Cookie Banner Audit: 7 Mistakes That Cost GDPR Fines — and How to Fix Them

TL;DR: 7 out of 10 Austrian websites we audit have at least 2 of the following cookie banner mistakes: dark patterns, missing reject buttons, or consent that’s technically ignored. A GDPR-compliant banner with 70% consent rate beats a dark-pattern banner with 95% — because those 95% are legally contestable and your tracking is built on sand (Source: Canem Errant, 2026).

A Vienna online shop came to us after receiving a noyb complaint. The problem: the “Reject” button was grey on a light grey background, font size 11px. “Accept All” was green, bold, font size 16px. The CEO said: “But everyone does it this way.” Correct. And everyone risks fines between €5,000 and €50,000 — plus the loss of all tracking data based on invalid consent.

Cookie banners are still the most ignored compliance risk in the DACH region in 2026. Not because the laws are unclear — Austria’s TKG 2021 and the GDPR are very explicit. But because most companies set up their banner once and never looked at it again. That catches up with you.

Here are the 7 specific mistakes we find in almost every audit — and how to fix each one.

Why Are Cookie Banners Still a Problem in 2026?

Because enforcement is only now gaining momentum. The organization noyb (None of Your Business), founded by Max Schrems and headquartered in Vienna, has filed over 1,000 complaints against cookie banners across Europe since 2021 (Source: noyb.eu, 2025). Many target Austrian websites — dark patterns, pre-checked boxes, and missing reject options.

The Austrian Data Protection Authority (DSB) is increasingly responding to these complaints. The GDPR penalty framework is well-known: up to 4% of global annual revenue or €20 million, whichever is higher. In practice, fines for SMEs in the DACH region range from €5,000 to €50,000 — still enough to ruin a quarterly result.

But the fine isn’t the biggest risk. The biggest risk is that your entire tracking infrastructure is based on invalid consent — and therefore worthless. If the DSB decides your cookie banner wasn’t compliant, all collected data is potentially illegal. Your audiences, your conversion data, your retargeting lists — all built on sand.

For more on the GDPR framework for online advertising in Austria, see our data privacy guide.

Which 7 Mistakes Do We Find in Almost Every Cookie Banner Audit?

Mistake 1: Dark Patterns — “Accept All” Dominant, “Reject” Hidden

Do you have this? The “Accept All” button is colored, large, and prominent — the “Reject” button is grey, small, or hidden behind “Settings.”

This is the most common and expensive mistake. The DSB and the CJEU have clarified: consent must be “freely given” (Art. 4(11) GDPR). If acceptance is visually favored and rejection is made difficult, the consent is invalid. noyb alone has filed over 200 complaints on this topic.

Fix: Both buttons must be equivalent — same size, same color contrast, same visual prominence. “Reject All” belongs on the first layer of the banner, not behind a second click.

Mistake 2: No Real Reject Option

Do you have this? Your banner shows “Accept” and “Settings” — but no direct “Reject” button on the first layer.

The mere ability to deselect categories via “Settings” isn’t enough. DSB practice and EDPB guidelines require an equally easy path to rejection as to acceptance. One click to accept = one click to reject. Not three clicks through a settings menu.

Fix: Add a “Reject All” button directly next to “Accept All” on the first layer.

Mistake 3: Pre-Checked Checkboxes

Do you have this? In cookie settings, marketing or statistics cookies are already pre-selected (opt-out instead of opt-in).

Art. 7 GDPR and the Planet49 CJEU ruling (C-673/17) are unambiguous: pre-checked boxes do not constitute valid consent. Every non-essential cookie must be actively checked — opt-in, not opt-out.

Fix: All non-essential cookie categories must be deactivated by default. The user actively selects what they want to allow.

Mistake 4: Cookie Wall (Forced Consent)

Do you have this? “Accept cookies or leave the site.” No access to content without consent.

Cookie walls are not permissible under the DSB’s and EDPB’s ePrivacy interpretation in Austria and Germany — unless there’s a genuine alternative offer (e.g., a paid subscription without tracking). “Pay or Consent” is legally contested and currently under CJEU review. Until final clarification: avoid.

Fix: Allow access to the website even with full rejection of all non-essential cookies. If your business model relies on tracking, explore a “Pay or Consent” model — but only with legal counsel.

Mistake 5: Missing Granularity

Do you have this? Your cookie settings offer only “Marketing” as an umbrella category — without breaking down which services (Google Analytics, Meta Pixel, TikTok Pixel) fall under it.

The GDPR requires informed consent. “Marketing” as a black box covering 15 different tracking services is non-transparent. Users must know who they’re giving their data to.

Fix: Break down each cookie category by individual service. Show per service: name, provider, purpose, storage duration, whether data is transferred to third countries.

Mistake 6: No Real Consent Storage

Do you have this? Your cookie banner displays “Consent saved” — but in case of an audit, you can’t prove when, how, and by whom consent was given.

Art. 7(1) GDPR requires the controller to be able to demonstrate that the data subject consented. Without documented proof — timestamp, IP hash, selected options, banner version — your consent isn’t provable.

Fix: Use a CMP (Consent Management Platform) that stores consent records in an audit-proof manner: timestamp, selected categories, banner version, anonymized user ID. Cookiebot, Usercentrics, and Borlabs offer this functionality natively.

Mistake 7: Consent Is Technically Ignored

Do you have this? The user clicks “Reject” — but Google Analytics, Meta Pixel, and TikTok Pixel fire anyway.

This is the most severe mistake because it renders the entire consent mechanism meaningless. Common cause: the CMP controls the cookie banner, but the tags in Google Tag Manager aren’t correctly linked to the consent signal. The pixel fires regardless of consent status.

Fix: Implement Google Consent Mode v2 — the technical bridge between your CMP and tracking tags. Consent Mode v2 ensures tags only fire with valid consent and sends anonymized pings for conversion modeling when consent is denied. It’s been mandatory since March 2024 for using personalized Google advertising products in the EEA.

Key Takeaway: Mistake #7 is the most dangerous: a cookie banner that says “No” while your tracking says “Yes” isn’t just a GDPR violation — it makes your entire data foundation contestable. Consent Mode v2 solves this problem technically (Source: Canem Errant, 2026).

How Does Consent Mode v2 Solve the Tracking Dilemma?

Consent Mode v2 is the technical answer to the question: “How do I track when 40% of users reject?” Short answer: you track differently, not less.

With valid consent, Google Analytics, Google Ads, and Meta CAPI work as usual with full data. When consent is denied, Consent Mode v2 sends cookieless pings — anonymized signals Google uses for conversion modeling. You don’t lose data completely; you get modeled conversions instead.

The result: consent rates of 60–70% (instead of 95% through dark patterns), but legally defensible data and better data quality for the algorithm. Accounts we’ve migrated to Consent Mode v2 see an average of 15–25% lower CPA — because the algorithm gets clean data (more details in our server-side tracking guide).

The technical implementation of Consent Mode v2 is explained step by step in our Consent Mode v2 guide. For CAPI integration, read our CAPI setup guide and the CAPI vs. Pixel comparison.

Which CMP Fits Your Setup?

Not every consent management tool suits every stack. Here’s a comparison of the most common solutions in the DACH region:

Tool	Monthly Price	Key Features	GDPR Compliance
Cookiebot (Usercentrics CMP)	from €12/month	Auto-scan, TCF 2.2, Google CMP partner	✅ Certified
Usercentrics	from €50/month	Enterprise features, DPS integration, A/B testing	✅ Certified
Borlabs Cookie (WordPress)	€49/year (one-time)	WP-native, lightweight, GDPR-focused	✅ Community-verified
Consentmanager	from €5/month	Budget option, TCF 2.2, multi-language	✅ Certified

For shops under 500 pages, Cookiebot is sufficient. For enterprise setups with multiple domains and custom integrations, we recommend Usercentrics. WordPress shops are most efficient with Borlabs.

What Do Two Real Cases Show Us?

Vienna Online Shop — noyb Complaint Avoided. A mid-sized fashion online shop in Vienna received a noyb complaint over a dark-pattern cookie banner (Mistakes #1 and #2). Instead of waiting for the DSB decision, the company acted proactively: migration to Cookiebot, banner redesign with equivalent buttons, Consent Mode v2 implementation. The noyb complaint was withdrawn after proof of compliance measures. Total cost: approximately €800 (CMP setup + agency effort). Alternative: potential fine of €10,000–30,000.

DACH Agency Client — Consent Rate from 45% to 72%. A B2B SaaS brand had a cookie banner with 95% consent rate — but Mistake #1 (dark pattern) and #7 (consent partially ignored). After redesigning to a GDPR-compliant banner (equivalent buttons, Consent Mode v2, granular categories), the consent rate dropped to 72%. But: data quality increased by 40%, modeled conversions in Google Ads were 25% more accurate, and CPA dropped by 18%. Less consent, better data, lower costs.

What Can You Do This Week?

1. Open your website in incognito mode and test your cookie banner against the 7-mistake checklist. Can you reject with one click? Are buttons equivalent? Are categories broken down?

2. Check Mistake #7: Click “Reject” and open the browser console (F12 → Network). Filter for “google-analytics”, “facebook”, or “tiktok”. Do tracking pixels fire despite rejection? If yes: act immediately.

3. Book a CMP audit or do it yourself: log into your CMP, check whether consent records are being stored, and whether the tags in GTM are correctly linked to consent signals.

Bottom Line: A GDPR-compliant cookie banner with 70% consent rate beats a dark-pattern banner with 95% — because the 95% are legally contestable, your data becomes worthless in an audit, and the algorithm delivers better results with clean 70% than with contaminated 95%. Compliance isn’t a performance killer — lack of compliance is.

Frequently Asked Questions

Is a simple cookie notice without buttons sufficient?

No. Since Austria’s TKG 2021 and GDPR case law, you need active consent with clearly separated options (Accept, Reject, Settings). A mere notice saying “This website uses cookies” without interaction options doesn’t meet the requirements — and was already insufficient in most cases before 2021.

What’s the average consent rate with a GDPR-compliant banner?

In our projects, we see consent rates of 55–75% with correct implementation and no dark patterns. The average is around 65%. Factors that influence the rate: industry, user demographics, banner design, and whether the value of tracking is communicated (e.g., “personalized offers”).

Do I need to show my cookie banner on every visit?

No — if consent is stored correctly. The CMP should save the consent status via cookie or local storage and only show the banner again when (a) no consent exists yet, (b) the stored consent has expired (recommended: 6–12 months validity), or (c) the cookie categories have changed.

What’s the difference between TCF 2.2 and Consent Mode v2?

TCF 2.2 (Transparency and Consent Framework) is an IAB standard that standardizes consent between publishers and ad networks — it governs which vendors can use which data. Consent Mode v2 is Google’s technical implementation that controls how Google tags fire based on consent status. Both are complementary: TCF 2.2 standardizes the consent process, Consent Mode v2 implements it technically.

Can noyb go after small businesses too?

Yes. noyb files complaints systematically — regardless of company size. The organization has developed automated tools that scan cookie banners for compliance. Your online shop with 500 visitors per day is just as exposed as a corporation. The fine will be proportionally lower, but the effort for defense and reputational damage remains.

---

Cookie banner audit overdue? Our tracking and compliance team reviews your banner, implements Consent Mode v2, and migrates you to a certified CMP — without performance loss. Request an audit now →