What does valid cookie consent legally require in the EU and UK?
The rule comes from ePrivacy Article 5(3) (PECR regulation 6 in the UK): storing or accessing information on a user's device requires informed consent unless strictly necessary for a service the user requested, and since the GDPR, 'consent' carries the Article 4(11)/Article 7 standard: freely given, specific, informed, unambiguous, by clear affirmative action, withdrawable as easily as given. Cashed out by regulators (CNIL's guidelines, the ICO's, the EDPB's cookie-banner taskforce report): prior consent, no non-essential cookies before the choice, which excludes cookie walls in most readings and definitely excludes fire-then-ask; affirmative action, scrolling, browsing on, or pre-ticked boxes do not count (the CJEU's Planet49 judgment settled pre-ticked boxes); equal prominence, refusing must be as easy as accepting, a first-layer 'Reject All' alongside 'Accept All,' the specific asymmetry behind CNIL's 150M/60M EUR Google and Facebook fines; granularity, consent by purpose (analytics, advertising, personalization) with per-purpose choice at least in the second layer; informed, who sets what, for which purposes, with what lifetimes, including third parties identified; no bundling with terms acceptance; and revocability, a persistent, findable mechanism (footer link or icon) to change choices later, with withdrawal actually stopping the processing. Strictly-necessary exemptions stay narrow: session security, load balancing, consent storage itself, shopping-cart state; analytics is not exempt in most member states (CNIL tolerates narrowly configured audience measurement under conditions), and advertising never is.
What are the most common implementation failures, and how do regulators find them?
The failure taxonomy, in observed frequency order. Tags fire before consent: the CMP renders a banner but Google Analytics, Meta Pixel, and adtech tags load on page-load anyway, either because tags are hard-coded rather than routed through the tag manager, or the tag manager fires on page-view without consent conditions; this is the single most cited defect in sweep enforcement, and it is detectable in sixty seconds with browser dev tools, no legal analysis required. Reject is buried: no first-layer reject, or a 'manage options' maze against a bright accept button, the dark-pattern asymmetry CNIL fined and the EDPB taskforce flagged. Consent ignored on subsequent loads: choices stored but not read, so returning visitors get tracked regardless. Third-party leakage: consent conditions cover the tag manager, but hard-coded scripts, embedded videos, social widgets, and chat tools set cookies outside it. Pre-consent data flows: the pixel 'loads but doesn't track' argument fails when network inspection shows requests carrying identifiers before choice. Category miscoding: advertising cookies labeled 'functional' so they fire under a category users did not consent to. Withdrawal that does nothing: the preference center updates but tags keep firing and cookies persist. Regulators find all of this the way anyone can: automated crawls (CNIL runs them at scale, as do NOYB's complaint campaigns, which filed hundreds of banner complaints), dev-tools inspection during complaint handling, and increasingly the same commercial scanners companies could have run themselves. The defense is symmetric: scan your own site, from a clean profile, before and after each release, and treat pre-consent network requests to tracking domains as a failing build.
How should consent-conditioned tag firing actually be engineered?
The architecture has four layers. Consent capture: a CMP (commercial or self-built) renders the banner, records the choice per purpose with a timestamp, banner version, and choice detail (the consent record your accountability obligations require), and exposes the current consent state to the page, via a data layer, the IAB TCF API where the adtech ecosystem requires it, or Google Consent Mode signals. Tag governance: every tag routes through a tag manager with consent-based triggers, each tag mapped to exactly one purpose category, firing only when that category's consent is granted; Google Consent Mode v2 (mandatory for Google advertising features in the EEA since March 2024) needs the CMP to send ad_storage, ad_user_data, ad_personalization, and analytics_storage states, with tags respecting them. Inventory discipline: a living register of every cookie and tracking technology, owner, purpose, category, duration, kept honest by scheduled automated scans that diff discovered trackers against the register, because marketing teams add pixels and the register rots in weeks without enforcement; new-tag additions should require category assignment as a deployment gate. Verification: CI or scheduled checks from a consentless profile asserting zero requests to non-essential tracking domains pre-choice, correct behavior after reject (nothing fires), after partial consent (only consented categories), and after withdrawal (firing stops, and reasonably promptly, cookies are cleaned up). Server-side tagging deserves a flag: moving tags server-side does not relax consent duties, it just moves the enforcement point where scanners cannot see it, so the consent state must gate server-side dispatch too, and your records must show it does. SPA routing is the classic regression: consent checked on first load, ignored on client-side navigation.
How do US state opt-out regimes change the implementation?
The US model inverts the default: processing may begin, but consumers get rights to opt out of sale, sharing (CCPA's term for cross-context behavioral advertising), and targeted advertising, so the implementation problem shifts from gating tags pre-consent to honoring opt-outs completely. Requirements that bite: a 'Do Not Sell or Share My Personal Information' mechanism (link or equivalent) in California, with the alternative of the Global Privacy Control, California (regulations and the Sephora settlement, $1.2 million, the landmark on both GPC and cookie-mediated 'sales'), Colorado (mandatory universal-opt-out honoring since July 2024, with an approved-mechanism list), Connecticut, Texas, and a growing majority of state laws require honoring browser-level opt-out signals automatically, meaning your stack must read the GPC header/JavaScript property and translate it into the same tag suppression a manual opt-out triggers; sensitive-data consent, several states (and CCPA's limit-use right) impose opt-in or limitation for sensitive categories, pulling geolocation and health-adjacent trackers into consent territory even in the US; and recognizing that adtech pixels are 'sales/shares,' the consistent enforcement position since Sephora, so an opt-out that stops email marketing but leaves Meta and Google pixels firing is a violation. Practical architecture for multi-jurisdiction sites: geolocation-based rule sets in the CMP, consent-first (opt-in) banners for EEA/UK/CH and other consent jurisdictions (Quebec's off-by-default tracking rule, Brazil, Korea), opt-out with GPC honoring for US states, with one shared tag-governance layer so both regimes drive the same firing logic, and consent/opt-out records kept per regime; the anti-pattern is running the EU banner worldwide but wiring GPC nowhere, which fails the US requirements while annoying everyone else.
What should a cookie-consent audit check, and how often?
A competent audit walks the stack from the outside in. Behavioral: from a clean, consentless browser profile (and from EU/UK/California egress points if geo-rules differ), record all network requests and cookies pre-choice, after accept-all, after reject-all, after each partial combination that matters, and after withdrawal; assert no non-essential tracking pre-choice and post-reject, and verify SPA navigations and iframes inherit the state. Banner UX: first-layer reject parity, no pre-ticked boxes, no consent nagging on every page-load after refusal (regulators read re-prompting frequency as pressure), purpose descriptions that match what actually fires, third parties enumerated, and the withdrawal path reachable in two clicks from any page. Records: consent receipts retrievable per user or per pseudonymous ID with timestamp and banner version; when a regulator asks 'prove this user consented to advertising cookies on this date,' this is the artifact. Inventory: scanner-discovered trackers reconciled against the register and the banner's disclosure, with every unclassified discovery treated as a defect. Signals: GPC honored on US-targeted properties; Consent Mode states correctly propagated if Google tags run. Governance: who approves new tags, what the deployment gate is, when the last scan ran. Cadence: automated scans at least monthly and on every marketing-stack release, with the full manual audit annually and after CMP migrations, the events that historically break everything. The uncomfortable audit truth: most organizations that 'implemented a CMP' two years ago and stopped watching are non-compliant today through tag drift alone, which is exactly what the regulators' crawlers are built to find.