Blog

Do Not Sell or GPC: Which One California Checks First

A Do Not Sell link and a GPC signal are not two ways of doing the same thing. California treats one as a request and the other as a standing instruction, and the Disney settlement shows which one regulators test. November 14, 2026

Cleared Cookies, Fresh Banner: Why Consent Keeps Coming Back

A visitor clears cookies and the banner returns. That is not a bug. It is three separate expiry rules stacking up: the regulator's six months, the CMP library's default, and the browser's own cap. November 14, 2026

The Consent Record Is the Product: What a Regulator Actually Asks For

A banner is not proof. When a regulator opens a file, it wants the record: who was asked, what they chose, when, and what happened to the data after. November 13, 2026

Consent Withdrawal Has to Work Everywhere, Not Just on the Homepage

A shopper withdraws consent on the homepage and keeps getting tracked on checkout, in email, and in ads. Withdrawal that stops at one page was never withdrawal. November 13, 2026

Consent on the Checkout Page: The Tracking That Starts Before the Order Exists

The banner works on the homepage. The checkout loads analytics, a payment fraud score, and a session recorder before the visitor has bought anything, and nobody gated any of it. November 11, 2026

The Chat Widget That Fingerprints Before Hello: Consent for Support Tools

The support chat on your site loads before the visitor types a word. It sets cookies, builds a fingerprint, and sends the page URL to a third party, all before anyone says hello. November 11, 2026

Consent on the Login Page: The Tracking That Starts Before the Visitor Is a Customer

The banner works on the homepage. The login page loads analytics, a chat widget, and a fingerprinting script before the visitor has an account, and nobody gated any of it. November 10, 2026

The Consent Default That Fires Before the Banner: What Happens When Your CMP Tag Loads Late

Your consent platform loads after the analytics tag. In that gap, tags run on their own defaults, and the default is to fire. November 10, 2026

After the Withdrawal Click: What Has to Stop, and Who Has to Hear About It

A visitor withdraws consent and your banner records it. The hard part starts after that click: stopping the processing, telling the vendors, and proving you did both. November 9, 2026

The Quarterly Consent Audit: Five Checks That Catch a Broken Banner Before a Regulator Does

Banners break quietly. A tag slips past the gate, a vendor list updates without a re-prompt, a GPC signal goes unread. Five checks, run every quarter, catch all of it. November 9, 2026

What a Consent Record Has to Contain to Hold Up

A consent record is evidence, not a log line. Five fields decide whether it proves anything: who, when, what, how, and what happened when the person changed their mind. November 8, 2026

The Footer Opt-Out Link Still Matters, Even With a Banner

The banner is the EU habit; the footer link is the California mechanism. What the Do Not Sell link has to say, why GPC has to agree with it, and three checks to run this week. November 8, 2026

What a Consent Record Has to Contain to Hold Up

A consent record is evidence, not a log line. Five fields decide whether it proves anything: who, when, what, how, and what happened when the person changed their mind. November 8, 2026

The Footer Opt-Out Link Still Matters, Even With a Banner

The banner is the EU habit; the footer link is the California mechanism. What the Do Not Sell link has to say, why GPC has to agree with it, and three checks to run this week. November 8, 2026

Consent Mode v2: Basic or Advanced, and What the Choice Costs You

Basic mode blocks Google tags until consent. Advanced mode sends cookieless pings and models the rest. The difference is measured in recovered conversions, and in a privacy position you have to defend. November 6, 2026

When Your CMP Vendor List Changes, Who Has to Re-Consent?

A vendor joins or leaves your consent platform and the consent string changes underneath you. The question is whether the yes you already collected still counts. November 7, 2026

A/B Testing a Consent Banner Without Breaking Your Consent Records

A banner test changes what visitors see, and that changes what they consented to. Run the test wrong and half your consent records describe a banner that no longer exists. November 7, 2026

TCF v2.4 Is Past Its Deadline. Check What Your CMP Actually Sends

TCF v2.4 became mandatory for web CMPs in October 2026. Legacy v2.2 strings stopped working in February, and the fix is a check of what your CMP sends, not a banner redesign. November 6, 2026

The GPC Signal Is Not a Banner Setting. Test It Like a Request.

A visitor with Global Privacy Control turned on has already opted out of sale and sharing. If your site treats that as a banner preference, the request is sitting unanswered. November 5, 2026

Withdrawing Consent Should Take One Click. Count Yours.

GDPR Article 7(3) says withdrawing consent must be as easy as giving it. Most sites fail that test by a factor of five, and the fix is a counter, not a redesign. November 5, 2026

Email Tracking Pixels Are a Consent Problem, Not a Privacy Footnote

An open-tracking pixel in a marketing email is data collection about a named person: when they opened, where, and on what device. Why consent and notice have to cover it, and what to test in your own sends. November 4, 2026

What a Consent Audit Finds Inside the Tag Manager

The banner gets audited. The tag manager is where consent programmes actually fail: tags firing before consent, triggers copied between containers, and vendors nobody remembers adding. November 4, 2026

When Purposes Change, Consent Has to Be Asked Again

Adding a new analytics vendor or a new advertising use is not a privacy notice edit. It is a new purpose, and consent collected for the old purposes does not stretch to cover it. November 3, 2026

The Consent Record Export Test Every Team Should Run Once a Quarter

Consent records only matter when someone asks for them: a data subject, an auditor, a regulator. If producing one person's record takes a vendor ticket and three days, the record keeping has already failed. November 3, 2026

Dark Pattern Consent Banners: The Designs Regulators Name in Complaints

Some banner designs get named in enforcement complaints word for word: the greyed out reject link, the double negative toggle, the accept button that follows the scroll. What those patterns are and how to audit your own banner for them. November 2, 2026

Honoring Global Privacy Control: Testing Whether Your Site Actually Stops the Sale

Sending a Global Privacy Control signal is easy for a browser. Proving your site received it, recorded it, and stopped the sharing it covers is the part most teams have never tested end to end. November 2, 2026

Consent Receipts: The Six Fields That Make a Yes Provable Later

A consent record that only stores a timestamp and the word yes will not survive a complaint two years later. The fields a receipt actually needs, and the ones teams forget. November 1, 2026

Withdrawing Consent Should Cost the Same Clicks as Giving It: Run the Parity Test

Accept takes one tap. Withdrawal takes a settings maze, a login, and a support ticket. That gap is the finding regulators keep citing, and it is measurable in clicks. November 1, 2026

Consent for AI Chatbots: What a Chat Notice Has to Say Before Anyone Types

A chatbot box is not a blank prompt. It collects text, files, and account data, and it may feed training. What the notice before the first message needs to cover, in plain order. October 31, 2026

Age Gates and Children's Data: Where a Birthday Box Stops Being Consent

Asking for a date of birth is not an age assurance system, and a parent's tick box is not verified consent. How age gates fail, and what services aimed at mixed audiences actually have to do. October 31, 2026

Audit-Ready Consent Records: The Fields a Regulator Actually Asks For

When a regulator or a platform partner audits your consent program, they do not read your banner. They read your records. The fields that satisfy an audit, and the gaps that fail one. October 30, 2026

Privacy Notice Version Control: Why Editing in Place Breaks Your Proof

Rewriting the live privacy notice quietly orphans every consent gathered under the old text. How versioning, changelogs, and effective dates keep notices and consent records linked. October 30, 2026

Global Privacy Control in Mobile Apps: The Signal Most Teams Forget

GPC enforcement started on websites, but regulators treat the signal as technology neutral. How the opt out signal reaches native apps, and what honoring it actually requires. October 29, 2026

Data Processing Addendums for Small Vendors: The Consent Clauses That Do the Work

Big vendors hand you their DPA. Small vendors sign yours, if you have one. The clauses that matter for consent data: sub processors, deletion timelines, and breach notice windows. October 29, 2026

Consent in Connected Cars: What Drivers Agree to Share

Connected cars collect location, driving habits, and cabin data under driver consent buried in setup screens. What that consent covers, where it falls short, and the checks owners and fleets should run. October 28, 2026

Consent Receipts: What a Good One Should Contain

A consent receipt is the record a person gets when they agree to data use. What a useful receipt contains, why most confirmations fail as receipts, and how teams should issue them. October 28, 2026

Consent for School Apps: What Parents Agree to and What Schools Should Check

School apps collect student data under parent consent given in a hurry at term start. What that consent covers, where it falls short, and the checks schools should run. October 27, 2026

Consent and Workplace Monitoring: What Employee Notices Must Actually Say

Employers monitor systems for security and management, but vague handbook clauses do not inform anyone. What a proper monitoring notice covers and when consent is the wrong basis. October 27, 2026

Consent in Connected Cars: Location Data, Passengers, and Shared Vehicles

A connected car collects location, voice, and driving data on everyone who rides in it, not just the owner who tapped agree at setup. How car data consent works, and the settings every owner and regular passenger should know. October 26, 2026

Consent Records in a Business Sale: What Buyers Check and Sellers Should Prepare

When a business is sold, its marketing lists and consent records become a due diligence item. What acquirers look for, the gaps that cut valuations or kill email programmes, and how to prepare records that survive the handover. October 26, 2026

Consent and Voice Assistants in Shared Homes: Who Agreed to What

A voice assistant in a shared home records guests, children, and housemates who never saw a setup screen. How voice data consent works in practice, which settings to review, and how households can set fair ground rules. October 25, 2026

Consent Receipts: What They Are and What They Actually Prove

A consent receipt is a record given to the person who agreed, not just a log kept by the company. What a useful receipt contains, where the idea falls short, and how to ask for one. October 25, 2026

Consent and Smart TV Viewing Data: What Your Television Collects

Smart TVs track what you watch, when, and for how long, often through automatic content recognition. What consent covers viewing data, what settings actually stop it, and what a household should check. October 24, 2026

Consent Records Retention: How Long to Keep Proof of Consent

Keeping consent records forever is as risky as deleting them too soon. How to set a retention schedule for consent proof, what triggers deletion, and how legal holds change the picture. October 24, 2026

Consent and Offline Data Onboarding: Matching Store Records to Online Profiles

Shops upload till records and loyalty lists to ad platforms to find customers online. What consent covers that matching, what it misses, and how opt outs must travel with the data. October 23, 2026

Consent in Weather Apps: Location Sharing That Goes Far Beyond the Forecast

Weather apps need a location to work, then often share it with data partners. How location consent should be scoped, timed, and withdrawn in apps people open every day. October 23, 2026

Consent and Voice Assistants: Choices for Always Listening Devices

Smart speakers collect voice data in shared rooms, often from people who never agreed to anything. How consent, guest handling, and deletion should work for voice assistants. October 22, 2026

Consent in Connected Cars: Driver Data, Passengers, and Second Owners

Connected cars stream location, driving, and cabin data. Who consents when a car has several drivers, passengers, renters, and a next owner. October 22, 2026

Consent in Connected TV Apps: Choices on the Big Screen

TV apps collect viewing data through SDKs most viewers never see. How to present a real choice on a remote control interface and store the receipt. October 21, 2026

How Long to Keep Consent Records: A Practical Retention Schedule

Consent receipts cannot be kept forever or deleted early. A retention schedule tied to the life of the account, the data, and local limitation periods. October 21, 2026

Consent in Mobile Apps: Getting SDK Signals Right

App consent fails quietly when SDKs start before the choice is recorded. How to gate third party SDKs, store the receipt, and keep web and app choices in sync. October 20, 2026

Consent Audit Trails: Exporting Records a Regulator Can Actually Read

When a complaint lands, a database dump is not an audit trail. What a usable consent export contains, how to format it, and the gaps that make exports fail review. October 20, 2026

Consent Renewal Prompts: When to Re-Ask and When to Leave People Alone

Re-asking too often trains visitors to click without reading, and never re-asking leaves stale records. The triggers that justify a renewal prompt and the ones that do not. October 19, 2026

Consent for Embedded Checkout and Payment Iframes

Payment iframes, booking widgets, and embedded checkouts load third party code inside your most sensitive pages. What consent covers, what it cannot cover, and how to audit the boundary. October 19, 2026

Consent Receipts: What Proof of Consent You Actually Need to Keep

A banner log buried in a vendor dashboard is not a record. What a defensible consent receipt contains, where it should live, and how long to keep it after a visitor withdraws. October 18, 2026

Auditing the Banner Itself: Dark Patterns That Void the Consent You Collected

A technically perfect tag setup still fails if the banner steers people. The design patterns auditors flag, from buried reject buttons to pre-ticked categories, and how to test your own banner honestly. October 18, 2026

Consent After Checkout: The Tracking Nobody Audits on Account and Confirmation Pages

Audits stop at the checkout button, but confirmation, onboarding, and account pages run their own trackers. Why post-purchase consent is a blind spot and how to bring those pages into the same record. October 17, 2026

Consent Drift: How Quiet Site Changes Break the Banner You Audited Last Quarter

The banner passed its audit, then the site changed around it: a new tag here, a theme update there. How consent setups decay between audits and the monitoring habits that catch drift early. October 17, 2026

Consent Banners on Small Screens: When Truncated Choices Stop Being Choices

On phones, banner text gets cut, buttons stack, and the reject option slides below the fold. Why small screen consent design decides whether a recorded choice was ever really offered. October 16, 2026

Sampling Consent Records: How to Audit a Week of Choices Without Reading Every Log

Nobody can review millions of consent records by hand. A sampling method that checks records against real tag behavior, catches systematic failures, and produces evidence an auditor respects. October 16, 2026

Consent Banner Audits for Redesigns: What Breaks When a Site Relaunches

Relaunches quietly break consent banners more often than any other change. What to audit before, during, and after a redesign so tags, records, and choices survive the move. October 15, 2026

How to Handle Consent When a Visitor Uses Multiple Devices

A visitor accepts on a laptop and gets asked again on a phone. Why consent does not follow people across devices, what logged in sync can and cannot do, and how to keep the experience honest. October 15, 2026

Consent Records Retention: How Long to Keep Proof and What to Store

Keeping consent proof too briefly or too loosely both create risk. What a usable consent record contains, how long to retain it, and how to store it so it can actually be retrieved. October 14, 2026

Consent Mode Signals When a Visitor Declines: What Your Tags Should Actually Do

When a visitor declines, consent signals should change how every tag behaves. What each signal means, where sites leak data after a no, and how to test it. October 13, 2026

Reading your consent string: how to confirm vendors honor what the banner recorded

Your banner writes a consent string every time a visitor chooses. Most teams never read it back. How to decode the string, spot vendors ignoring it, and prove the signal chain works. October 12, 2026

Consent record retention: how long to keep proof of consent, and how to honor deletion requests

Regulators want proof of what each visitor chose, but keeping consent records forever creates its own liability. How to set retention schedules and handle deletion requests without breaking your audit trail. October 11, 2026

Consent banners and keyboard navigation: the accessibility gap that breaks opt-outs

A consent banner that works with a mouse but traps keyboard users is not a real choice. How to audit the tab order, focus states, and reject path of your banner.

Marketing pixel sprawl: the internal process gap that quietly breaks consent

Consent breaks most often inside the company, not in the banner code. How marketing teams add pixels without review, and the process that keeps every new tracker inside your consent records. October 9, 2026

Consent audit trails for finance teams: reconciling marketing pixels against vendor invoices

Finance sees the vendor invoices; marketing sees the pixels. A consent audit trail reconciles the two so you only pay for tracking you actually consented to run. October 8, 2026

Reject all should stay rejected: the vendor resync problem

Your banner records the rejection, but vendor list updates quietly re-enable trackers. How the resync problem works and how to test for it. October 7, 2026

Your banner ignores the global privacy signal: consent and the opt-out broadcast

The GPC signal broadcasts a user's opt-out choice to every site they visit. If your consent setup ignores it, your banner is making promises it does not keep. October 6, 2026

Consent on checkout pages: the trackers your funnel adds after the banner

Checkout and account pages load payment, fraud, and analytics scripts that were never in your consent inventory. How to find them and bring them under the banner. October 5, 2026

Consent for embedded content: the iframe, video, and form embeds that bypass your banner

Embedded YouTube videos, maps, review widgets, and third-party forms load their own trackers the moment the page renders. How to find them, block them before consent, and keep them working. October 4, 2026

Legitimate interest is not a consent shortcut: the claims that fail audits

Legitimate interest sounds like a legal shield for tracking, but regulators treat it as a claim you have to prove. The banner claims that fail, and what to write instead. October 3, 2026

The consent drift detector: how to spot when your banner stops matching your tags

Consent setups decay after launch as tags, plugins, and vendors change. A lightweight weekly detector that diffs your site's tracking behavior catches drift before an auditor does. October 2, 2026

Switching consent platforms: how to migrate without losing your consent records

Changing consent vendors is common, and losing your proof of past consent choices in the move is the classic mistake. How to export records, map categories, and cut over without creating a gap regulators can see. October 1, 2026

The quarterly consent re-check: keeping your banner honest after launch

Consent setups decay after launch as tags, plugins, and vendors change. A quarterly re-check routine that catches banner drift, orphaned trackers, and broken blocking before regulators or customers do. September 30, 2026

Consent receipts: keeping proof of what each visitor actually chose

Regulators no longer ask whether you have a banner. They ask what a specific visitor consented to, and when. Consent receipts are the evidence layer that answers that question, and most sites are not keeping them. September 29, 2026

The pre-launch consent audit: 12 checks before your new site goes live

A redesigned or rebuilt site quietly resets your consent setup. The twelve checks that catch banner misconfigurations, orphaned tags, and tracking that fires before choice, before visitors do. September 28, 2026

Dark pattern consent banners are getting fined: what the 2026 decisions punish

Regulators spent 2026 fining consent banners that nudge, hide, and exhaust visitors into clicking accept. The design tricks that drew penalties and how to audit your own banner. September 27, 2026

First-party cookies can violate consent too

First-party cookies are not automatically exempt from consent rules. How analytics, ad tech and plugins use first-party storage for tracking, and how to audit it. September 26, 2026

Your cookie banner said no, but your server sent the data anyway

Server-side tracking moves data collection off the browser and out of sight of your consent banner. How to find these backend flows, disclose them, and bring them under real consent. September 25, 2026

Your scan found trackers nobody recognizes: what now?

Mystery trackers in a scan report are normal, not evidence of a breach. How to identify them, trace them to their source, and decide whether to disclose, block, or remove them.

Shadow trackers: how new marketing tools quietly add cookies to your site

Every new marketing tool someone adds to your site usually brings its own cookies and trackers along, and most of them start firing before anyone updates the consent setup. A scan from three months ago will not catch the

Why do trackers keep firing before consent?

Trackers fire before consent because tag managers and embeds load on their own schedule, independent of the consent banner.

How do I find out what cookies my website sets?

The fastest way is a browser check: open your browser's developer tools, visit your own site, and look at the cookies set under Application or.

How often should you scan your website for cookies?

At minimum, scan after every site change that touches scripts, plugins, themes, or embeds, and on a recurring schedule even when nothing obvious.

Frequently asked questions

What does this blog cover?

Cookie consent and consent management: how banners work, what the law requires, and how to keep consent records that hold up in an audit. The posts are written for teams that run the banner, not just teams that buy one.

How long should we keep consent records?

Keep the timestamp, the choices per purpose, and the banner version for each decision, and treat six months as the working ceiling before asking again. The CNIL treats about six months as good practice, and consent-free audience measurement cookies get a 13-month maximum lifespan.

Do we need consent for analytics cookies?

Yes, in the EU. Article 5(3) of the ePrivacy Directive requires prior consent for any cookie that is not strictly necessary, and analytics cookies are not strictly necessary. The banner has to block them until the visitor agrees.

What is the first thing to check on our own banner?

Whether anything fires before consent. Load the site in a clean browser with the network tab open and the banner untouched. Anything that requests a third-party domain before a choice is made is firing without consent, whatever the policy says.