Have you researched CIPA lawsuits lately?
People are getting sued because of Google Analytics, Facebook / Meta tracking pixels, etc.
If you’ve looked into CIPA compliance, then what about GDPR and CCPA compliance?
If you install one of the highly rated cookie banners, is that good enough to cover all laws and regulations? Is your cookie banner WCAG 2.1 AA conformant when it’s installed on your website?
Simply, privacy and tracking is a problem:
- It’s technically complex
- It’s legally complex
- It’s confusing
- It’s time-consuming
And you can buy a plugin with 5-star reviews and you still won’t know if you’ve done everything you need to.
Let’s unwrap this disaster.
Innocent Starting Questions
- Do I need one for GDPR or CCPA or both?
- What about CIPA? What is CIPA?
- Should our privacy choices be opt-in or opt-out?
- Does the banner need to look different for visitors in Europe than for visitors in California?
- What is Global Privacy Control and does my site have to respond to it?
- What counts as a “sale” of data?
- Is Google Analytics a cookie? Is a tracking pixel a cookie?
- What about session replay tools and live chat widgets?
- Do we need to update our privacy policy too?
- What is a consent management platform, and is that different from a cookie banner?
Now every one of these questions has an answer.
The problem is that the answers depend on where your visitors are, what technology is on your site, how your tags are set up, and which of a multitude of overlapping laws and regulations applies to each visitor.
The software that says, “Press big red button for 100% compliance” is not available and from there you’re off to slash through the Amazon jungle with a butter knife as your machete.
Laws Aren’t the Same
Part of the problem is this isn’t just about complying with one law and dusting off your hands. You’re trying to be compliant with every single privacy law and regulation at once and they’re not the same.
Sure, there’s a lot of overlap, but some have more or different requirements than others.
- GDPR (Europe) and the UK equivalent generally require opt-in consent before non-essential cookies and trackers load. Nothing fires until the visitor says yes.
- CCPA/CPRA (California) works the other way. Tracking can generally happen, but the visitor has the right to opt out of the sale or sharing of their data, and your site has to honor that. It also has to respond to the Global Privacy Control browser signal automatically, whether or not the visitor ever clicks anything.
- CIPA (California Invasion of Privacy Act) is not a cookie law at all. It is a decades-old wiretapping statute that plaintiffs’ lawyers are now using against websites over tracking pixels, session replay scripts, and chat tools. Demand letters and complaints galore are coming from this ancient law.
- Other state privacy laws (Colorado, Connecticut, Virginia, Texas, Oregon, and more), each with slightly different thresholds and requirements.
So a single banner has to behave one way for a visitor in Germany, another way for a visitor in California, and another way for a visitor in Texas. And it has to actually control what loads on the page, not just display a message.
Banner Day Research
What’s your hourly rate?
I ask because once you start trying to find the right plugin, app, toolbar, etc., you’re going to have spent thousands of dollars of your time.
OneTrust. Usercentrics. Cookiebot. Osano. Consentmo. CookieYes. Termly. Termageddon. Iubenda. Complianz. There are dozens more.
Next, search Google. Most articles are written by the vendors themselves or by affiliates. You look at pricing tables that charge by pageview, by domain, by “sessions,” or by tiers with names that tell you nothing. You look at feature lists full of terms like “consent logging,” “auto-blocking,” “IAB TCF 2.2,” and “Google Consent Mode v2” and you have no way of knowing which of those you actually need.
Then go to Reddit and G2 (maybe even TrustPilot if you’re a gambler) and see if the real (maybe) user reviews help you.
And, then, when you finally select one, you breach into territory that none of the comparison articles answer:
How do you know it actually works?
Not “does it display a banner.” Does it actually:
- Stop your analytics, your ad pixels, your embedded videos, and your chat widget from loading until the visitor consents?
- Honor the opt-out when someone clicks “reject”?
- Respond to Global Privacy Control?
- Play nicely with Google Tag Manager, which has its own consent settings that need to be configured to match?
- Still work after your marketing team installs a new app next month?
Those questions mean having a cookie banner successfully show up on your website is worth next to nothing.
Sued with a Banner
This is the part most website owners do not realize until they’ve been sued or, worse, have enforcement action taken against them by authorities.
Having a cookie banner installed is not the same as being compliant. Lawsuits and enforcement actions regularly target sites that already had a banner in place. The banner was there. The tracking still fired.
Mistakes and omissions were made:
- Tags load before the visitor makes a choice, so the banner is decorative.
- The visitor clicks “reject” and the site keeps tracking anyway because the CMP was never connected to the tags.
- Google Tag Manager is configured independently of the banner and never receives the consent signal.
- A third-party app (a review widget, a chat tool, a popup builder) injects its own scripts outside of the CMP’s control.
- The site ignores the Global Privacy Control signal, which California treats as a valid opt-out request.
- Opting out takes more clicks than opting in, which California regulators have treated as a violation on its own.
California’s enforcement history includes a $1.2 million settlement with Sephora in 2022 for, among other issues, failing to honor Global Privacy Control opt-out signals. In 2025, the California Privacy Protection Agency fined Honda for a consent flow that made opting out harder than opting in. Both companies had privacy tooling. It was not set up correctly.
Meanwhile, CIPA demand letters and lawsuits are being sent to businesses of every size, many of them with a banner already on the site. The banner is not the defense. The behavior of the site is.
What the Reviews Say About the Tools
We read through current reviews of the major consent platforms on sites like G2 and Trustpilot. The complaints repeat.
- Setup is complicated. Reviewers of Usercentrics and OneTrust describe difficult initial configuration, a steep learning curve, and documentation that assumes technical knowledge. Teams without dedicated implementation help struggle.
- The scanner finds things, and then you are on your own. Osano reviewers describe confusing cookie classification and not enough guidance on how to categorize what the scanner turns up. The tool tells you a script exists. It does not tell you what it is, what category it belongs in, or what to do about it.
- Support is inconsistent. Some reviewers praise support. Others describe waiting days, or as long as a week, to hear back. Recent complaints about OneTrust include a reviewer whose consent tool was not working on their site and who could not get technical help to fix it.
- Cost escalates. Osano reviewers mention expense, particularly for high-traffic sites. OneTrust reviewers note the cost is hard to justify for organizations that only need a fraction of the platform. Professional implementation services are often a separate line item on top of the software.
- Too much product. OneTrust in particular is an enterprise privacy suite: data mapping, assessments, DSAR handling, vendor risk, governance. That breadth is valuable for a large privacy team. For a business that just wants its website set up correctly, it is a lot of interface, training, and configuration standing between you and a working banner.
The Support Problem
The lack of support is where frustration really starts to boil over.
You bought the latest and greatest tool. Something is not working. Maybe the banner is not blocking a script. Maybe it conflicts with another popup. Maybe Google Consent Mode is not receiving the signal.
You ask for help.
Here is what that experience often looks like, based on reviews and on our own direct experience with Consentmo on a Shopify site:
- Live chat may exist, but it is not obvious, and you may not discover it for months.
- Support is by email. A reply can take a day. Sometimes two.
- The reply is often a link to documentation you have already read.
- The documentation explains what the product does. It does not do the implementation for you.
- Complicated questions get bounced back to “your developer.”
- If you do not have a developer, you either become one or you hire one, which is a second vendor and a second bill.
The pattern is consistent: support explains the product. It does not take responsibility for the result on your site. The hard part, the actual technical work of making the banner control what loads on your pages, is left up to you.
Accessibility Too
And just when you thought you graduated from Cookie Banner Hell University, there’s one more item on your checklist: don’t forget that your banner may not be accessible out of the box, and may not stay accessible once it’s installed on your website.
A cookie banner is a user interface element on every page of your site. It is often the very first thing a visitor encounters. If it is not accessible, your site isn’t WCAG 2.1 AA (or 2.2) conformant.
Buying a plugin does not take care of this. Even a plugin that publishes an Accessibility Conformance Report (ACR) does not guarantee an accessible consent experience on your site. Here is why:
- An ACR describes the vendor’s product under the vendor’s conditions. It does not describe how the banner behaves after it is installed on your theme, with your fonts, your colors, and your other plugins.
- The banner and the preferences window are two separate interfaces. Both have to work with a keyboard, both have to manage focus correctly, and both have to be announced properly by screen readers.
- Consent banners routinely collide with other popups: newsletter signups, chat widgets, promotional overlays. A keyboard user can get trapped between them.
- Customization (which almost everyone does) can break the accessibility the vendor tested for. Change the button styling, hide the reject option in a smaller link, or reposition the banner, and the conformance claim no longer applies.
Accessibility needs to be tested on the finished site, with the real theme and the real third-party apps in place. That step almost never happens.
Buyer’s Research vs. Reality
As you’re finding out, there is no tropical island destination for cookie banners and etc. Here’s a more realistic outlook on what’s actually happening once you’ve wrapped up with your research.
| What You Think You Are Buying | What You Actually End Up Doing | What Accessible.org Provides |
|---|---|---|
| A banner that makes you compliant | Figuring out which laws apply to which visitors and configuring region-specific behavior | Configured for GDPR, CCPA/CPRA, CIPA, and other state laws as part of setup |
| Automatic script blocking | Connecting the CMP to Google Tag Manager, Consent Mode, and every third-party app that injects scripts | Implemented and verified on your actual site |
| A scanner that finds your cookies | Interpreting the scan, researching unknown scripts, and categorizing each one | Classification and configuration done for you |
| Opt-outs that are honored | Testing whether “reject” actually stops tracking and whether GPC signals are respected | Tested manually, including opt-out and GPC behavior |
| Support | Waiting days for an email that links to documentation, then hiring a developer | Scheduled hands-on implementation and testing with a real person |
| An accessible banner (it has an ACR) | Hoping the banner is still accessible after installation and customization | Keyboard, screen reader, and focus testing on the finished site, with fixes where needed |
| A one-time setup | Re-checking everything each time a new app or tag is added | Retesting after implementation and clear guidance on what changes matter |
Accessible.org Labs
We are consolidating all of the above into one product and one complementary service.
Of course, we’d love to just release a website privacy SaaS product and call it a year, but we can’t do that because it’s incomplete.
Website owners need the manual service work too. The service means the job is complete.
We’ll eventually have a knowledgebase with step-by-step instructions and video tutorials if you only want the app, but, as you can clearly see by now, the manual testing component is critical.
The product is an app we are releasing on October 15, 2026 for Shopify, WordPress, and custom-coded websites. It is being designed around one principle: take away the confusion. Clear options instead of a wall of settings. A standard, repeatable setup instead of an enterprise configuration project. Pricing that a smaller business can afford, with more complex sites paying for the additional work they actually require, not for enterprise-level complexity they do not need.
The service is the manual side, and it is what makes the difference. When you sign up, we schedule implementation with you and get to work right away. We do not hand you documentation and wish you luck. We:
- Implement the banner and preferences window on your site
- Connect it to Google Tag Manager, Consent Mode, and your existing tracking
- Classify what the scanner finds
- Test that consent choices and opt-outs are actually honored, including the Global Privacy Control signal
- Test the consent experience for accessibility: keyboard, screen reader, focus, and interaction with other popups and apps
- Fix what needs fixing
- Retest
You get a person, on a schedule, who actually tests installation and functionality. Not an AI chatbot. Not a ticket queue. Not a two-day email reply. Not a link to a help article.
As simple as possible. Genuine service. Manual testing. Accessible.
If you want to be notified when the app is available, or you want to talk about services for your site now, contact us. We’d love to help.
