Compliance and risk: where consent, privacy or accessibility rules create exposure.

Where do consent, privacy or accessibility rules create exposure?

Mostly where a target collects leads, tracks visitors or serves customers online: lead forms, calls and texts, tracking tags, website accessibility and how it handles reviews.

Compliance due diligence is a review of where a target’s practices could create legal or commercial exposure, ranked so the deal team knows which ones matter and which go to counsel.

Compliance is one of the six areas of private equity due diligence.

Insured for cyber, general and professional liability. BAAs in place as needed. HIPAA audits available.

Who must comply with TCPA?

Businesses that call or text consumers for marketing, or that use an autodialer, a prerecorded voice or an artificial voice, including AI-generated voices. Consent and opt-out rules apply to those calls and texts.

The TCPA compliance checklist turns consent wording, follow-up and opt-out handling into an evidence request for counsel.

For an engagement covering the workflow and its records, scope a TCPA compliance audit.

Do websites legally have to be ADA compliant?

US courts and the Department of Justice have treated many business websites as covered by the ADA, and website accessibility claims are common. WCAG 2.1 AA is the usual technical benchmark. Whether a specific site must comply is a question for counsel.

The ADA website accessibility audit separates scoped technical checks from the legal questions counsel must resolve.

Is GDPR compliance mandatory in the USA?

Only for US companies that offer goods or services to people in the EU or monitor their behavior. Most US targets are more exposed to state privacy laws such as California’s CCPA, and to tracking tags on sensitive pages.

We check what tags fire on which pages and what the privacy notice says, and list the gaps for counsel.

A privacy compliance audit brings tracking, notices and consent evidence together, with questions about legal applicability and obligations reserved for counsel.

What can trigger a HIPAA compliance audit?

Typically a patient complaint, a reported breach or selection for a federal audit program. For a healthcare target, the outside view shows tracking on patient-facing pages and how forms handle health information; a HIPAA risk assessment inside the target needs authorized access.

Scope the HIPAA risk assessment within an authorized engagement, with appropriate BAA arrangements before sensitive information is reviewed.

For healthcare targets, see healthcare due diligence.

How we rank compliance risks

Every risk gets a likelihood, an impact, an owner and the evidence behind it.

Which compliance findings go to counsel?

Any finding that turns on how a law applies to the target: consent wording, accessibility claims, privacy notices and review incentives. We flag them, with evidence, and counsel decides.

• We do not give legal opinions.
• We do record the evidence counsel needs: screenshots, page copy and timestamps.
• Counsel-reviewed policies are a hardening item in the 100-day plan.

What you receive from compliance due diligence

A prioritized risk register and the compliance row of the 100-day plan.

The compliance row feeds the 100-day value creation and hardening plan. This page is not legal advice.

Prepare the compliance evidence requests

Use the HIPAA risk assessment checklist for authorized internal evidence and the ADA website compliance checklist for scoped accessibility checks. Both keep legal conclusions with counsel.