I’m sure I’m not the only one who’s had this experience…
I visit a website and get a cookie banner popping up at the bottom. It asks me whether I want to accept or reject cookies. I click Reject All with confidence that my preferences are going to be honored.
And then… the site tracks me anyway! I know this because I start getting ads that I wouldn’t be getting if that lying jerk of a website had honored my opt-out preferences!
This is what I less-than-fondly refer to as cookie banner theater. It’s performative only. I’m invited to make a choice, the interface politely thanks me for my decision, and then just completely ignores it and gaslights me into believing I’m just overreacting or somehow it didn’t ignore my choices and I’m instead going slowly insane.
If you’re a privacy professional, this is frustrating. If you’re an executive at a site that isn’t honoring cookie preferences, it’s risk. Cookie preferences are part of what we call “visible compliance” and regulators often make the assumption that if you’re publicly-facing compliance is running smoothly, the back end won’t be either! And, perhaps even most importantly, if you’re a customer or website user, it’s not only incredibly frustrating, it’s also a betrayal of trust wrapped in a smooth UX lie. And customer trust is foundational for a lot of companies.
Why This Happens Even at Mature Organizations
This mismatch, albeit frustrating for all (see above), isn’t usually malicious. It’s an operational issue.
Cookie a tracking implementation sits at the intersection of marketing, engineering, product, vendors, and third-party scripts. Even well-intentioned teams end up with tracking behavior that is true in one place and false in another.
What are some common causes you ask although you in your gut already know the answer?
Tags firing before the consent signal loads
A tag manager configured to “always on” because it wasn’t actually mapped correctly
A vendor’s SDK collecting data by default unless explicitly disabled
Multiple consent systems (e.g., CMP, app SDK preferences, internal feature flags) that don’t align — and this one happens a lot!
Teams assuming that posting the cookie notice = tracking is handled
Site changes rolled out quickly without updating the inventory... “We just added a chat widget!”
In reality, it’s really tough to govern what you can’t see, and tracking technologies are designed to be invisible. But, luckily, I’m here to chat abut some practical workflows you can implement as part of your standard QA process to double-check your cookie preferences and implement whenever you have a trigger (e.g., new feature deployed, new vendor connection, etc.).
Your cookie notice might be perfectly tailored, your cookie inventory lovingly maintained, and your CMP (that’s cookie management platform for the newly initiated) enterprise-grade, but at the end of the day, the real question is simple: When a user says “no,” does your site behave like “no”?
It might seem like a scary question, but luckily, you don’t even need a full audit to get to an answer. You just need a short, repeatable “reality check” you can run whenever you update your website, you add a new vendor or SDK, marketing deploys a new tag, yo change your CMP configuration, you receive a complaint, or you want to validate your disclosure before you update your privacy notice.
That’s what the tool below is for.
It Goes Beyond Compliance
Even if enforcement and standards shift over time, the stakes don’t just go away. Tracking mismatches create multi-dimensional operational risk, including:
customer trust erosion (“what you want doesn’t matter”)
contract risk (e.g., partner requirements, ad tech disclosures, enterprise commitments)
security risks from unvetted tags
The organizations that get this right aren’t just “more compliant.” They have customer trust, run cleaner, and are harder to surprise.
Become a paid subscriber to get access to all of the mini tools that we publish with each post. For instance, this post includes a 10-Minute Tracking Reality Check to implement immdiately!
Finally, reminder that the opinions expressed in this article are the opinion of The Privacy Design Lab. They are not legal advice, and no attorney-client relationship is formed by reading this article or downloading the 30-Minute Privacy Tabletop Exercise. If you need to consult legal counsel, you can book a consult with ARLA Strategies or other legal counsel you trust!
If you’re tired of privacy advice that only works in theory, you’re in the right place.
The Privacy Design Lab exists for people who want to practice privacy, not just talk about it. It focuses on practical, repeatable ways teams actually learn. We offer hands-on workshops, downloadable systems, and a Privacy Design Lab Studio community where teams and practitioners can go deeper. Paid newsletter subscribers get access all the micro tools.
If that sounds like your kind of work, we’d love to have you.