Cookie consent banners have become such a universal annoyance that it's easy to assume they're all doing the same legally-required thing — the actual requirements vary meaningfully by which regulations apply to your visitors.
Genuine, specific, informed consent before non-essential cookies are set — meaning a banner that only offers "Accept" with no equally easy "Reject" option, or that sets tracking cookies before any interaction, doesn't actually meet the requirement despite having a banner present.
A common non-compliant pattern is a prominent "Accept All" button paired with a "Reject" option buried in a secondary settings menu requiring extra clicks — this asymmetry is itself a compliance problem under GDPR's guidance, since making rejection meaningfully harder than acceptance undermines the claim that consent is being freely given. A genuinely compliant banner puts both options at the same visual prominence and same number of clicks.
Other privacy laws (in various US states, Brazil, and elsewhere) have different specific requirements — some are opt-out based rather than opt-in, some have different definitions of what counts as personal data. A one-size-fits-all banner built only for GDPR compliance may not satisfy every jurisdiction your visitors come from.
Cookies categorized by purpose (necessary, functional, analytics, marketing) with granular accept/reject control per category, consent that's actually recorded and can be demonstrated if challenged, and cookies genuinely not firing until consent is given for that category — not just a banner overlay while tracking scripts run underneath regardless.
A dedicated consent management tool that handles categorization and blocking correctly is worth the cost over a custom-built banner that looks compliant but doesn't actually block anything before consent — the visual banner is the easy part; correctly blocking scripts until consent is the part that actually matters legally.
A quick way to check whether a currently installed banner is actually functioning correctly, not just displaying correctly, is opening the browser's network activity panel before clicking anything on the banner and checking whether analytics or advertising scripts are already firing. If tracking requests appear before any consent choice is made, the banner is cosmetic rather than functional, regardless of how compliant it looks on screen.
A poorly configured consent tool from an otherwise reputable vendor is a more common source of this problem than an outright fake or scam banner — misconfiguration during setup (a category not properly linked to its blocking rule, a script tag placed above the consent check in the page's code) can leave real gaps even when the underlying vendor's product is fully capable of correct behavior. The audit is about your specific implementation, not just which vendor you chose — even a fully capable tool can be misconfigured in a way that quietly undermines its actual compliance value.
