Cookie & Consent Compliance

A Cookie Banner Isn't Compliance.

Regulators stopped asking whether you have a banner. They're checking whether it actually stops the tags. We audit what fires, fix your consent setup, and keep your ad data flowing while you play by the rules.

Run the Free Consent Check See Review Tiers

2-minute quiz · instant grade + fixes · no call required

Consent Replay · Sample Scan

example-store.com

Consent Grade

52 / 100

Exposure: High

Meta Pixel fired before consent

CRITICAL

GPC signal ignored by ad tags

CRITICAL

"Reject all" hidden behind settings

MAJOR

Consent Mode v2 defaults missing

MAJOR

Cloudflare bot cookie (necessary)

PASS

Recent Fouls

US states with comprehensive privacy laws in effect in 2026

$2.75M

Largest CCPA settlement to date: opt-outs that didn't carry through (Feb 2026)

€325M

CNIL fine against Google over cookie consent (Sept 2025)

Google Consent Mode version required for personalized ads in the EEA and UK

Sources: MultiState, California AG / Consenteo, TrustArc, Google Ads policy. Summary only, not legal advice.

Flags on the Field

The Six Calls We Make Most

Most sites we review have a banner. Almost none of them have a banner that works end to end. These are the flags that show up again and again.

Flag 01 · Early Start

Tags Fire Before Anyone Clicks

Meta, Google Ads and analytics load on page one, before the visitor says yes. In opt-in regions that's the violation, banner or not.

Flag 02 · Uneven Field

"Reject" Is Harder Than "Accept"

A big Accept button and a Reject buried two clicks deep. EU regulators treat that as a dark pattern and fine it.

Flag 03 · Missed Signal

Global Privacy Control Ignored

California and a growing list of states treat the browser's GPC signal as an opt-out. Most setups detect it and keep firing anyway.

Flag 04 · Stops at the Browser

Opt-Outs Never Reach the CRM

The cookie is blocked, but the email list, ad audiences and server-side events keep sharing. That exact gap drove the largest CCPA settlement.

Flag 05 · Lost Yardage

Consent Mode v2 Missing

Without it, Google can't model conversions for people who decline, and EEA/UK remarketing shuts off. Compliance and ad performance run through the same setup.

Flag 06 · Wrong Rulebook

The Policy Doesn't Match the Site

A template privacy policy listing none of the vendors actually on the page, last updated years ago. CCPA expects a yearly refresh.

Know the Rulebook

GDPR vs. CCPA vs. Everyone Else

Different leagues, different rules. The short version of what each one expects from your site.

GDPR + ePrivacy (EU/UK)

CCPA / CPRA (California)

Other US State Laws

Consent model

Opt-in. Nothing non-essential loads until the visitor agrees.

Opt-out. Tracking may run, but visitors must be able to stop sale and sharing.

Mostly opt-out for targeted ads and sales; opt-in for sensitive data.

The banner

Required. Reject as easy as Accept on the first layer; choices by purpose.

Not required by name. A "Do Not Sell or Share" or "Your Privacy Choices" link is.

Not required by name. A clear opt-out method is.

Browser signals

Choices must be recorded and provable.

GPC must be honored as a valid opt-out.

A growing number of states require universal opt-out signals like GPC.

Who enforces

National data protection authorities.

California Privacy Protection Agency and Attorney General; wiretap suits from private plaintiffs.

State attorneys general; cure periods are expiring.

Penalty ceiling

Up to 4% of global annual turnover.

Per-violation fines, adjusted for inflation.

Per-violation fines, typically up to $7,500–$10,000.

Plain-language summary, not legal advice. Which laws apply depends on your traffic, revenue and data. Your Cookie & Consent Audit includes a jurisdiction map for your business.

Free · Consent Check

What You Think Is True vs. What Your Site Actually Does

Confirm your email, answer 12 quick questions, and get an instant grade with the fix for every flag. When you want proof of what your site actually fires, before and after consent and with GPC on, that's the Cookie & Consent Audit.

Start the Free Consent Check

The Quiz

Your banner, tags, opt-out links, policy and consent records. Instant grade, exposure level, and which rulebooks likely apply to you.

The Flags

Every flag ranked critical, major or minor, with the fix for each. Want proof of what actually fires and a full cookie register? That's the Cookie & Consent Audit.

Cookie & Consent Audit

Pick Your Review

A hands-on audit by a 14+ year marketing and analytics veteran, not a robot report. Every tier ends with a flag list, the fix for each, and a written plan.

Spot Check

$999

1 domain · up to 10 key pages · US or EU/UK

Multi-page cookie and tag scan
Full cookie register by vendor and purpose
Pre-consent firing and GPC tests
Banner check against the rules that apply
Flag list with a fix for every flag

Start Spot Check

Full Review

Most Chosen

$2,499

1 domain · full site · US + EU/UK

Everything in Spot Check, site-wide
Tag-by-tag consent audit in Google Tag Manager
Consent Mode v2 verification
Opt-out test through CRM, email and ad audiences
Privacy policy vs. reality gap list
Jurisdiction map and 3-phase roadmap
45-minute walkthrough call

Start Full Review

Multi-Property

$4,500

Up to 3 domains or regions

Full Review on each property
Server-side and conversion API consent check
Cross-property opt-out test
Vendor and data-flow map for your counsel

Start Multi-Property

Consent Setup

from $2,500

We pick and configure your CMP, style the banner to your brand, wire consent into every tag, turn on Consent Mode v2 and GPC, add the footer opt-out link, and rescan to prove it works.

Consent Monitoring

from $299/mo

Monthly rescans, alerts when a new tag or cookie shows up, small CMP changes, and a quarterly note on rule changes. Run by our partner agency, Forward Slash Marketing.

How the Game Runs

From First Whistle to Final Call

Free Consent Check

Free grade and fixes. No call needed.

Scoping Call

We scope the review. You're invoiced after the call, not before.

The Review

You grant read access. We never ask for passwords.

Setup

We fix what we flagged, then rescan to prove it.

Watch

New tags get caught before a regulator does.

FAQ

Questions We Get

Is this legal advice?

No. We're the marketing and tracking side: we find what your site does, fix the setup, and hand your counsel a clean vendor list and data map. Policy wording and legal calls stay with your lawyer.

We're US-only. Do we even need a banner?

Not by name in most states. You do need a working opt-out for targeted ads, a footer link, and GPC support in states that require it. A banner and CMP is usually the simplest way to deliver all three.

Will blocking tags wreck our ad data?

Done badly, yes. Done right, Consent Mode v2 and server-side tagging recover modeled conversions for people who decline. Protecting ad performance is half the reason to hire a marketer for this.

Which consent platform should we use?

It depends on your stack, regions and budget. Plans range from a few dollars a month to enterprise contracts. We recommend one in the review and configure it in Setup, or work with the one you already pay for.

How long does a review take?

Average of 5-10 business days from access.