Building for a country where the rules depend on who is visiting
What makes a US build different is mostly engineering. Privacy obligations depend on where the visitor lives, so collection and consent have to be conditional rather than one global setting. Browser opt-out signals such as Global Privacy Control have to be honored in code. Accessibility belongs in the components.
American sites are usually built as though there were one rule, then a policy page covers the fact that there is not. What applies to a visitor depends on where that visitor is, and several states now expect a site to answer a preference the browser sends on the person's behalf rather than waiting for a click. That is not a policy problem. It is a set of decisions made in code.
The standard failure is a site that treats every visitor identically and calls the banner compliance. Analytics, ad pixels and session recording fire on first paint, before anyone has agreed to anything. The browser is sending Global Privacy Control and nothing in the stack reads it, because nobody was asked to. Forms collect more than the business needs, including categories several states treat as sensitive, and it lands in a CRM nobody has mapped. Then a deletion request arrives and nothing can find where that record went.
When this work makes sense
Questions worth asking any supplier
Does the site read Global Privacy Control and act on it, because several states treat a preference sent by the browser as a real request rather than something to ignore?
Can tag behavior differ by where the visitor is, because a single national posture is defensible but should be a choice rather than an accident?
Is there a written inventory of every script, pixel and form field, because you cannot honor a deletion request for data you cannot locate?
Are accessible patterns built into the component library, because a component fixes the problem once and a remediated page fixes it until the next release?
Where is the site served from, because a visitor on the far coast pays for a distant origin on every navigation?
Deliverables
A data inventory listing every script, tag and form field, what it collects and where it sends it
Consent wired so that nothing requiring permission runs before permission exists
Global Privacy Control read at the edge and applied to tag behavior, with the decision logged
Collection configurable by visitor location, so differing state obligations are configuration rather than a rebuild
Forms that collect what the business actually uses, with sensitive categories scoped deliberately
A component library with keyboard behavior, focus handling, labeling and contrast tested against WCAG
Multi-region delivery with origin and caching chosen for a continental audience rather than one city
Built with
Process
A US build starts with a data inventory, before any design is approved. We list every tag, script, embedded widget and form field on the current site, what each collects and where it goes. This usually takes days and produces surprises, a pixel nobody remembers adding, a form capturing a field the business has never used, a chat widget recording sessions. The inventory is what makes everything downstream possible: you cannot make collection conditional, honor an opt-out signal or answer a deletion request until you know what is being collected.
The standard nine stages, discovery, strategy, UX/UI, development, content and SEO, testing, launch, measurement and continuous improvement, apply to every project. The paragraph above is what differs for this one.
What moves the number
Pricing depends on scope, functionality, integrations and content requirements. These are the factors that change it most:
Three ways to handle a rulebook that varies by visitor
One strict posture everywhere
Fits: Businesses that would rather apply the most demanding interpretation nationally than maintain differences
Limits: You give up measurement everywhere to meet obligations that may only reach part of your audience
Conditional by visitor location
Fits: Companies selling into many states where the measurement loss of a blanket approach is material
Limits: More to build, more to test, and it needs revisiting as states change what they expect
A banner and nothing behind it
Fits: Nothing we would recommend, though it is what most sites currently have
Limits: The banner records a click while the tags fire regardless, documenting an intention the site does not keep
Case studies
No published US web development case study yet. Our New York office is at 1 Liberty Street, 23rd Floor. We will publish client work when we have permission to name the business and outcomes that can be evidenced rather than described.
MBGDesk operates from 4 offices in India, United States, United Kingdom, United Arab Emirates. We hold no industry certifications and do not imply otherwise.
Frequently asked questions
What is Global Privacy Control and do we have to honor it?
It is a preference a browser or extension sends on the visitor's behalf, saying they do not want their data sold or shared. Several states treat a signal like this as a valid opt-out. Whether it reaches your business is a determination for your counsel, but the engineering is straightforward, and a site that reads it is in a better position than one that never looked.
Can we just apply the strictest rule to everyone?
Yes, and for many businesses that is sensible. It removes a whole category of conditional logic and the testing around it. The cost is measurement: you lose analytics and attribution in states where you might not have had to. Our job is to show what that costs in your own data before you decide.
Why does a data inventory come before design?
Because everything else depends on it, which fields the forms carry, what consent gates, where deletion requests have to reach, what the notice can truthfully say. Teams that skip it design a consent experience for a data flow they never mapped, and find the mismatch when somebody asks for their records.
Does accessibility really need to be in the components?
It is the only version that holds. Focus order, keyboard operation, labeling, contrast and error messaging are properties of a pattern rather than a page. Fix them in the button, the modal and the form field and every screen inherits the fix. Fix them page by page and the next release reintroduces them.
Our site is slow for customers in one part of the country. Why?
Usually the origin. A site served from a single data center is fast near it and slower away from it, and the country is wide enough for that to be visible rather than theoretical. Caching assets helps; rendering closer to the visitor helps more, which is worth doing depends on how dynamic your pages are.
Who decides which state rules apply to us?
Your counsel, which regimes reach your business depends on where your customers are, what you collect and how you use it, and that is a legal judgment rather than an engineering one. We build so whatever they determine can be implemented, conditional collection, honored signals, a record of what happened, instead of a rebuild each time the answer moves.
Can you work on our existing site instead of replacing it?
Often, and the inventory tells us whether it is worth it. A site with tags under management and a real component library can be brought into shape incrementally. One where every page is a one-off and tracking was added by hand over years is cheaper to rebuild than to untangle.
Services that connect to this
Talk to us about this
Tell us what you are trying to build and we will come back with scope, approach and an estimate.