TL;DR: A cookie banner must offer a clear, voluntary choice and enforce it. Check more than its buttons: tags, CMS plugins and server events must also follow the selected state. A CMP or Consent Mode is not an automatic legal guarantee.
A banner can look correct while a plugin already measures advertising activity. Blocking can also work while the interface hides rejection. Both belong in an audit before new campaigns rely on the resulting data.
This is a technical and product checklist for Austrian websites. Legal assessment depends on technologies, purposes, recipients and visitor markets. The Austrian Data Protection Authority explains Section 165(3) of TKG 2021 and the exception for strictly necessary technologies; personal data processing also requires a GDPR assessment. Checked on 28 September 2026.
Why Cookie Banners Still Need Review
A banner rarely remains the only component involved. New GTM tags, embedded video, CMS extensions or backend integrations can bypass the original blocking. The notice then promises a different process from the one the website actually runs.
Complaints, including those from noyb, can trigger scrutiny. They do not establish a general failure rate for Austrian websites or a standard fine for small businesses. The specific processing matters. A high acceptance rate does not prove valid consent either.
Compare three layers: the information displayed, the visitor’s choice and the actual data flows. These seven mistakes are practical audit areas, not a ranking of how frequently they occur.
Mistake 1: Rejecting Is Harder Than Accepting
A new visitor should understand how to reject optional technologies on the first layer. A prominent “Accept all” next to a barely readable link, or a rejection path through several screens, undermines a free choice.
The EDPB cookie banner task force report covers missing rejection, preselection and misleading design. It does not prescribe a universal colour or contrast threshold: assess the interface as a whole. Different colours are not automatically unlawful, but a practically invisible rejection option remains a problem.
Check: Ask someone unfamiliar with the site to reject on desktop and mobile. Examine labels, readability, keyboard access and the number of steps. Avoid language that shames visitors or promises benefits that do not exist.
Mistake 2: Optional Categories Are Preselected
Analytics, advertising and personalisation must not be enabled simply because a CMP template ships that way. Separate necessary functions from optional purposes. Explain why a shopping cart needs specific storage rather than calling advertising measurement “necessary”.
Check: Open settings in a clean browser profile. Inspect every optional switch before a decision, after rejection and on a return visit. Closing the banner or continuing to browse must not be implemented as agreement to optional tracking.
Mistake 3: Tracking Starts Before the Decision
A banner displayed later cannot recall requests already sent. Inspect network traffic, cookies, local storage, embeds and scripts outside the GTM container. A cookie scanner alone does not capture every loading condition.
Check: Test a first visit without a choice, full and partial acceptance, and rejection. Repeat after navigation and reload. Record the service, purpose, start time and recipient rather than just a cookie name.
Mistake 4: The Cookie Wall Removes a Free Choice
“Agree or leave” is not voluntary merely because there is a button. A paid alternative does not automatically make every arrangement valid either. The Austrian DSB describes conditions for “pay or okay”, including a reasonable alternative and a real choice.
Check: Assess any access restriction separately: what is available without advertising tracking, what does the alternative cost, and how is its data processed? Saying “all cookie walls are illegal” does not answer those questions.
Mistake 5: Purposes and Providers Are Unclear
A single “everything else” switch hides different purposes. A long list of technical vendors without an explanation is not useful either. Visitors need to understand the functions, recipients and processing behind their selection.
This does not mean every vendor always requires its own checkbox. Appropriate granularity depends on the actual purposes and framework. Categories, provider information and privacy notices must agree.
Check: Map every service to a specific purpose. Verify that allowing statistics does not silently permit personalised advertising. Do not extend an old decision to new purposes or recipients that the visitor never saw.
Mistake 6: Consent Cannot Be Traced
The organisation must be able to connect a decision to the information shown at that time. Record the version, time, selected states and an appropriate means of association. Limit data, access and retention to what is needed.
An IP hash is neither a mandatory standard solution nor automatically anonymous. A pseudonymous identifier can still be personal data. Do not collect extra information just because the CMP has a field for it.
Check: Can the team reconstruct which version and categories a test visitor saw? Also check that “Cookie settings” remains accessible. Withdrawal must be as easy as giving consent and stop the relevant further processing.
Mistake 7: The Browser or Server Ignores the Choice
A correct banner is insufficient if a CMS plugin or backend still sends advertising events. Assess Google tags, Meta Pixel, TikTok and server integrations through their actual rules. Consent Mode v2 controls Google tags, not Meta CAPI or TikTok Events API automatically.
Google distinguishes Basic and Advanced Consent Mode. Basic blocks Google tags before consent and sends no data to Google without it. Advanced can send limited cookieless requests when the state is denied. Cookieless does not automatically mean anonymous or legally authorised.
Check: Compare the four Google states with the CMP choice and outgoing requests. Test every server path after rejection and withdrawal. See Consent Mode v2 for European businesses.
Which CMP Fits Your Website?
These four products are examples, not a ranking or legal endorsement. Check current terms with each provider: page limits, domains, languages, app support and subscription period can change the cost.
| Product | Question Before Choosing |
|---|---|
| Cookiebot | Does the integration fit your CMS, domains and required scanning coverage? |
| Usercentrics | Does the specific package cover your web, app and multiple domain workflows? |
| Borlabs Cookie | Do you use WordPress? This product is for WordPress, not Astro or Shopify. |
| consentmanager | Can you configure the categories, languages, records and server handoff you need? |
Test choice, withdrawal and actual tag execution. Google publisher products such as AdSense have separate certified CMP requirements. That is not certification of an entire website’s lawfulness or a rule requiring every Google Ads advertiser to use a certified CMP.
IAB TCF conveys signals through the advertising supply chain. TCF 2.4 has been published as of this review; new disclosure requirements have transition deadlines of 23 October 2026 for web CMPs and 23 February 2027 for apps/CTV. Ask your provider which migration is required. IAB Europe: confirmed timetable. TCF replaces neither a banner audit nor Consent Mode.
Two Practical Scenarios
Scenario 1: The interface works, the server handoff does not. After rejection the browser pixel stays off, but the backend continues sending Purchase events to an advertising platform. Fix the backend consent handling; a new button colour will not solve it.
Scenario 2: Blocking works, the choice is misleading. Optional tags wait for agreement, but rejection is hidden in settings. Fix the choice path. Correct technical blocking does not replace a free decision.
These are teaching examples, not verified client cases. A change does not establish better lead quality or a specific CPA without comparable measurement. A different acceptance rate can also change the measured audience.
What Belongs in a Technical Audit?
- An inventory of cookies, SDKs, pixels and external requests;
- A map of categories, purposes, recipients and retention periods;
- Tests before choice and after acceptance, rejection and withdrawal;
- Desktop, mobile and language versions;
- Browser and server paths with consent states;
- A comparison of notices, versions and actual behaviour;
- An owner and a repeat check after relevant changes.
The report should identify the finding, affected path, priority and repeatable correction test. A scanner supports the inventory but does not evaluate every purpose or interface.
Three Steps for This Week
- Stop optional transfers occurring before a decision or after rejection; include the backend.
- Check first-layer rejection, categories and permanently accessible withdrawal.
- Update provider information and version records; assign an owner for repeat checks.
Start with a documented fault. The acceptance rate is not a substitute for this review. For data paths, see Tracking & CAPI.
Frequently Asked Questions
Does a CMP Automatically Make a Website GDPR Compliant?
No. Categories, notices, blocking, recipients, evidence and withdrawal must match actual processing. The software alone cannot establish this.
Is Continuing to Browse Consent?
Continuing to browse, silence or closing the banner is not active agreement to optional technologies. The interface and its implementation must allow a real decision.
Does Consent Mode Replace a Cookie Banner?
No. Consent Mode sends the state to Google tags. Information, valid choice and correct execution must be ensured separately.
Is a Simple Cookie Notice Enough?
An informational notice does not collect consent for optional technologies. A site using only strictly necessary technologies may be different; first check the complete inventory and information requirements.
What Is a Good Acceptance Rate?
There is no universal target. Visitors, markets, devices, purposes and interface affect the result. A high rate proves neither free consent nor better business performance.
Must the Banner Appear on Every Visit?
Not necessarily. Retention and renewal must fit the situation. Material changes to purposes or recipients require reassessment; one fixed renewal period for every site is unsuitable.
How Does TCF Differ from Consent Mode?
TCF is an industry framework for signals between advertising participants. Consent Mode changes Google tag behaviour. Both need appropriate configuration and replace neither a legal basis nor clear choices.
Can Small Businesses Also Face Complaints?
Small businesses must follow applicable rules and can be investigated. The actual sanction depends on the infringement and circumstances; there is no reliable flat fine for small companies.
Canem Errant can review technical data paths and banner behaviour. Describe the discrepancy you observed. Diagnostic scope and implementation are agreed separately; legal assessment requires an appropriate specialist.
