policy. List every third-party tag on the site, the pixel, the analytics snippet, the chat widget, anything a marketing contractor or a plugin installed, and note which pages each one fires on. The question that matters is whether any of them fire on a category, gender, or orientation-specific listing page before a visitor has done anything to consent to that. Most operators have never made this list, because no single person owns every tag on the site, and that is exactly the gap this exposure lives in.
Once the list exists, split it. Tools that only need to run on account, billing, or general site-wide pages are the low-risk half. Anything that fires on a category or orientation-specific listing page belongs in a separate bucket that should not load automatically, and should only load after a specific, logged consent action, not a generic cookie banner accept button built for an ordinary retail site. A banner that says "we use cookies" satisfies almost nothing under an opt-in consent model for sensitive data.
Combine the two disclosure obligations into one visible link, commonly labeled "Your Privacy Choices," covering both the right to limit sensitive personal information and the right to opt out of sharing for behavioral advertising, and make sure the site actually honors a Global Privacy Control browser signal rather than only offering the manual link. This is a specific, buildable requirement, not a vague aspiration, and it is worth confirming with whoever built the site that it is wired up correctly rather than assuming a cookie-consent plugin handles it by default.
Treat session-replay and screen-recording tools as the highest-risk category on this list and, if the business does not have a clear operational reason to keep one, consider dropping it entirely rather than trying to configure around the risk. If one stays, exclude every category and listing page from recording rather than relying on redaction after the fact. The same logic that pushed traffic strategy toward search and referral instead of paid ad platforms applies here for a second reason: fewer third-party ad pixels on the site is not just a marketing choice, it is also fewer places where a category page's data can leak to a vendor nobody audited. Building this map before the next campaign is cheaper than reconstructing it after a demand letter arrives.
