Consent Widgets That Do Not Actually Comply

This is the privacy version of a hard truth we already tell on the accessibility side about overlay widgets. The comforting story is that you can buy a small piece of software, drop it on your site, and be compliant by dinner. The reality is that installing a banner and actually gating your tracking are two very different things, and only one of them is compliance.

What the widget usually does

A typical consent widget shows a message, offers some buttons, and sets a cookie recording which button was clicked. That is it. What it very often does not do, unless someone deliberately wires it up, is change whether your analytics and advertising tags fire. The tags are loaded by your site or your tag manager, and the widget sitting on top has no effect on them until it is actually connected to them.

So you end up with a visitor clicking Reject, the widget dutifully recording reject, and Google Analytics and the Meta pixel collecting and sharing away exactly as before. The widget did its job as a widget. It just was not doing the job you thought you bought it for.

Why installing is not gating

Gating means the collection genuinely waits. No tag that needs consent runs until the person agrees, and if they decline, it never runs. That requires the consent choice to be the switch that controls the tags, which is a wiring job rather than an install job. A widget can be the interface for that switch, but the switch has to be connected to something. The mechanism that makes real gating possible has its own pieces in this lane: holding tags until someone says yes, and using consent mode.

Which tags need to wait is a separate question, and the Canadian answer is not the European one. Ordinary analytics can sit on the lighter path of clear notice and an opt out that works. Advertising pixels, session recording and anything sensitive are the ones that should not fire until somebody agrees. Either way, the widget only matters if it is wired to something.

How to tell the difference

The test is refreshingly concrete. Open your site, decline consent, and then look at whether the tracking cookies still get set and the tags still fire. If they do, your widget is decoration. If declining genuinely leaves the trackers switched off, it is doing real work. Most owners have never run that test, which is why so many sites are quietly in the first group.

We are not lawyers and this is not legal advice. It is what the rules say and what we keep finding on real sites. For your own obligations, talk to a lawyer.

If you have a consent widget and have never checked whether reject actually rejects, that is the single most useful thing to verify, and it is one of the first checks we run.