Cookie Banner Compliance: Why a Banner Is No Longer Enough

Coverage depends on thresholds around revenue, the volume of consumer data handled, and how much revenue comes from selling or sharing personal information. Most businesses running paid advertising at any scale meet at least one. The trigger is collecting data from California residents, not having an office or entity there.

GPC is a browser-level signal that tells every site a visitor lands on not to track them, built into browsers such as Firefox and Brave and into privacy extensions. Honoring it means your consent setup reads the signal on arrival and applies the opt-out automatically. Waiting for the visitor to find your banner and click decline does not satisfy it.

Generally no. Most US state laws operate on notice plus a genuine opt-out rather than prior consent, which is the opposite of the GDPR model. The exceptions matter though: sensitive categories of data and anything involving minors require actual opt-in, not just a route to decline.

Because an opt-out that is too difficult to use is treated as no opt-out at all. That is where a design problem becomes a legal one. Unequal button prominence, a decline option buried several clicks deep, or preferences that reset on return all undermine the mechanism the law actually requires you to provide.

Long enough to evidence the decisions a regulator asks about, which in practice means keeping them indefinitely rather than to a fixed schedule. Investigations have reached back several years, so records that only cover the recent past leave the earlier period undocumented. Each entry needs a timestamp, the choice made, and what it applied to.

The legal basis differs but the technical requirements converge. GDPR needs consent before tracking, US state laws generally need a working opt-out. Both require scripts that actually stop when someone declines, records proving what was collected and evidence you can produce on request. A site built for one is usually close to the other.

Fines have run into seven figures for single businesses, and they are not always proportional to the violation itself. Regulators have selected targets for their signaling value to an entire sector, which means a mid-sized company can receive a penalty calibrated to get an industry's attention rather than to match the scale of what it did wrong.

Quarterly, and after any change to your site or tag stack. Automated scanning runs continuously rather than in response to complaints, so a setup that passed six months ago proves nothing about today. New plugins, third-party embeds and forgotten ad pixels are the usual sources of drift between checks.