CASE STUDY

Bakkt automates global privacy compliance across 22 jurisdictions.

How a NYSE-listed digital assets platform moved from a UK ICO notification to continuous, outside-in privacy monitoring, at half the cost per market.

See Your ExposureAll case studies →
BAKKT HOLDINGSfinancial services
Company size~750 employees
MarketsUS, EU, UK +8
Jurisdictions✓ 22 monitored
OutcomeScaled

The challenge.

Regulatory compliance
Privacy enforcement accelerating across 12 US states, the UK, and the EU, with 20+ more states in development.
International expansion
Seven new markets, each with distinct rules. Internal per-market legal estimate: $200K+.
Audit reporting
NYDFS, SEC, and the board expected auditable, ongoing documentation, not a one-time snapshot.

In December 2023, a UK ICO notification flagged tracking technologies firing before consent: a UK GDPR and PECR violation.

The solution: an outside-in review across 22 jurisdictions.

Tracking Technology Review
A full audit of Bakkt’s tracking infrastructure: cookies and tags firing before or without consent across the UK, Connecticut, and Utah. Remediated within days.
International Expansion Reviews
Automated regulatory assessments for seven markets (LGPD, PIPL, APP, PDPA & more): consent models, policy-practice alignment, and prioritized gaps.
Ongoing Monitoring & Reporting
Continuous, auditable dashboards by geography, regulation, and status, structured to meet NYDFS and SEC documentation standards.

Privaini’s assessment drew on 100+ data sources across privacy, corporate, regulatory, and security signals.

By the numbers.

From incident-response compliance to continuous, proactive monitoring across every market Bakkt operates in.

22
Jurisdictions monitored
50%
Cost reduction per market ($100K saved)
Days
To remediate the UK ICO findings
100+
Data sources in the assessment
“

Privaini was indispensable for Bakkt, highlighting gaps in our privacy program and providing actionable insights to ensure our global expansion was compliant. It was our compass for navigating the complex landscape of international privacy laws.

Kevin Morgan · Privacy & Risk, Bakkt
FULL CASE STUDY · PDF
Bakkt automates global privacy compliance across 22 jurisdictions
The complete Bakkt story: the UK ICO trigger, the 22-jurisdiction rollout, and continuous outside-in monitoring at half the cost per market.
Download the case study ↓Download the case study ↓

Your exposure is already visible.
See it before they do.

From your domain name to findings in 30 minutes.

See Your ExposureMore case studies

No generic alerts · No installation · Domain name only · Results in 30 min

Opt-Out Signal Honored