Blog

The Banner Fires Again on app.yoursite.com: Subdomain Consent, Fixed

A visitor accepts on the marketing site and gets the banner again on the app. Cookies default to the host that set them, and localStorage is scoped to one origin. The fix is one shared record on the root domain. November 14, 2026

Your Cookie Policy Page: What Regulators Expect It to Actually List

Most cookie policies list categories and call it done. Regulators expect six fields per cookie: name, provider, purpose, duration, type, and legal basis. Two of those six are the ones every policy omits. November 14, 2026

GPC Is Not a Banner Setting: What the Global Privacy Control Signal Actually Does

Global Privacy Control is a browser signal, not a banner option. When a visitor has it on, the site has to treat it as an opt-out, whether or not the banner ever appears. November 13, 2026

Server-Side Tagging Does Not Remove the Consent Question

Moving tags server-side hides them from the browser, not from the law. The consent signal still has to reach the server container, and on most setups it never does. November 13, 2026

Global Privacy Control: The Browser Signal Your Banner Cannot Ignore

A visitor arrives with Global Privacy Control turned on. The browser is telling every site it opens: do not sell or share my data. Your banner asks them to choose anyway. November 11, 2026

The Store Locator That Pings Google Before Consent: Maps Are Trackers Too

The store locator on your contact page loads a map before the visitor has consented to anything. The map sends the visitor IP address to Google, and the banner never saw it happen. November 11, 2026

Consent Mode v2 Meets Server-Side Tagging: Where the Signal Travels

The browser says the visitor declined. The server sends the purchase event anyway, because nobody told the server what the browser decided. November 10, 2026

Testing Your Cookie Banner Without Breaking the Law: What You Can A/B Test

You want to test the banner. The law wants the choice to stay real. Most of what you want to test is fine. The rest is a dark pattern with a dashboard. November 10, 2026

Consent Mode Modeling: What the Modeled Numbers Are and Are Not

Consent mode fills the gaps where visitors said no. The modeled numbers look like data, and in some ways they are. But they are not measurements, and treating them as measurements leads to bad decisions. November 9, 2026

First-Party vs Third-Party Cookies: What Your Banner Actually Controls

Visitors hear first-party and third-party and assume the banner controls both the same way. It does not. The two kinds of cookies are set by different parties, blocked by different browsers, and governed by different rules. November 9, 2026

IAB TCF v2.3: The Cutover Your CMP Has to Make

TCF v2.3 became mandatory in March 2026, and new consent strings must contain the disclosedVendors segment or they are invalid. What changed, and the ten-minute check that tells you whether your CMP cut over. November 8, 2026

Consent on Mobile Apps: The Banner Rules Change

Your website banner is sorted. Your app is a different product with different rules: a system prompt, a mobile SDK, and consent that has to be re-checked on every launch. November 8, 2026

When Your CMP Vendor Changes Subprocessors, Your Consent Records Move Too

A CMP vendor's subprocessor change moves your visitors' consent data to a new company. Your records of processing, your DPA, and your banner notice all have to catch up. November 6, 2026

Reading Your Own TCF Consent String: What the CMP Actually Stored

The consent string is the receipt for every yes on your site. Most site owners have never decoded one, so they cannot tell whether it says what they think it says. November 7, 2026

The Cookie Banner Button With No Name: An Accessibility Failure Hiding in Plain Sight

A cookie banner that a keyboard cannot operate and a screen reader cannot name is not just a bad banner. It is a consent flow that excludes the people it is supposed to protect. November 7, 2026

The Cookie Banner Keyboard Trap: Test Yours With Tab Alone

A banner that mouse users can dismiss and keyboard users cannot is a WCAG failure and, under the EAA, a consent failure too. The test takes two minutes and a private window. November 6, 2026

Consent Evidence Is a Timeline. Keep the Versions.

An auditor does not ask what your banner says today. They ask what it said on the date the data was collected, and most sites cannot answer that question. November 5, 2026

The Video Loads Before Anyone Presses Play. Use a Facade.

Many video embeds load the player and its tracking the moment the page renders. A lightweight facade that fetches the real player only after a click fixes the consent problem and the page weight at once. November 5, 2026

Single Page Apps Break Consent in a Specific Place: The Route Change

In a single page app the page never reloads, so tags that would recheck consent on navigation simply never recheck. What route changes do to consent state, and the checks SPA teams need to add. November 4, 2026

Your Banner Speaks Three Languages and Your Site Speaks One: Consent Language Matching

A banner in the wrong language is not a translation nicety. A choice a visitor could not read is a choice you will struggle to defend. How language matching should work for consent. November 4, 2026

Embedded Maps, Videos, and Widgets Set Cookies Your Banner Never Mentions

Third party embeds load on render, not on click, and many set cookies or fingerprint before any interaction. Facade patterns and consent gating are how sites stop describing one site and running another. November 3, 2026

How Long to Keep Consent Logs: Retention That Survives the Data It Covers

Delete consent logs too early and you cannot prove consent for data you still hold. Keep them forever and the log itself becomes an unmanaged data store. Retention has to be tied to the processing, not picked from a dropdown. November 3, 2026

Consent for Connected TV Apps: The Living Room Screen Nobody Audits

Smart TV and streaming apps collect viewing data under consent flows built for a remote control, often in a shared living room. Why TV consent records are weak, and what a defensible flow looks like. November 2, 2026

Reject All Parity: When the Decline Button Is Harder to Find Than Accept

One button is large, coloured, and first. The other is a text link, below the fold, or missing entirely. Reject parity is the measurable gap between the two paths, and it decides whether consent was a choice at all. November 2, 2026

Proving Consent in an Audit: The Trail Behind the Banner, Field by Field

When an auditor asks how you know a thousand users consented, screenshots of the banner are not an answer. The records, versions, and change history that actually close the question. November 1, 2026

Newsletter Signup Consent: Why the Unticked Box Is Only Half the Record

Everyone knows the box must start unticked. Fewer teams keep the wording, the form version, and the double opt in trail that make a signup defensible when a spam complaint lands. November 1, 2026

Consent Across Devices: Why Your Phone Never Heard About Your Laptop's No

Consent lives in a browser cookie, so it dies at the device boundary. How logged in consent sync works, where it breaks, and what honest sites tell users about the gap. October 31, 2026

Newsletter Consent Records: What Double Opt In Proves and What It Does Not

A double opt in email proves an inbox was reachable and clicked. It does not prove who clicked, or consent to everything else. Keeping email consent records that hold up. October 31, 2026

Consent and Email Tracking Pixels: The Inbox Is a Tracking Surface Too

Open tracking pixels, click redirects, and per-recipient identifiers run under the same consent and disclosure logic as web cookies. What email teams inherit from privacy law, and the settings that matter. October 30, 2026

When Consent Signals Disagree: Troubleshooting CMP, Tag Manager, and Vendor State

The banner says denied, the tag manager says granted, the vendor dashboard shows data anyway. A diagnostic order for tracing where consent state diverges across the stack. October 30, 2026

Consent and Embedded Video: The Player That Phones Home Before Play

A standard video embed loads trackers the moment the page renders, long before anyone presses play. Two click solutions, facade patterns, and what privacy mode embeds actually change. October 29, 2026

Consent Log Retention When You Change Vendors: Export First, Cancel Second

Switching consent platforms is easy. Keeping years of producible consent proof through the switch is the work. What to export, in what format, and how to verify it before the old account closes. October 29, 2026

Consent and Voice Assistants: When a Spoken Yes Is the Record

Smart speakers collect consent by voice, in shared rooms, from people who may not own the device. How spoken consent works, where it breaks down, and what households and makers should check. October 28, 2026

How Long Should Consent Records Be Kept? Building a Retention Schedule

Consent records prove choices, but keeping them forever creates its own risk. How to set retention periods by purpose, handle withdrawal, and document the schedule so audits take minutes. October 28, 2026

Consent for Wearables: Health Data Collected on the Wrist, Shared Everywhere

Fitness wearables collect heart, sleep, and location data continuously. What consent covers at setup, where data flows next, and the settings worth reviewing. October 27, 2026

Auditing Consent Banners for Dark Patterns: A Practical Checklist

Reject buttons hidden in second layers, pre ticked boxes, and confirm shaming still appear on major sites. A checklist for auditing your own banner honestly. October 27, 2026

Consent on Smart TVs and Streaming Apps: Viewing Data Nobody Agreed To Share

Smart TVs track what you watch, second by second, and streaming apps add their own layers. How viewing data consent works on the biggest screen in the house, and the settings worth changing. October 26, 2026

Loyalty Programs and Consent: What Shoppers Actually Agree To

A loyalty card promises discounts and quietly builds one of retail's richest data assets, now sold onward through retail media networks. What loyalty consent covers, where it stretches, and what members can check. October 26, 2026

Consent for Wearables: What Your Watch Shares Beyond Your Steps

Wearables collect heart, sleep, location, and cycle data, then share more of it than most wearers realise. Which sharing settings matter, how app connections multiply exposure, and what to check before linking a wearable to anything else. October 25, 2026

A Quarterly Consent Audit You Can Finish in One Afternoon

Consent setups drift: new cookies appear, notices age, records pile up. A quarterly afternoon checklist that covers scanning, banner behaviour, records, and the privacy notice, sized for a small team. October 25, 2026

What Consent Enforcement Cases Teach About Dark Patterns

Regulators keep fining the same banner tricks: missing reject buttons, buried settings, and pre ticked boxes. The patterns enforcement has named, and how to audit your own banner against them. October 24, 2026

Consent in Newsletter Popups: Timing, Exit Intent, and the Decline Button Problem

Newsletter popups convert, but their consent quality varies wildly. How timing, decline wording, and pre ticked extras decide whether a sign up list is an asset or a complaint waiting to happen. October 23, 2026

Consent for SMS Marketing: Text Messages Are Not Small Emails

Text marketing has stricter consent habits, personal devices, and real costs for getting it wrong. How SMS consent, records, and opt outs should work. October 22, 2026

When a Business Is Sold: What Happens to Consent and Customer Data

Acquisitions move customer data into new hands. What buyers and sellers owe the people on the list, and when new consent is the only honest route. October 22, 2026

First Party Data Still Needs a Receipt: Consent for What You Collect Yourself

First party data feels safe because no third party is involved. Why the collection basis, notice, and receipt still matter for your own analytics and CRM. October 21, 2026

Dark Patterns in Consent Banners: What Enforcement Actually Targets

Regulators keep naming the same banner tricks: hidden reject paths, pre ticked boxes, and accept buttons that shout while decline whispers. The patterns to remove and what compliant design looks like. October 20, 2026

Consent in Connected Cars: Infotainment, Apps, and Driver Data

Modern vehicles collect location, voice, and driving data through infotainment systems and companion apps. How consent should work when the screen is a dashboard and the user might be a passenger. October 19, 2026

Consent and Student Data in Education Apps

Schools adopt apps faster than privacy reviews can follow. Who can consent for a child, what teachers should check before rollout, and the data practices that should disqualify a tool outright. October 19, 2026

Consent on the Big Screen: Tracking Choices in Connected TV Apps

The television has no mouse, a shared audience, and a remote with four buttons, yet streaming apps collect some of the richest viewing data there is. How consent works, and fails, on connected TV. October 18, 2026

Consent by Voice: What Smart Speakers Record and Who Agrees to It

A speaker in the kitchen listens for a wake word and keeps more than people assume. How voice consent actually works in a household of speakers, guests, and kids, and the settings worth changing. October 18, 2026

Consent in Podcast and Audio Apps: Listening Data, Dynamic Ads, and Off-Site Measurement

Podcast listening was private by design; downloads were anonymous. Dynamic ad insertion, hosted measurement, and app accounts changed that. How consent applies to listening data now, and what honest settings look like. October 17, 2026

Email Tracking and Consent: Pixels, Clicks, and the Rules Beyond the Banner

Marketing email tracks opens with pixels and clicks through wrapped links, usually under rules that differ from web consent and confuse teams who manage both. How email tracking works, what subscribers agreed to, and how to keep it honest. October 16, 2026