Audited source 1: Homepage
www.davis-davislaw.com/
GTM-M3PGF25, GA4 G-X5Q3VMP5WP, retired UA-267194897-1, Google Ads, The Trade Desk pixel, Rubicon, PubMatic, BidSwitch, Clarity, CallRail, Ngage chat, UserWay. axe 37. October 13, 2026.
Audited source 2: Contact page
www.davis-davislaw.com/contact/
Form requires a full street address; no attorney-client notice on the form. Index Exchange and Xandr cookies also set. axe 19. October 13, 2026.
Audited source 3: Privacy Policy + Disclaimer
www.davis-davislaw.com/privacy-policy/
“Effective September 14, 2015.” Says the firm does not share personal information with any third-party advertiser. axe 28 / 33. October 13, 2026.
9
Ad-tech and tracking companies setting cookies
117
axe failures (4 pages)
Executive pitch
davis-davislaw.com is a medical-malpractice site where ad-exchange companies, including The Trade Desk, Rubicon, PubMatic, Index Exchange, Xandr, and BidSwitch, set tracking cookies on the contact page, along with Google Ads, Microsoft Clarity session recording, CallRail, and Ngage chat. There is no consent banner and GPC is ignored. The Privacy Policy dates from September 2015, mentions Flash cookies and AdRoll, and says the firm does not share personal information with any third-party advertiser. The intake form requires a full street address but carries no attorney-client notice.
2026 → 2027 exposure
Do now (2026): remove or gate the ad-exchange tags; add a consent manager that honors GPC; rewrite the 2015 policy; add an intake notice to the form and chat; fix accessibility. Conditional: Texas TDPSA rights. 2027: a dated legal hub.
Executive key takeaway
The biggest risk: ad-exchange tracking on a medical-malpractice intake page, governed by an 11-year-old policy that says the firm doesn’t share data with advertisers. The full report unlocks the exact replacement language for all 4 critical and 1 warning findings, plus the 2027 roadmap item, along with the 8-step roadmap.
Free preview: finding 1 of 6
2026: Ad-exchange companies set tracking cookies on a medical-malpractice intake page
2026 GAP
Cookies / ad tech · Health-adjacent intake · Active 2026 finding
Current state (verified October 13, 2026 CT)
Live Chrome load of home and contact. Requests and cookies from insight.adsrvr.org (iframe titled “TTD Universal Pixel”; cookies TDID, TDCPM), pixel.rubiconproject.com (khaos, audit), simage2.pubmatic.com (KRTBCOOKIE_377, PugT), x.bidswitch.net (tuuid), dsum-sec.casalemedia.com (CMID), ib.adnxs.com (uuid2, XANDR_PANID), ad.doubleclick.net (IDE), and www.googleadservices.com (_gcl_au). No cookie banner was shown, though a wpconsent_geolocation cookie is set. With GPC on, TDID, IDE, uuid2, and tuuid were still set.
Requirement
Ad-exchange cookie syncing ties a visitor’s browser ID to a medical-malpractice site visit across companies. Visitors should be able to refuse this, and GPC should be honored if TDPSA applies.
Exact language / corrective action that should be there
Cookie notice: “We use essential cookies to run this site. With your permission, we also use Google Analytics, Google Ads, The Trade Desk, Microsoft Clarity, and CallRail to measure visits and our advertising. [Accept] [Reject non-essential] [Settings].” Reject must be as visible as Accept; a GPC signal counts as Reject.
Recommended fix
Remove The Trade Desk tag from intake pages (or entirely) and gate every ad tag behind a consent manager wired to Consent Mode v2.
2026 gaps & 2027 roadmap (locked)
2026: September 2015 Privacy Policy says no sharing with advertisers and refers to Flash cookies and AdRoll
2026 GAPPrivacy notice · Accuracy · FTC Section 5 · Active 2026 finding
Current state
████████████████████████████████████████████████████████████ ████████████████████████████████████████████████████████████
Requirement
████████████████████████████████████████████████████████████
Exact language that should be there
████████████████████████████████████████████████████████████ ████████████████████████████████████████████████████████████ ████████████████████████████████████████████████████████████
2026: Intake form requires a full street address and has no attorney-client notice
2026 GAPIntake confidentiality · Data minimization · Active 2026 finding
Current state
████████████████████████████████████████████████████████████ ████████████████████████████████████████████████████████████
Requirement
████████████████████████████████████████████████████████████
Exact language that should be there
████████████████████████████████████████████████████████████ ████████████████████████████████████████████████████████████ ████████████████████████████████████████████████████████████
2026: Accessibility (WCAG 2.2 AA / ADA Title III): 117 axe failures across 4 pages
2026 GAPAccessibility · WCAG 2.2 AA · ADA website demand-letter risk
Current state
████████████████████████████████████████████████████████████ ████████████████████████████████████████████████████████████
Requirement
████████████████████████████████████████████████████████████
Exact language that should be there
████████████████████████████████████████████████████████████ ████████████████████████████████████████████████████████████ ████████████████████████████████████████████████████████████
2026: No Texas TDPSA rights section (conditional on coverage)
2026 GAPTexas Data Privacy and Security Act · Universal opt-out · Conditional
Current state
████████████████████████████████████████████████████████████ ████████████████████████████████████████████████████████████
Requirement
████████████████████████████████████████████████████████████
Exact language that should be there
████████████████████████████████████████████████████████████ ████████████████████████████████████████████████████████████ ████████████████████████████████████████████████████████████
2027: A dated legal hub that matches what the site actually runs
2027 ROADMAPFuture-proof · Texas law-firm intake · 2027 readiness
Current state
████████████████████████████████████████████████████████████ ████████████████████████████████████████████████████████████
Requirement
████████████████████████████████████████████████████████████
Exact language that should be there
████████████████████████████████████████████████████████████ ████████████████████████████████████████████████████████████ ████████████████████████████████████████████████████████████
2026–2027 Integrated Remediation Roadmap
⚑
Step 1
Remove / gate ad-exchange tags
Trade Desk off intake pages.
⚑
Step 2
Consent manager + GPC
Consent Mode v2.
⚑
Step 3
Rewrite the 2015 policy
Name every live vendor.
⚑
Step 4
Form + chat notice
No attorney-client relationship.
⚑
Step 5
Drop required address
Collect only what’s needed.
⚑
Step 6
WCAG 2.2 AA fixes
Contrast, link names, alt.
⚑
Step 7
Accessibility statement
Beyond the UserWay overlay.
⚑
Step 8
2027 Legal hub
Privacy+Cookie+TX rights+A11y.
2027 Texas Law-Firm Web Intake Privacy & Accessibility Readiness
Step 1
Remove / gate ad-exchange tags
Trade Desk off intake pages.
Step 2
Consent manager + GPC
Consent Mode v2.
Step 3
Rewrite the 2015 policy
Name every live vendor.
Step 4
Form + chat notice
No attorney-client relationship.
Step 5
Drop required address
Collect only what’s needed.
Step 6
WCAG 2.2 AA fixes
Contrast, link names, alt.
Step 7
Accessibility statement
Beyond the UserWay overlay.
Step 8
2027 Legal hub
Privacy+Cookie+TX rights+A11y.
Get the full Davis & Davis Privacy Snapshot
5 more findings with live evidence and word-for-word replacement language, plus the 8-step 2026–2027 roadmap.
Privacy Snapshot
$1,000
- Full report, delivered in 1 business day
- Ready-to-upload policy pages (Privacy, Cookie, SMS, Accessibility)
Website Upgrade
$2,000
- Full report and policy pages
- New accessible (WCAG 2.2 AA) website, delivered in 5 business days
- Up to 2 rounds of revisions
Get the full report →