The challenge
Soloh Partners, a New York staffing and recruitment firm, was running on an ageing WordPress site when a legal demand letter arrived citing potential violations of California's Invasion of Privacy Act (CIPA): exposure of up to $5,000 per violation for capturing visitor data with third-party scripts before consent. The fix wasn't a cookie banner. It required technically blocking every non-essential script until a visitor made an active choice, across a codebase still tied to WordPress plugins and licensing overhead.
What we did
We rebuilt the site from WordPress into a clean, custom PHP codebase with no framework dependency, preserving all existing content and SEO structure through the move. The new Travel page uses parallax scrolling and background video to convert healthcare and travel staffing candidates, and every page ships mobile-responsive, with the JobDiva candidate portal embedded on the Jobs page, GA4 analytics, and Google Maps on Home and Contact.
For CIPA compliance, we ran a full script audit across the codebase, cataloguing every external script by domain, file, load method and risk level, and confirmed no hidden trackers like GTM, Meta, LinkedIn, TikTok, Hotjar, Clarity or HubSpot. We implemented Enzuzo, a Google-certified consent platform, in Prior Consent mode: the site stays completely inert until a visitor actively accepts or declines, with dismissing the banner explicitly not counted as consent.
The JobDiva candidate portal couldn't inherit consent from the parent site, so we built a custom block that keeps the iframe from rendering until consent is confirmed, handling four live states: blocked, declined, accepted, and preference changes, with no page reload. On the analytics side, we found Google Signals enabled across all 307 regions, quietly linking visitor traffic to signed-in Google accounts for remarketing regardless of consent, and disabled it, landing on an approach stricter than Google's own Consent Mode.
We stood up a staging environment with SSL, verified every consent state across Chrome, Edge, Firefox and Safari with Playwright: 10 of 10 checks passing in each, and published Privacy Policy and Terms of Service pages generated with Soloh's real details. The contract drew a clear line between our implementation responsibility and Enzuzo's platform-level compliance responsibility, with indemnification capped at the project fee.
How we worked
We worked directly against the legal demand letter's timeline, treating the compliance fix with the same urgency as the risk it addressed: auditing, building and verifying in staging before anything touched production, and documenting the split between platform and implementation liability for Soloh's counsel.