User consent is a fundamental part of data privacy compliance, ensuring that websites collect and process user data legally and transparently. However, many businesses struggle with implementing a seamless and compliant consent management experience. When we audited 450 US websites for our State of Consent Compliance report, 79% still loaded at least one targeting or advertising tag after a user opted out, and nearly all of those sites had a working CMP installed.
If your website’s user consent is not working properly, there could be several reasons behind the issue.
Common Reasons for User Consent Issues
Misconfigured Consent Management Platform (CMP)
Many organizations rely on a CMP to manage user consent preferences. If not properly configured, the CMP may fail to capture or enforce user choices correctly. The most common version of this problem is outside the CMP itself: the CMP captures and signals consent correctly but downstream the tag management system (TMS) isn’t configured to respect the user’s choice. In the TMS, each tag instance has to be configured to read and respect the consent signal.
In our audit, 23% of sites showed no reduction in tracking at all after a user opted out.
Unmonitored or Rogue Tags
Even if your CMP is set up correctly, unmonitored tags on your website can bypass consent settings and still collect user data. This leads to non-compliance and potential legal issues.
Piggybacking makes this harder to catch, because a vendor tag you did approve can load additional tags from partners you have no direct relationship with, and wouldn’t appear in your tag manager. This can be problematic when the uses of the data differ. For example, if an analytics tag loads a platform that can be used for audience targeting.
Incorrect Tag Firing Sequences
If marketing or analytics tags fire before the user has given consent, they may collect data unlawfully. This often happens when tags are misconfigured within a TMS or hard-coded on a site.
It also happens when the timing is wrong rather than the configuration itself: if your CMP script loads asynchronously and a tag evaluates its firing conditions before the CMP signals are present, that tag fires without consent on a share of page loads.
Cross-Domain Tracking Issues
If your website uses multiple domains or subdomains, user consent preferences may not be properly shared across them. This can lead to inconsistencies in data collection and compliance risks.
The same gap appears behind authentication, where checkout flows and account pages handle your most sensitive collection and most auditing tools can’t log in to check them without additional development.
Technical Errors or Broken Scripts
A malfunctioning consent banner or script error can prevent user selections from being recorded or enforced properly, leading to unintended data collection. It’s worth checking how your site behaves when the CMP script fails to load at all, since an ad blocker or a failed request can leave the page defaulting to collection instead of suppression.
Global Privacy Control Signals Being Ignored
Consent Mode is now a requirement for organizations running ads in the EEA, and it operates on its own signal path separate from the gating in your tag manager.
The default consent state frequently goes unset, which leaves Google tags behaving as though consent were granted until told otherwise. Teams also implement basic Consent Mode believing they implemented advanced, or the reverse.
Google Consent Mode Misconfiguration
13 states (as of August 2026) now explicitly require websites to honor universal opt-out mechanisms, and Global Privacy Control has become the standard for expressing them.
The signal arrives from the visitor’s browser before your banner does anything, so a consent setup built around banner interactions treats that person as undecided and keeps collecting. In September 2025, the California Privacy Protection Agency, the Colorado Attorney General, and the Connecticut Attorney General ran a coordinated sweep aimed at failures to honor these signals.
What Are the Risks of a Faulty User Consent Experience?
Failing to implement a properly functioning user consent experience can have serious consequences, including, but far from limited to, fines and lawsuits.
Regulatory Non-Compliance
Regulations like GDPR and the ePrivacy Directive require explicit consent for most digital data collection. Similarly, regulations like CCPA and CPA carry consent and opt-out requirements for certain types of data collection.
If your consent mechanism fails, your business could face fines and legal action. Twenty states now have enforceable comprehensive privacy laws, with penalties ranging from $2,663 per violation under the CCPA up to $20,000 under Colorado’s CPA, and enforcement has begun coordinating across states rather than staying isolated to California.
Loss of Consumer Trust
Users expect transparency and control over their data. A faulty consent experience can erode trust, leading to higher bounce rates and lower conversions.
Cisco’s 2024 Consumer Privacy Survey, covering more than 2,600 people across 12 countries, found that 75% of consumers will not buy from a company they don’t trust with their data, and that 67% had reviewed or updated their privacy settings in the previous 12 months.
Data Privacy Violations and Potential Lawsuits
Unlawful data collection due to broken consent architectures can result in data privacy complaints, investigations, and class-action lawsuits.
California’s Invasion of Privacy Act (CIPA) allows $5,000 per violation plus attorney fees, and plaintiffs have successfully argued that session replay tools, chat widgets, and third-party scripts fall under a wiretapping framework. There’s been a sharp increase in private litigation from 2025 to 2026 (doubled according to Cyber Insurance firm Coalition), so the risk is only increasing.
On the regulatory side we’re also seeing increased enforcement and hefty fines. Recent CCPA settlements include Healthline Media at $1.55 million, Jam City at $1.4 million, and Tractor Supply at $1.35 million, the last turning partly on opt-out mechanisms that failed for technical reasons rather than policy ones.
Deleted or Unusable Marketing Data
Regulators can order you to delete what you collected, including data that is powering attribution, audience, and bidding models.
The California Attorney General’s July 2025 settlement with Healthline centered on a consent banner that didn’t disable tracking cookies despite appearing to, and the terms required the company to disgorge sensitive personal information collected before the required notice was posted. The FTC has gone further in other contexts, ordering deletion of the models and algorithms built from improperly obtained data, which puts the audience segments and measurement models you built on that data at risk alongside the data itself.
Additionally, if your consent system doesn’t function correctly, you may collect incomplete or inaccurate data, leading to misguided business decisions and wasted marketing spend. Over-blocking causes the same problem from the other direction, suppressing data you were legally entitled to collect so that analytics under-report and conversions go unattributed.
How Tag Inspector Ensures Proper User Consent Implementation
To prevent these risks and ensure always-on compliance, businesses need a comprehensive solution to monitor and validate their user consent experience. Tag Inspector audits simulate users from around the globe across all consent conditions (i.e. users who accept, users who reject, users who reject via Global Privacy Control, and users who make no selection at all).
Comparing those states is what surfaces the problems above. For example, if a tag loading an analytics platform behaves the same if a user accepts all cookies as it does when they reject all you could have a serious (costly) violation.
From there, Tag Inspector provides the tools to:
- Catalog every tag and cookie: Build a complete inventory across your sites, including tags loaded by other third parties, which is how piggybacking gets found.
- Define and manage consent policy: Document what should load, under which conditions, in which regions, giving you a standard to audit against.
- Diagnose policy violations: Give technical teams the specifics of what fired and why, rather than a list of problems without causes.
- Track remediation to completion: Manage each fix through workflows with action logs that hold up as evidence.
- Monitor for exposed PII: Flag clear-text personally identifiable information collected by tags or exposed in URLs.
- Audit behind a login: Cover the checkout and account pages that most scanners cannot reach.
Across 2025, Tag Inspector audited 12,584 sites and more than 116 million pages, with clients seeing an average $5 million reduction in risk exposure within the first month.
Taking Control of Your Cookie Compliance
A malfunctioning user consent experience puts your business at legal, financial, and reputational risk. By identifying and resolving consent issues with the help of Tag Inspector, you can ensure compliance, build user trust, and optimize your data collection strategy. Given that most organizations can’t see these failures from inside their CMP, the practical first step is finding out what your tags are doing today.
