Website privacy compliance (Amendment 13) implemented in code and forms

No. We do the technical work on the website: forms, the cookie banner, blocking tracking tools, security and connections to other systems. What the law requires of your business, which legal wording is right for the privacy policy, and whether you have to register a database or appoint an officer are settled with a lawyer or privacy consultant. We work alongside them: we prepare an exact description of what the site collects and who the vendors are, and implement their decisions. For a first check of your site you can use our free tool at /tools/amendment-13-website-checklist. If your lawyer asks for a change, it goes into the site without rebuilding everything from scratch.

Amendment 13 to the Privacy Protection Law was approved on 5 August 2024 and came into effect on 14 August 2025. Since then an online identifier counts as personal information, so measurement and advertising tools on a site are part of the picture, not only forms. Consent under the law is informed consent, and a notice next to a form should say why the details are requested and to whom they will be passed. The website is usually where data is first collected, which is why work starts there. For what applies to you, ask a lawyer. That date is the reason a policy written before it deserves a fresh check against what the site does today, rather than being assumed to be fine.

Only if it is wired correctly. Many sites show a banner while Google Analytics and other pixels load on arrival. We configure the tools in Google Tag Manager with Consent Mode, so nothing loads before consent, and the reject button is as prominent as accept. We do not stop at the configuration: we open the browser, check the Network tab for what is sent before the click and after it, and keep a screenshot. The check is repeated whenever a new tool is added to the site. If an advertising agency adds pixels on your behalf, you should know about it, because every such pixel goes on the list.

You can prepare a good draft, but you should not skip legal review if you hold a significant database. In our free cookie policy generator, at /tools/cookie-policy-generator, you enter the tools on your site and get a detailed text. In the service itself we adapt the wording to what the site really does, including the forms and the vendors, and publish it on the right pages with the right links. The final wording should be reviewed by your lawyer, especially if you hold sensitive information. The generator does not replace advice, but it saves valuable time describing the tools and leaves only the polishing to your lawyer.

We set up a dedicated email address or form and name the person who handles requests. Each request is logged with its date, the requester's identity is verified, and we show where your systems hold data about that person: the site, the CRM, the mailing tool and email. Under the regulations, access must be allowed within 30 days, so the process should be ready in advance. We build the technical route and test it with a sample request. Whether particular data is deleted or kept, for example because of legal retention duties, is decided with your adviser. If a person asks to correct a wrong detail, it is corrected everywhere it is held, not in just one place.

We start with a list: which vendor receives which data, for what purpose and where in the world it is stored. Then we connect only the fields that are needed, limit permissions by role and revoke access when a vendor or an employee leaves. An agreement with a vendor that processes data on your behalf is something you settle with your legal adviser, and we prepare the technical details for it. If vendors are outside Israel, this is stated in the privacy policy and checked against the requirements. The vendor list is updated whenever a tool is added. This way every new party that connects to the site is reviewed before it is connected rather than afterwards, and data does not spread unnoticed.