Industries · SaaS
Usually the marketing site does, and you need to be just as open about what the app behind the login loads. The answer depends on what your stack sets before anyone agrees to anything, and that’s something you can check.
Plans for growing teams
Behind the banner
The short answer
The obligation comes from storage and access on a visitor’s device, and from whether personal information is being sold or shared, whatever kind of company you are. A product-analytics SDK, a session-replay tool, a support widget and an ad pixel all put something on the device, and most SaaS marketing sites run at least three of those.
You don’t have to guess. We load your site in a real browser with no consent given and capture every cookie set by header, by HTTP-only record, or by document.cookie. Scripts, pixels and storage keys get filed separately. Then you can decide with a list in front of you.
What a SaaS stack usually sets
Analytics SDKs are the single most common source of non-essential storage on a SaaS site, and they load on the marketing pages as often as inside the app. For EU and UK visitors they’re held until consent. For US visitors they’re the category most likely to count as a “sale or share” when the vendor gets something of value out of the data.
Session replay and heatmap tools set their own identifiers and record what visitors do. They should go in the analytics category and in your disclosure, and they should be held like everything else non-essential. Your inventory should name them, and scanners that only count “cookies” often miss the storage keys entirely.
Chat and help widgets are functional for the visitor and invisible in most audits. UserGuard’s default blocking rules already name the common ones, and you can edit the rule list by adding patterns, recategorizing or removing them. First match wins, and you can read the list yourself.
The pixels on your pricing and demo pages are why a US opt-out matters to you. “Sharing” under California law covers ordinary cross-context advertising whether or not money changes hands, so a Do Not Sell or Share mechanism is usually the right call for a SaaS marketing site, alongside automatic Global Privacy Control honoring.
What it looks like in practice
A SaaS team usually runs one production domain and a docs or blog subdomain. That’s one billable site at $10 a month, and you get the full workflow: monthly scans plus manual rescans, the banner and preference center, behavior that adapts by country, consent records tied to banner version, the accessibility widget, and generated cookie policy and accessibility statement drafts.
Security reviews increasingly ask how consent is recorded. “We export a CSV tying each choice to a site, a banner version, a region, a language and a timestamp” is a better answer than a screenshot of a banner.
A crawler with no account can’t reach cookies set behind a login. You can add them manually and UserGuard labels them as manually added, so the inventory never claims evidence it doesn’t have.
The accessibility widget is a per-site toggle on the embed you already ship. Enterprise procurement asks about accessibility too, and a published statement is a better answer than an assurance.
Coverage
UserGuard is built for the US first and is ready for Europe. It runs the visitor-facing parts these regimes ask for and keeps the records that show it.
There are 19+ state laws in force in 2026, and twelve of them require universal opt-out signals, which UserGuard honors automatically.
See how → GDPR + ePrivacyNothing non-essential fires before consent, reject gets equal prominence, and you have Article 7(1) records for the audit.
See how → WCAG 2.1 AA · ADA · EAAYou get a consent banner every visitor can operate, plus accessibility tooling that doesn’t overclaim.
See how →This page is general information, not legal advice. Whether your site is in scope for any particular law depends on facts we cannot see from here. UserGuard helps you operate consent and opt-out management as part of your compliance program; configuration decisions and legal outcomes remain yours.
Start today
Create an account, add one line of code, and the first scan runs in minutes. If it isn’t right, you have thirty days to get your money back.
