Having a banner was never the requirement.

The rule that put banners on every European site is short. Storing information on a visitor's device, or reading what is already there, needs the visitor's consent — and once the visitor refuses, the storing and the reading have to stop. The banner is how a site asks. It is not what the rule is about. The rule is about what the site does next.

• S-2, Art. 5(3)

Consent has conditions. It has to be freely given, specific, informed and unambiguous, and the site has to be able to demonstrate it. A pre-ticked box is not a choice. Withdrawing consent has to be as easy as giving it. Refusing should be as easy as accepting — the French regulator said it plainly, and issued orders on it. The same expectations reach beyond cookies: pixels, local storage, session-replay scripts are all inside the rule's technical scope.

• S-1, Art. 4(11), Art. 7(1)
• S-5, CJEU Planet49, C-673/17
• S-1, Art. 7(3)
• S-6
• S-3, EDPB Guidelines 2/2023

The site's operator does. Under the accountability principle the controller is responsible for the processing and must be able to demonstrate it. Embedding a third party's tool on your own pages does not hand that responsibility to the third party: the Court of Justice has held that a site operator whose page causes the visitor's browser to send data to an embedded provider is a controller for that collection and transmission. The vendors say as much themselves: their public terms typically provide the software "as is" and leave meeting the legal requirements with the customer — one leading vendor's terms put it as "the Customer is solely responsible for checking whether the … services meet the legal requirements that apply to the Customer". A consent tool is something you run, not a duty you transfer. None of this makes consent tools bad — most sites need one. It makes them unverified. Researchers who measured sites with consent tools installed found the gap: one study, which collected 680 consent pop-up designs, those of the five most widely used consent tools on the top ten thousand UK sites, found that "only 11.8% meet the minimal requirements" the authors set from European law; another, testing 560 sites using the IAB's consent framework, found 141 that "register positive consent even if the user has not made their choice" and 27 that "store a positive consent even if the user has explicitly opted out". Those are the authors' criteria and counts, not legal findings — and they are exactly the divergence a scan records. A banner working as intended is an assumption until someone looks at the traffic.

• S-1, Art. 5(2), Art. 24
• S-333, CJEU Fashion ID, C-40/17
• S-337
• S-335, Nouwens et al., CHI 2020
• S-336, Matte et al., IEEE S&P 2020

Regulators publish what they act on. The French CNIL's summary of its 2025 activity groups its tracker-related decisions into three categories, in its own words: storage without the user's consent; insufficient information; and failure to effectively take into account the user's refusal or withdrawal of consent.

• S-334, CNIL, 2025 tracker-sanction summary

In the United States, the California regulations require businesses to honour an opt-out preference signal such as Global Privacy Control as a valid request to opt out of sale or sharing, and the state Attorney General's office publishes its enforcement activity on the subject. The scan reads whether a page honours that signal too.

• S-8, Cal. Code Regs. tit. 11 § 7025
• S-9

In Brazil, the data protection authority's cookie guidance says consent is free only when the visitor has a real choice — "the effective possibility of accepting or refusing the use of cookies" — and recommends a clearly visible button to reject all non-necessary cookies on the first layer. The scan's regional emulation covers Brazil too.

• S-330, ANPD, Guia Orientativo — Cookies, 2022, pp. 17–18, 30

Consent behaviour is not set once. It changes through routes nobody signs off on: a tag-manager edit, a new marketing pixel, a vendor SDK update, a banner version bump, an A/B test that forgot the reject branch. "Verified once" decays. A scan records what the site did on the day it ran.

Get a record of what the site does today, before any choice and after each one. Fix what the record shows, while the only people who have seen it are you and your team. Re-scan to see the change. Come back to it: the next tag change is coming. The first step is free.