On almost every website we audit, the cookie banner is the first thing that fails. Not the privacy policy, not the contact form. The banner.
The rule behind it is simple. Under the ePrivacy Directive, nothing that is not strictly necessary may be stored on or read from a visitor’s device until they agree. Analytics is not strictly necessary. Neither is the Meta pixel, or the YouTube video on the homepage. And since the CJEU’s Planet49 ruling in 2019, a box that is already ticked is not agreement. Consent is a click, and it comes first.
A Banner That Asks Too Late
Open almost any site in a private window, open the network tab and do not touch the banner. Google Analytics loads. The Meta pixel loads. Often Hotjar and LinkedIn as well. The banner is still on screen, politely asking for permission it has already ignored.
Nobody planned this. Someone set up Google Tag Manager, someone else installed a consent plugin, and the two never talked to each other. The banner is decoration. The tracking runs anyway.
Tracking Nobody Calls Tracking
The same goes for things nobody thinks of as tracking. Google Maps on the contact page. Fonts loaded from Google’s servers. In January 2022 a Munich court awarded a visitor 100 euros because a website sent their IP address to Google just by loading a font. A hundred euros is nothing. The wave of warning letters that followed in Germany was not.
A Reject Button Two Layers Down
Then the reject button. Accept all is big and green. Reject is a grey link two layers down under “settings”, behind a list of toggles, some already switched on as legitimate interest. That is not bad design. It is a conversion trick, and it works, which is exactly why regulators stopped tolerating it. At the end of 2021 the French CNIL fined Google 150 million euros and Facebook 60 million, because accepting took one click and refusing took several. The EDPB’s cookie banner taskforce said the same for all of Europe in 2023.
Yes, a real reject button costs you consent rate. The old number was never real anyway.
A Privacy Policy for a Different Website
And finally the privacy policy, which on most sites was written for a different website. It names the wrong company. It explains IP anonymisation in Universal Analytics, which stopped processing data in July 2023. It relies on Privacy Shield, which the CJEU struck down in 2020. It cites German law on a Croatian site. And it does not mention the chat widget, the newsletter tool or the booking plugin the site actually runs.
A privacy policy is not a template you fill in. It is a list of what the site really does with personal data. If it does not match the network tab, it is wrong.
Ten Minutes to Find, a Day to Fix
None of this takes a lawyer to find. It takes ten minutes, a private window and a banner you do not click. Fixing it is not much harder:
- A consent tool that actually blocks scripts, with every tag connected to it.
- Reject next to accept.
- Fonts hosted locally.
- Maps behind a click.
- A privacy policy written last, from what you found.
Most of the sites we see could be clean in a day. They are not, because nobody ever looked.
What It Means for You
If you are not sure what your site loads before anyone clicks, book a 20-minute call and we will look at it with you. If it is clean, we will tell you.