Two founders run a web studio in Bristol. Six years in, about forty client sites — Shopify stores, WordPress brochure sites, a couple of booking systems for local clinics. The kind of agency where the founders do everything.
The question that changed their year arrived by email, from a wine-bar client renewing her site maintenance plan: "A place down the road got a complaint about their mailing list and had to deal with the ICO. Are we OK on cookies and all that? You handle our website, right?"
One of them says their first instinct was the one every agency owner will recognise: answer narrowly, change the subject. "We host the site and keep the plugins updated" is true, and it's also a dodge — because both of them knew that "all that" was nobody's job. Not theirs, not the client's. Forty sites' worth of nobody's job.
The fear that keeps agencies out of privacy
They'd talked about offering privacy work before and always backed off, for two reasons that will sound familiar.
"We're not lawyers." Cookie banners, consent, data subject requests — it smelled like legal advice, and legal advice smelled like professional-indemnity claims. The safe move seemed to be staying out of it entirely.
"We can't scale opinions." Even if they upskilled, a manual privacy review of forty sites meant weeks of unbillable reading, producing forty PDFs that would be out of date by the next regulation change. There was no product in it — just hours.
So the question sat there. Meanwhile their clients were being asked about privacy by their customers, and the honest answer across the portfolio was a shrug.
The scan that turned an opinion into evidence
What changed the economics wasn't a course or a hire. It was a free tool. They ran the wine bar's site through Dxtra's privacy scan — enter the domain, wait a minute, no account — mostly expecting a marketing gimmick.
What came back didn't read like a gimmick. It read like an inspection report: the site's live cookie and tracker behaviour, the privacy notice (what US audiences call a privacy policy) checked against what the site actually does, findings across thirteen capability areas marked as evidenced, gapped, or — where the public surface can't show it — honestly not assessed, and an overall risk band — low, medium, high — plus a capability maturity score. Every finding cited. The methodology is public, anchored to recognised frameworks, which mattered to them for a specific reason:
"I could defend it. That changed the whole calculation. I'm not standing in front of a client saying in my legal opinion. I'm showing them what their own site does, measured against a published, open methodology. I'm the person who found it and can fix it — not the person guaranteeing the law."
That distinction — evidence, not opinion — is what dissolves the professional-indemnity fear. The agency isn't selling legal advice. It's selling detection, remediation, and ongoing operation. The escalation path for hard legal questions still points to a lawyer; almost nothing in the day-to-day ever needs one.
From one scan to a product
They ran the scan on five more client sites that afternoon. Four came back with the same cluster of findings — trackers firing before consent, notices that didn't match reality, no visible way for a customer to ask what data was held. Which meant they weren't looking at forty bespoke problems. They were looking at one repeatable service.
Here's the shape it took:
1. The scan became the conversation. Instead of pitching "privacy services" in the abstract, they sent each client their own scan report. The wine bar's report did the selling on its own — the client saw her site, her trackers, her gaps. No scare tactics required; the risk band and the citations did the work.
2. Dxtra became the fix. Each client site got a Dxtra plan — from £7 ($10) a month — which generated and now maintains the privacy notice, runs consent management (a consent banner plus live order logging for the Shopify stores), handles data subject requests, keeps the processing records, and publishes each client's own Transparency Center on their subdomain. Setup on the first site took a day, most of which they spent being suspicious of it. By the fifth it was just a couple of hours.
3. The agency wrapped it in a maintenance plan. "Privacy care" joined hosting and maintenance on the menu: onboarding and remediation up front, then a monthly retainer covering monitoring, quarterly rescans with a client-facing summary, and handling anything that comes in — a DSR, a question, a wobble after a news story. They price it the way Dxtra's partner economics anticipate: the platform is the £7 ($10) ingredient, the service sells for five to ten times that, and the margin lives in the setup, the reviews, and being the person who answers.
50% of the clients signed in the first quarter — mostly the e-commerce stores and the clinics, the ones who feel data risk. That's a new recurring line that didn't exist at Christmas, from clients they already had, without a single cold email.
What it changed with clients
The revenue is the headline, but the founders keep coming back to something softer: the agency's posture changed. "For six years, when privacy came up we got smaller. Now it's the part of the QBR where we look best. We open the Transparency Center, show them the consent receipts, show them the rescan trend. Clients bring us the scary LinkedIn post about some new regulation, and we get to show them exactly where they stand, with the evidence on screen."
The wine-bar client, incidentally, forwarded her scan summary to the place down the road. They became a new client.
If you're the agency in this story
The pattern generalises well past web studios — accountants, bookkeepers, MSPs, and marketing agencies are running the same play, and it's the same three steps:
1. Scan your own site first. dxtra.ai/scan — free, no account, under a minute. You'll want to have fixed your own findings before you show a client theirs.
2. Scan three clients you know well. Send each their report with two sentences of your own. Watch what comes back.
3. Pick your partner lane. Dxtra's partner program runs from simple referral, to reseller on your margin at pricing you set, to full managed service. Start where your capacity is; move up when the retainers stack.
Every plan includes the same capabilities, from $10/month with a 14-day money-back guarantee on the START plan — and your clients' customers get a Transparency Center that makes your work visible every day, not just at renewal.
Sources
Current as of 5 August 2026. Pricing, partner terms and scan behaviour move; check the linked source before you rely on any of them.
- Dxtra privacy scan — free, no account, risk band in under a minute
- Scan methodology — the open methodology, anchored to the NIST Privacy Framework, ISO/IEC 27701 and ENISA guidance
- Dxtra pricing — plans from $10/month; 14-day money-back guarantee on the START plan
- Dxtra product tour — the Shopify consent banner and live order logging, end to end
- Dxtra partner program — the partner models (Referral / Reseller / Managed Service) and the 5–10× economics
- ICO — make a complaint — the complaint route UK customers actually use, as in the story's opening
The studio in this story is a composite drawn from real agency conversations. This article is general information, not legal advice. Rules change; confirm anything that matters with the ICO or a qualified adviser before you rely on it.
Ready for a new line on the invoice?
The next recurring revenue line after hosting and maintenance is sitting in your client list, waiting for someone to run a scan. Explore the partner program or take the product tour to see what your clients would get.