Website privacy compliance comes down to four things: know exactly what tracking runs on your site, obtain valid consent where the law requires it, make sure opt-outs actually stop tracking, and keep evidence that proves all of it. A cookie banner alone accomplishes none of the four until it is correctly implemented, accessible, and tested.
| Key Point | What It Means for You |
|---|---|
| Know your tracking | Every cookie, pixel, session replay tool, and chat widget on your site must be identified before you can control it. |
| Valid consent | Where opt-in rules apply, non-essential tracking must be blocked until the visitor agrees. |
| Honored opt-outs | Reject and opt-out choices must actually stop tracking, not just close the banner. |
| Accessible implementation | The consent interface must conform to WCAG 2.1 AA so every visitor can operate it. |
| Preserved evidence | Recorded verification testing proves your consent choices work as claimed. |
What counts as tracking on a website?
Tracking is any technology that observes or records visitor behavior. Cookies are only the most familiar form. Most websites also track visitors through:
- Advertising and analytics pixels, including the Meta Pixel and Google tags
- Session replay tools that record scrolling, clicks, and keystrokes
- Chat widgets that capture conversations and metadata
- Browser storage and scripts that identify visitors without setting a conventional cookie
Automated scanners recognize known cookies. They routinely miss custom scripts, storage-based tracking, and tags loaded through other tags. That gap is why manual review matters, and it is where most compliance problems hide.
Which privacy laws apply to your website?
Four sets of requirements cover most websites. Each works differently, and each has its own page with the full detail.
GDPR: opt-in consent for EU and UK visitors
The GDPR requires opt-in consent before non-essential tracking fires for visitors in the EU and UK. Consent must be specific, informed, and as easy to refuse as to give.
- Block non-essential tracking until the visitor agrees
- Offer granular choices by purpose, with no pre-ticked boxes
- Make withdrawal as easy as acceptance, and keep consent records
Full requirements: GDPR cookie consent.
CIPA: California’s wiretap statute, applied to websites
The California Invasion of Privacy Act is a 1967 wiretap law now used against websites over pixels, session replay, and chat widgets. It carries statutory damages of $5,000 per violation and drives an active demand-letter economy.
- Tracking that fires before consent is the core allegation
- Session replay, chat, and advertising pixels are the common targets
- Opt-in blocking for California visitors is the defensive posture
Full requirements: CIPA compliance.
CCPA: California’s opt-out model
The California Consumer Privacy Act gives California residents the right to opt out of the sale and sharing of personal information. It is a notice-and-opt-out model, not an opt-in model, and it is actively enforced by a dedicated regulator.
- Provide a Do Not Sell or Share mechanism
- Honor Global Privacy Control signals automatically
- Keep your privacy policy accurate about the tracking in use
Full requirements: CCPA compliance.
The cookie banner: where every requirement meets the visitor
All three laws are experienced through one interface. The banner must block what it claims to block, and it must be usable by every visitor, including people using keyboards and screen readers.
- Function: tracking prevented from loading until the visitor chooses
- Accessibility: conformance with WCAG 2.1 AA and WCAG 2.2 AA
- Honesty: the banner does what its own text says it does
Full requirements: cookie banner accessibility and implementation.
What makes consent valid?
Valid consent is freely given, specific, informed, and unambiguous. It also has a requirement that most consent tools overlook: the visitor must be able to operate the interface at all.
A visitor who navigates by keyboard cannot agree or refuse through a banner that traps focus or hides its buttons from tab order. A screen reader user cannot make an informed choice through a dialog that is never announced. Consent collected through an interface a disabled visitor cannot operate is not meaningful consent, and it fails on both accessibility and privacy grounds at once. This is why WCAG conformance is not a nice-to-have layered on top of compliance. It is part of what makes the consent itself real.
Why installing a cookie banner is not compliance
A banner is a user interface. Whether tracking actually stops is a separate technical question, and the two disagree more often than most site owners expect. Common failure points include:
- Scripts hardcoded into the page that never receive the consent signal
- Consent signals treated as blocking when the underlying tags still load
- Tags that load other tags the consent tool never identified
- Tracking that fires in the moments before the consent tool initializes
Enforcement reflects this. In one CCPA action, the California Privacy Protection Agency penalized American Honda $632,500, and the agency’s order specifically examined how Honda’s cookie consent tool was configured. Having a consent tool installed did not prevent the penalty. Correct configuration and verification are what count.
How do you prove your site is compliant?
Proof means evidence created before anyone asks for it. That includes recorded verification testing showing what loads before consent and after rejection, dated reports identifying the exact banner version and configuration tested, and consent records for the choices visitors make. If a demand letter or regulator inquiry arrives, documented testing is the difference between a defensible position and a settlement decision.
What are your options for getting compliant?
The app
Our consent app is available for Shopify, for WordPress, and as a general script for all other sites. It blocks non-essential tracking until the visitor chooses, honors rejection and withdrawal, and its banner and preference center are built to conform with WCAG 2.1 AA and WCAG 2.2 AA: fully keyboard navigable, announced correctly to screen readers, with visible focus and adequate contrast.
The services
We also do the work for you: implementation on your site, verification testing that confirms tracking genuinely stops on opt-out, accessibility testing of the banner as it actually renders in your theme, recorded evidence of both preserved for your records, privacy policy language documenting what you have done, and guidance for maintaining compliance as your site changes.
Frequently asked questions
Does a cookie banner stop tracking by itself?
No. A banner is an interface. Tracking stops only when the implementation blocks scripts until consent and honors rejection, which is exactly what verification testing confirms.
Do I need consent if my visitors are all in the United States?
Often yes. CIPA claims target tracking that fires before any consent, and CCPA requires a working opt-out. US-only traffic reduces GDPR exposure, not California exposure.
What makes a cookie banner accessible?
Keyboard operability end to end, screen reader announcement, managed focus, sufficient contrast, and adequate target sizes, measured against WCAG 2.1 AA and WCAG 2.2 AA. The details are on our cookie banner page.
Can I be sued even with a banner installed?
Yes. Demand letters and lawsuits regularly involve sites with banners in place, because the banner did not block the tracking it described. Testing and preserved evidence are the response to that risk.
Where to start
- Inventory the tracking on your site, including pixels, session replay, and chat widgets
- Determine which of GDPR, CIPA, and CCPA apply to your traffic
- Implement consent that blocks tracking until the visitor chooses
- Confirm the banner conforms to WCAG 2.1 AA as rendered on your site
- Verify with testing that rejection actually stops tracking, and preserve the evidence
