A website launches with what appears to be a compliant consent experience. The banner is clear. Users can accept or reject tracking. Consent records are retained. Legal has reviewed the wording. Marketing is satisfied with the user journey.
Six months later, a complaint arrives.
The complaint is not about the banner. It is not about the wording. It is not even about whether consent was requested.
The question is much simpler: what happened after the user clicked “reject”?
When investigators examine online tracking practices, they are increasingly interested in behaviour rather than presentation. A screenshot may show that a user was offered a choice. It does not prove that the choice was honoured.
This distinction matters more than ever. The ICO’s guidance on Storage and Access Technologies (SATs) reflects a broader view of online tracking than many organisations still apply in practice. The focus is no longer limited to traditional cookies. It extends to technologies such as tracking pixels, web storage, device fingerprinting techniques and other methods that store or access information on a user’s device.
For many organisations, that shift exposes a gap between what they believe they are auditing and what regulators may ultimately examine.
The Audit Object Has Changed
For years, discussions about consent compliance centred on cookies. As a result, many organisations built governance processes around cookie inventories, cookie banners and cookie policies.
The ICO’s SAT guidance takes a broader approach. The key question is not whether a technology is technically classified as a cookie. The question is whether information is being stored on, or accessed from, a user’s device and whether the relevant legal requirements have been met. The guidance explicitly covers technologies such as web storage, tracking pixels and other mechanisms capable of storing or accessing information.
That change may appear subtle, but it has significant practical implications.
A website may display a well-designed consent banner while simultaneously deploying technologies that create compliance risks elsewhere on the page. A compliance review focused solely on the banner may never identify those issues.
This is why organisations should think carefully about what they are actually auditing. If the review focuses exclusively on what the user sees, it may miss what the website is doing.
The compliance challenge is increasingly behavioural rather than visual.
Why Many CMP Programmes Stop Too Early
Most consent management programmes follow a predictable path.
The organisation selects a CMP. The banner is configured. Categories are defined. Preference options are reviewed. Consent records are captured and stored.
At this stage, many teams feel they have completed the bulk of the work.
The problem is that these activities primarily govern the collection of consent rather than the execution of consent.
Those are not the same thing.
A user may reject analytics tracking, yet a page may still initiate network requests to third parties. A consent preference may be recorded correctly, yet scripts may continue loading because of configuration errors, implementation gaps or changes introduced after deployment.
Neither the marketing team nor the privacy team necessarily sees these issues during routine reviews.
Marketing teams often focus on user experience, campaign performance and website functionality. Privacy teams focus on governance, policies and legal obligations. The technical behaviour occurring between those functions can receive far less scrutiny.
The result is a visibility gap.
Many organisations know what their consent banner is designed to do. Far fewer know exactly what happens on the page after a user exercises a choice.
What Regulators Are Likely to Examine After a Complaint
When a complaint reaches a regulator, the investigation rarely begins and ends with a screenshot.
Instead, investigators are likely to examine evidence showing what occurred during the user’s interaction with the website.
They may seek to understand whether storage or access technologies were activated. They may examine network requests, third-party communications, storage activity and the sequence of events that followed a consent decision.
In practical terms, the evidence trail often looks very different from the artefacts organisations typically prepare for internal reviews.
A screenshot can demonstrate that a banner existed.
A consent record can demonstrate that a choice was captured.
Neither necessarily demonstrates that the user’s choice was respected across every relevant technology operating on the page.
This distinction becomes particularly important where websites contain multiple layers of third-party services, embedded content, advertising technologies or analytics components.
The compliance question is not whether consent was requested.
The compliance question is whether the resulting behaviour aligned with the user’s decision.
That is a fundamentally different evidential standard.
The Three Blind Spots Behind Most Consent Failures
Many consent issues emerge from one of three operational blind spots.
The first is hidden third-party activity.
Modern websites often rely on numerous external services. Marketing tags, embedded media, customer engagement tools and analytics components can introduce tracking activity that is not immediately visible to those responsible for governance. Organisations may understand their primary technologies while remaining unaware of secondary or downstream activity triggered by those services.
The second blind spot involves consent signal propagation.
A user rejects consent. The banner records the decision correctly. The problem occurs when that decision is not communicated consistently across the wider technology stack. Somewhere between the consent interface and the underlying tracking technology, the signal breaks down.
The third blind spot is change management.
Websites evolve continuously. New campaigns launch. New scripts are added. Existing integrations are modified. A page that behaved correctly during a review six months ago may behave very differently today.
This is one reason why consent compliance cannot be treated as a one-time exercise. Technical behaviour changes over time, often without attracting immediate attention.
What a Technically Credible Consent Audit Looks Like
A technically credible consent audit goes beyond reviewing policies, screenshots and configuration settings.
Its purpose is to determine whether consent choices are being honoured in practice.
That requires evidence.
The audit should examine how pages behave before and after consent decisions are made. It should assess network activity, storage activity, third-party communications and the operation of tracking technologies across the user journey.
It should also examine whether consent signals are propagated correctly and whether website changes have introduced new risks since previous reviews.
Importantly, the objective is not merely to identify technical defects.
The objective is to create a defensible evidential record.
If a regulator, customer or internal stakeholder asks whether consent controls are functioning correctly, the organisation should be able to demonstrate its answer through evidence rather than assumption.
That distinction separates governance from assurance.
Governance defines what should happen.
Assurance demonstrates what actually happened.
Why the New PECR Enforcement Landscape Matters
Historically, some organisations viewed PECR compliance as a lower-priority concern compared with broader data protection obligations.
That calculation has changed.
The Data (Use and Access) Act 2025 aligned PECR’s enforcement regime more closely with UK GDPR enforcement levels. The ICO can now issue penalties of up to £17.5 million or 4% of global annual turnover, whichever is higher. The legislation also strengthened aspects of the ICO’s investigatory powers.
The significance is not simply the size of the potential penalty.
The more important point is that organisations should expect greater scrutiny of the evidence supporting their compliance claims.
When compliance programmes rely heavily on screenshots, implementation assumptions or historic reviews, they may struggle to demonstrate that consent choices are consistently respected in practice.
As enforcement expectations evolve, technical evidence becomes increasingly important.
The organisations best positioned to withstand scrutiny are unlikely to be those with the most attractive banners.
They are more likely to be the organisations that understand precisely how their websites behave and can demonstrate that understanding with confidence.
The difference between apparent compliance and demonstrable compliance is often found beneath the surface of the page.
The DPG helps organisations examine consent controls at the technical and operational layer, assessing how storage and access technologies behave in practice, whether consent signals are being honoured across the digital estate, and whether the evidence exists to support compliance with regulatory expectations.
Sources
This article is based primarily on guidance and updates from the Information Commissioner’s Office relating to Storage and Access Technologies, PECR, cookies and similar technologies, and the Data (Use and Access) Act 2025.
Contact the Author
Iain Borner
Chief Executive Officer
As Co-founder and CEO of The Data Privacy Group, Iain Borner leads our mission to empower businesses with top-tier data protection services and foster Digital Trust across all customer touchpoints. With an extensive background in data privacy management, he is passionate about safeguarding businesses' reputations, revenues and relationships in this digital age. It's about steering organisations towards a future where Digital Trust is their most invaluable asset.
Receive the latest news to your Inbox
