Here’s the thing about cookie consent banners: just having one doesn’t make you compliant. A lot of developers and site owners add the popup, pat themselves on the back, and assume they’re good. But the popup is only half the equation.
The other half is what your scripts are doing before anyone touches that banner.
Tracking scripts — things like ad pixels, analytics, session recorders — are often baked into a website’s code in a way that makes them fire the instant a page loads. Not after someone clicks “Accept.” The moment the page opens. That means the tracking has already happened before the user even saw the question asking if they consent to it.
That’s not compliance. That’s the illusion of compliance.
The laws that require cookie banners — like GDPR in Europe and the CPRA in California — are built on the idea that consent has to happen *before* data collection, not after. Legal analysis from the University of Chicago Business Law Review makes clear that most cookie consent setups aren’t capturing “real” consent at all — and regulators are paying closer attention to this now. The FTC has also started pushing harder on disclosure and consent failures that let companies interpret a user’s silence as permission.
The fix isn’t just visual. It’s technical.
What you actually need is a Consent Management Platform (CMP) that intercepts scripts at the network level and holds them paused until a user makes a choice. Without something doing that active blocking, your scripts don’t wait for permission — they just run, because that’s what code does unless something stops it. A properly configured CMP keeps trackers frozen until there’s a real signal that the user said yes.
If your site isn’t doing that, you’ve essentially built a “No Trespassing” sign but left the door wide open.
As for what’s at stake financially: fines under GDPR can reach up to 4% of global annual revenue or €20 million, whichever is higher — and that’s for the most serious violations. (Less serious violations carry lower caps.) It’s worth noting that GDPR applies to sites that target or collect data from users in the European Union, so if your site reaches EU visitors, it’s in scope regardless of where you’re based. The CPRA in California also applies, though it currently covers businesses above certain size thresholds rather than every website. The broader point stands: the legal exposure from getting consent wrong is real and can far outpace the revenue a small site generates. That’s not hypothetical — it’s the structure of the law.
So if you’re building or managing a website with any kind of tracking, the honest checklist is: Does your CMP actually block scripts before consent? Have you tested whether pixels fire on page load before anyone interacts? And do users get a genuine, easy-to-use “Reject All” option that actually works?
If you can’t answer yes to all three, the banner is decoration.