Privacy LitigationConsent Banners
Why Does a Cookie Banner Need to Block Tracking Behind the Scenes?
A cookie banner has to do more than offer visitors a privacy choice. It also has to stop the website's tracking tools from running when a visitor decides to opt out of tracking. Many recent tracking complaints allege that misconfigured banners are violating website visitors' privacy.
By Alex Proctor
Published September 27, 2026
Summary
A banner that records a visitor's choice without taking action to block the relevant tracking behind it is worse than having no consent technology in place at all, because it results in a deceptive posture. Several complaints filed in September 2026 allege that tracking began before the visitor made a choice, or continued after the visitor declined.
What Does a Banner Have to Do Behind the Scenes?
One of the core functions of a consent banner is to present a choice. Then, if a visitor chooses to opt out of non-essential tracking, the banner or the website technology supporting it has to block the use of advertising and analytics tools.
The choice applies to non-essential tracking. Tools the website needs in order to work do not depend on the visitor's answer. Analytics and advertising tools do, and those are the tools the banner has to control.
Whether a website should default to opt-in or opt-out consent is a separate decision with its own tradeoffs. This article is about a simpler requirement that applies under either model. A banner has to do what it says it does.
When the platform is not connected to the tracking tools, it records the visitor's choice and the tools run regardless. In my experience reviewing websites, the problem usually has one of three causes:
- Tags added in the page code or a tag manager, outside the consent platform
- Tools never assigned to a consent category, so they are treated as necessary
- Cookies removed after a rejection while the underlying scripts keep sending data
A website whose banner does not enforce its choices is exposed to more risk than a website with no banner. Both may face the same tracking claims. The website with the banner also made a promise to its visitors that it did not keep, which opens it to a separate claim that the banner misled them.
Why Isn't Blocking Cookies Enough?
Many consent setups focus on cookies. They prevent or delete cookies when a visitor declines, but the tracking script still loads and still sends the page address, the visitor's IP address, and browser details to the vendor. California wiretapping and pen register claims are based on that network transmission rather than on the use of cookies.
Script-level blocking generally controls whether a tracking tool loads at all, based on the visitor's choice. Under an opt-in model, the tool stays off until the visitor agrees. Under an opt-out model, the tool stops loading once the visitor declines. In both cases, stopping the script itself is more effective than deleting the cookies it sets, because a script that keeps running creates risk even without cookies.
Not every tool fits this pattern. Google's Advanced Consent Mode, for example, loads Google's tags before consent and sends cookieless pings when consent is denied.
| Setup | After a visitor declines | Exposure |
|---|---|---|
| Banner without enforcement | Tools keep loading and sending data | High |
| Cookie-level blocking | Cookies removed, scripts still send data | High |
| Script and cookie blocking | Tools do not load and no cookies are set | Low |
Based on how consent management platforms enforce choices, as of September 2026.
What Are the Lawsuits Alleging?
Recent complaints of this kind have reached a range of industries, including sports entertainment, financial news, cybersecurity, optical retail, and fitness. Each alleges that the website's banner offered visitors a choice and that some tracking tools kept running after the visitor declined. Several also allege that tracking began as soon as the page loaded, before the visitor made any choice at all.
Some of these complaints also plead common law fraud or misrepresentation, based on the banner's statement that visitors could reject cookies. Those claims exist only because the banner made a promise that the website did not keep.
What Does a Banner That Blocks Look Like?
I recommend routing every tracking tool through the consent platform and assigning each one to a category. Tools the website needs in order to function, such as the shopping cart or the login, belong in the necessary category and stay on regardless of the visitor's choice. Analytics and advertising tools belong in the non-essential categories, so that when a visitor declines, both the script and the cookies it sets are blocked. The visitor's choice should take effect immediately and carry over to every page that follows.
Where a tag manager such as Google Tag Manager loads the tools, the gating has to be configured there as well, because the consent platform cannot stop a tag it does not control. The setup should be checked again after any change to the website or its tags, because a tag added outside the platform may run no matter what the visitor chose.
Questions
Does using a consent management platform protect a business?+
Yes, as long as the platform blocks the relevant tracking. A platform that records choices without enforcing them adds a misrepresentation problem to the tracking problem. The protection comes from how the platform is configured and whether it is connected to every tracking tool on the site, not from the presence of the top-level notice.
Is it enough to delete cookies when a visitor declines?+
Usually not. Deleting cookies does not stop a tracking script from sending the page address, IP address, and browser details to its vendor. California wiretapping and pen register claims focus on that transmission, so the script itself has to stop when the visitor declines.
Does Google Consent Mode block tracking?+
It depends on the mode. Basic Consent Mode keeps Google's tags from loading until the visitor's consent status allows them. Advanced Consent Mode loads the tags before consent and sends cookieless pings when consent is denied, which may draw scrutiny under California's wiretapping law.
Briefings are informational and do not constitute legal advice.
Not sure your banner works?
I'll check whether visitor choices are honored.
Website Privacy Audits include a detailed video review of your live site, a written report for your team or counsel, and a remediation review call. Priority audits add 72-hour delivery and testing of demand letter claims.
Standard $449. Priority $649.
My audits are most useful when you have a consent management setup to validate, a demand letter with specific claims to assess, or a team or client that needs an external web privacy expert. If you already know you have major gaps, your budget may be better spent addressing them directly. I recommend Captain Compliance, the platform I help build, for privacy technology needs.