Your Cookie Banner Is Lying: Consent Gaps That Invite GDPR Fines

The banner is theater; the network tab is the truth

Cookie consent has a credibility problem, and regulators have noticed. The banner is the part everyone sees and argues about, the wording, the buttons, the dark-pattern "Accept all" that glows while "Reject" hides in gray. But the banner is just a UI. What actually matters legally is what the page does: which cookies and trackers fire, and when, relative to the user's consent. And on a huge number of sites, the answer is "everything, immediately, before consent", which makes the banner a misrepresentation of what is happening underneath it.

This is not a paperwork technicality. Under GDPR and the ePrivacy Directive, non-essential cookies, analytics, advertising, fingerprinting, require prior, freely given, specific, informed consent. "Prior" is the operative word. A tracker that fires on page load has already processed the user's data before they consented, and the banner that appears afterward is closing a door the page already walked through. Per Consenteo's 2026 analysis of GDPR cookie consent, this prior-consent requirement is the exact line enforcement keeps landing on, again and again.

The enforcement is real, large, and accelerating

For years, pre-consent tracking was a known issue that nobody paid for. That era is over. Per Bird & Bird's analysis of recent CNIL enforcement, France's data protection authority has made cookie compliance a sustained priority, and the 2025 numbers are eye-watering: the CNIL issued 83 sanctions totaling approximately €486.8M, with cookie and advertising-tracker violations accounting for the bulk.

The individual cases name the exact mechanics, which is what makes them useful as a checklist. Per reporting on the CNIL's record fines, the regulator fined Shein's Irish subsidiary €150M after inspectors found advertising cookies landing on visitor devices the moment they arrived on the site, before any interaction with the banner, and found that clicking "Reject all" did not actually prevent new cookies, while previously deposited cookies kept being read even after consent was withdrawn. Google was hit with €325M combined for cookie-consent manipulation and related violations. American Express was fined €1.5M for the same pattern: cookies dropped before the user could interact with the banner. These are not edge cases; they are the most common cookie implementation on the web, finally being priced.

And it is not only France. Data protection authorities across the EU coordinate on cookie sweeps, and the ePrivacy framework applies in every member state. A French fine establishes a pattern other regulators follow, and because the violation is on your public website, anyone, a regulator, a competitor, a privacy NGO, an activist, can document it in thirty seconds with browser dev tools and file a complaint.

Why the gap exists even when you "have a CMP"

The frustrating part for engineering teams is that this happens even on sites that have invested in a proper consent management platform. The banner is configured, the categories are defined, the "Reject all" button is present, and trackers still fire before consent. The reasons are mundane and technical, and they are exactly the kind of thing that passes a visual QA and fails a network audit.

Tags hardcoded outside the CMP

A developer adds an analytics or pixel snippet directly to the page template, bypassing the tag manager entirely. The CMP has no idea it exists, cannot gate it, and it fires on load regardless of what the banner says. This is the single most common cause, because adding a snippet to a template feels like a one-line change, not a compliance decision.

Tag manager misconfiguration

The tag manager is supposed to hold tags until a consent signal arrives, but a trigger is set to "page view" instead of "consent granted, " or a tag was added without a consent condition. The CMP and the tag manager are not actually wired together correctly, so tags fire on schedule. Consent Mode and similar integrations help, but only if every tag is actually routed through them.

The "Reject" button that only hides the banner

Some implementations treat "Reject all" as merely dismissing the UI without actually suppressing the non-essential tags, exactly the Shein finding. The user thinks they declined; the trackers run anyway. This is the most legally damaging failure because it turns a passive oversight into something a regulator can characterize as deceptive.

Persisted cookies and third-party chains

Cookies set on a prior visit keep being read, or a consented third-party script loads its own further trackers that the CMP never categorized. The chain leaks past the consent gate, and the deeper third parties are exactly the ones no one inventoried.

The only honest test: read the wire, not the banner

You cannot audit consent compliance by looking at the banner, and you cannot trust the CMP's own dashboard, because the failures are precisely the cases the CMP does not know about. The only reliable method is to load the page in a clean browser, record every cookie and network request before any interaction, then compare that against what is legally allowed pre-consent (essentially: strictly necessary cookies only).

// Headless audit: capture cookies/trackers fired BEFORE any consent
const browser = await playwright.chromium.launch();
const ctx = await browser.newContext();   // fresh, no prior consent
const page = await ctx.newPage();

const networkHits = [];
page.on('request', (r) => networkHits.push(new URL(r.url()).hostname));

await page.goto('https://example.com', {waitUntil: 'networkidle'});
// DO NOT click the banner, this is the pre-consent state

const cookies = await ctx.cookies();
const nonEssential = cookies.filter((c) =>
  /_ga|_fbp|_gcl|doubleclick|_hj|ad_|tracking|_tt|_pin/i.test(c.name));

const trackerHosts = networkHits.filter((h) =>
  /google-analytics|doubleclick|facebook|hotjar|tiktok|criteo|pinterest/i.test(h));

if (nonEssential.length || trackerHosts.length) {
  console.error('PRE-CONSENT VIOLATION:');
  console.error('  Cookies:', nonEssential.map((c) => c.name));
  console.error('  Trackers:', [...new Set(trackerHosts)]);
}

Then run the second test that the Shein case demands: click "Reject all" and confirm that no new non-essential cookies appear and no previously set ones keep being read. And run a third: grant consent, then withdraw it, and confirm tracking actually stops. A banner that passes the visual audit and fails any of these network audits is the exact configuration that has been drawing eight-figure fines.

// Second test: does "Reject all" actually reject?
await page.click('text=Reject all');
await page.reload({waitUntil: 'networkidle'});
const afterReject = await ctx.cookies();
const leaked = afterReject.filter((c) => /_ga|_fbp|doubleclick/i.test(c.name));
if (leaked.length) console.error('REJECT DID NOTHING:', leaked.map(c => c.name));

The fix is wiring, not lawyering

Once the scan tells you which trackers leak past the gate, the remediation is technical, not legal. Route every non-essential tag through the CMP with a consent condition, no exceptions, no hardcoded snippets in the template. Configure the tag manager to fire on a "consent granted" signal, not page view. Make "Reject all" genuinely suppress and clear non-essential cookies, and make withdrawal actually stop the tags it consented. Inventory the third-party scripts that load further trackers and categorize them. And re-scan, because the most common way this breaks is a marketer adding a pixel directly to a page next quarter, silently reopening the gap you just closed.

The ePrivacy landscape is not going to rescue you here. The long-promised ePrivacy Regulation that might have simplified things was withdrawn from the Commission's 2025 work programme, so the current framework, the ePrivacy Directive interpreted through national law, plus GDPR's consent standard, is what governs, and what enforcers are using. Per Matomo's analysis of the CNIL's enforcement wave, the trajectory is toward more scrutiny, not less, and the fines are scaling with company revenue. Waiting for clearer rules is not a strategy; the rules are clear enough to have generated €486.8M in one country in one year.

The bottom line

Your cookie banner is only as honest as the network traffic behind it, and on a great many sites the traffic tells a different story than the banner, non-essential cookies and trackers firing before consent, and "Reject all" buttons that do not actually reject. That gap is now the primary cookie-enforcement target, with the CNIL alone issuing roughly €486.8M in 2025 sanctions, including €150M against Shein for exactly this pattern. The failure is invisible from the front end and obvious on the wire, which is why the only valid audit loads the page clean, records what fires before any interaction, and tests whether refusal and withdrawal actually work. Find the trackers that leak past your consent gate, route them all through a correctly wired CMP, and re-scan after every marketing change, because the next hardcoded pixel reopens the door.