Cookies Are Sweet, but Fines Aren't: Get Consent Before It Costs You
Your banner says "we respect your choice". Your trackers might not.
4 minutes read
A visitor lands on your website.
Within seconds, analytics starts measuring. Ad pixels start collecting.
One question nobody asked: did they actually say yes?
1. Know your trackers
Analytics tools, ad pixels, plugins and embeds all bring their own trackers, often without anyone noticing.
Scan your site regularly. List every tracker, its purpose and the vendor behind it.
2. Make consent real
A banner alone isn't compliance.
A giant "Accept All", a hidden "Reject" and trackers firing before anyone clicks: the banner is visible, but the choice isn't real.
Real consent means:
- clear information on what's collected and why
- "Accept" and "Reject" equally easy to find
- choices people can change or withdraw anytime
- non-essential trackers off until the visitor says yes
3. Know the laws
- GDPR (EU): generally requires prior consent for non-essential cookies.
- CCPA/CPRA (California): gives users the right to opt out of the sale or sharing of their data.
- DPDP Act (India): sets notice and consent obligations, with key provisions scheduled for May 2027.
One banner doesn't automatically satisfy all three.
4. What's at stake
Maximum penalties for certain violations:
- GDPR: up to €20 million or 4% of global annual turnover
- CCPA/CPRA: civil penalties, depending on the violation
- DPDP Act: up to ₹250 crore
These are ceilings, not automatic fines. But the trust you lose has no ceiling.
5. Keep it running
Websites change every week. New pixels, new plugins, new risks.
Monitor trackers, test that choices are enforced, and keep your privacy notice matching what your site really does.
ConsentCenter makes this automatic: continuous scanning, real-time blocking, region-aware banners for GDPR, CCPA and DPDP, and a timestamped record of every choice.
Common mistakes to avoid
- Treating a visible cookie banner as proof of compliance.
- Hiding "Reject" or letting non-essential trackers run before consent where prior consent is required.
- Assuming one banner automatically satisfies GDPR, CCPA and DPDP.
- Adding pixels and plugins without checking whether visitor choices are still enforced.
The bottom line
The question isn't whether your website shows a banner.
It's whether it respects the choice.
