Catching consent and disclosure drift before it becomes complaints, regulator questions, or avoidable trust damage.
The EDPB Cookie Banner Taskforce confirmed that when users reject cookies, all third-party tracking must stop immediately (EDPB Report, 2023-2024). Sweden's data authority ruled in March 2025 that even making the "accept" button more visually prominent than "refuse" violates compliance rules. If your trackers persist after rejection, you're not just non-compliant — you're creating audit evidence against yourself.
Open guideCNIL fined Google €150M in 2021 for making cookie rejection harder than acceptance, then escalated to a €325M fine in September 2025 for inserting ads without valid consent (CNIL enforcement records). These aren't just big-company problems — the EDPB's 2024 guidelines confirm that any storage or access to information on user devices (cookies, URL tracking, pixel tracking) requires prior consent. Every unconsented tracker impression is a violation.
Open guideGDPR classifies browser fingerprinting as personal data processing requiring prior consent, and session replay tools that capture form data or personal information require explicit, informed consent (GDPR Article 4). Non-compliance carries fines up to €20M or 4% of global annual revenue, whichever is higher (GDPR Article 83). These are the highest-risk trackers regulators look for because they're inherently invasive.
Open guideThe California Privacy Protection Agency fined Tractor Supply $1.35M in September 2025 — the largest CCPA fine to date — because their "Do Not Sell" link routed to a form that didn't actually stop data selling (CPPA Final Order). Disney paid $2.75M for similar non-compliance. CCPA fines are $2,663 per negligent violation and $7,988 per intentional violation (adjusted 2024 rates).
Open guideThe EDPB requires that cookie banners include an equally conspicuous "Reject All" button on the first layer — making rejection as easy as acceptance (EDPB Cookie Banner Taskforce Report, 2023). CNIL fined Google €150M specifically because acceptance required one click while rejection required five. Both French and Spanish authorities treat a missing reject button as a violation.
Open guideThe FTC fined Avast $16.5M in 2024 specifically because their privacy policy claimed data was "pseudonymised and anonymised" while they actually shared granular, non-aggregated browsing data with subsidiary Jumpshot (FTC, 2024). Regulators now routinely audit whether privacy policy claims match runtime behaviour. Scavo checks this by comparing your declared tracking practices against what actually loads on your pages.
Open guideThe FTC fined Avast $16.5M in 2024 for collecting and selling browsing data that contradicted their privacy policy promises (FTC enforcement action). Privacy policies and terms must be easily discoverable — not just present, but findable. Most legal frameworks (GDPR, CCPA, FTC Act) require clear, accessible disclosure. A footer link is the minimum standard.
Open guidePrivacy compliance problems are usually behavior problems first. Policies matter, but what the browser actually does is what users, regulators, and auditors eventually compare.
The difficult part of privacy work is not usually writing the notice. It is making sure the banner, tag manager, analytics setup, replay tools, opt-out path, and published disclosures all line up with what the site is actually doing in production. That is why these guides are built around observed behavior, not legal theory in the abstract.
This category is meant to help teams understand the operational side of consent and disclosure: which scripts fire too early, whether reject paths really hold, whether California choice signals are visible, and whether privacy and cookie statements still match the vendor stack the browser can see.
Runtime drift is where privacy risk accumulates. The banner may look compliant while optional trackers still fire before consent or after rejection.
Users judge trust from the live experience, not the policy PDF. Easy-to-find notices and real reject parity matter operationally as well as legally.
Implementing a banner visually but letting tag-manager defaults or embedded scripts run before the consent decision is applied.
Making reject and opt-out options harder to find than accept, or leaving no obvious way to revisit choices later.
Consent-interface behavior so accept, reject, and manage-preferences choices are visible and usable.
Pre-consent and post-reject tracking so optional vendors do not load before a valid choice or keep loading after a refusal.
Map the trackers and scripts by purpose first. You need to know what is essential, optional, and higher risk before you can fix the flow cleanly.
Verify the full decision path in a real browser: fresh visit, consent given, consent rejected, and settings changed later.
