1. Your Consent Banner Doesn’t Control What Fires
The most common privacy compliance problem is a consent banner that collects choices the website doesn’t honor. A visitor clicks Reject All, and the marketing pixels keep firing anyway.
This happens far more often than most teams expect. In a 2024 study of 97,000 websites popular in the EU, researchers found that 65.4% of sites offering a reject option likely collected user data after visitors rejected it. And 73.4% did so even when visitors never interacted with the cookie notice.
Why it happens: Most consent management platforms (CMPs) don’t block tags on their own. The CMP records the visitor’s choice and passes it to the tag management system (TMS), and the TMS decides what fires. That means the CMP can only enforce consent for tags the TMS controls.
There are two places this breaks down.
The first is tags that never go through the TMS. Developers sometimes hard-code tags directly into page templates. Third-party tags also load other tags of their own, a practice called piggybacking. Because the TMS doesn’t manage these tags, the visitor’s consent choice never reaches them, and they fire for everyone.
The second is the connection between the CMP and the TMS. Even when every tag lives in the TMS, implementation errors can break consent enforcement. Common examples include:
- Tags set to fire on every page instead of on a consent-aware trigger
- Tags mapped to the wrong consent category, so an advertising pixel gets treated as strictly necessary
- Timing problems, where the TMS fires tags on page load before the CMP has set the visitor’s consent state
- Consent changes that never reach the TMS, so tags keep firing after a visitor withdraws consent
- Missing or misconfigured Google Consent Mode v2 signals, so Google tags receive the wrong consent state
- A CMP missing from some templates, subdomains, or regional sites while the TMS still runs there
Any of these can slip in during a site redesign, a new campaign, or a routine TMS update.
How to address it: Test your site the way a visitor experiences it, in each consent state. At minimum, check what fires before anyone touches the banner, after Reject All, and when a browser sends a Global Privacy Control (GPC) signal. Any non-essential tag that appears in the opt-out states is a tag your setup failed to block. Then trace each one back to its source, so you know whether to fix the TMS configuration or track down a tag that’s loading outside it.
ObservePoint’s Consent Management Validation scans your site in each consent state and shows which tags and cookies appear in each one. Tag Initiators then shows what loaded each tag, so you can tell whether it came through your TMS, was hard-coded, or was piggybacked by another vendor. For more on how CMPs break, read Is Your CMP Actually Working? 5 Privacy Compliance Risks to Avoid.
2. You Don’t Know Every Tag and Cookie on Your Website
You can’t get consent for technology you don’t know about. Large websites pick up tags from many teams over many years, and plenty of them never go through privacy review.
Even tags you do know about need to be classified correctly. Your CMP needs every tag and cookie assigned to a consent category, and public cookie databases don’t cover everything. ObservePoint’s research found that one of the most widely used public cookie databases is missing 60% of cookies. An unknown cookie is easy to miscategorize, or to leave out of your consent setup entirely.
How to address it: Build a complete inventory of the tags and cookies that load on your site, including the vendor behind each one. Assign every item to a consent category, and remove vendors you can’t justify keeping.
ObservePoint’s Cookie & Tag Database helps you identify and categorize the tags and cookies on your site, so your consent categories match what’s actually there.
3. Privacy Compliance Doesn’t Stay Fixed
Passing an audit once won’t keep you compliant. Laws change, and so does your website.
On the legal side, more than 20 U.S. states have now enacted comprehensive privacy laws, according to the IAPP’s US State Privacy Legislation Tracker, and many of them require businesses to honor GPC or a similar universal opt-out signal. Each law sets its own thresholds and opt-out rules, so a setup built for GDPR or California won’t automatically cover the rest. Outside the U.S., laws like Brazil’s LGPD and Quebec’s Law 25 add requirements of their own.
On the website side, every release can change what fires. A new landing page, a vendor update, or a TMS change can bring back a tag your team already fixed.
How to address it: Treat privacy compliance as ongoing monitoring instead of a one-time project. Schedule regular scans of your key pages and user journeys, test from the regions whose laws apply to you, and alert the right team when something new appears.
ObservePoint’s Web Privacy solution automates this with scheduled audits, location-based scanning, and alerts when unapproved tags or cookies show up.
Start With What Your Website Is Actually Doing
Every privacy law asks for something a little different, but all three of these problems show up in the same place: your live website. If you’re working toward GDPR specifically, our complete guide to GDPR compliance covers the requirements in depth.
To see what your site does in each consent state, request a demo or try ObservePoint for free.
Felice Wu
Felice has been a Content Marketer at ObservePoint since 2021 and enjoys getting to the heart of product benefits, compliance nuance, and illustrative diagrams. She writes about web governance, tag management, and privacy regulations, and has a soft spot for turning dense technical topics into something people actually want to read. When she's not untangling GDPR articles, she writes about vampires and makes western jewelry.
Read full bio
