I have been working in privacy for nearly eighteen years and have watched the regulatory environment shift from one where a reasonably recent privacy notice and a visible cookie preferences banner was enough to satisfy most regulators (the early days!), to one where that same configuration is now a liability.
The change has not been gradual, but came in progressively more stringent steps, and many organizations have not kept pace.
Following is a quick snapshot of the current regulatory landscape in 2026 and why the gap between what most organizations assume about their cookie consent program and the truth is larger than they think.
Regulators Are No Longer Doing Visual Checks
There was a period, not that long ago, when a regulator would visit a website, see that a privacy notice existed and looked relatively current, observe that a banner was being displayed with some preference options, and move on. They were looking for the most obvious violators: organizations with no privacy policy at all, no consent mechanism, nothing.
That is not what is happening today. Regulatory agencies have become technically sophisticated. They have teams of legal and technical experts. They use automated scanning tools, the same types of tools that privacy professionals use, and visit websites not just to check whether consent options are being offered, but whether those options work.
It is not difficult to simulate a user arriving from a specific jurisdiction, interacting with a consent banner, and then checking whether the choices that user made are honored downstream. Regulators are now routinely engaging in these exercises. If your systems don’t actually work, if your banner fires after the tracking scripts have already loaded, if your GPC configuration is broken, if rejecting cookies does not actually stop cookies from firing, these errors will be detected and noted.
GPC Is the Number One Issue in Active Audits
Global Privacy Control is a browser-based signal that allows users to globally opt out of tracking across every site they visit. In California, honoring this signal is now written explicitly into law. It is not a best practice. It is a legal requirement.
And it is the most common compliance failure we see.
The problem is almost always misconfiguration. Many CMP providers acknowledge the GPC signal by design, but the way the banner loads means the signal arrives after the tracking scripts have already fired. TikTok, LinkedIn, Facebook, Snap pixels are often loading before the CMP has had a chance to react. The user’s opt-out choice is being technically acknowledged and practically violated at the same time.
We have also seen configurations where GPC is enabled only for targeting cookies when it should apply to all non-essential categories. And we frequently find sites that honor the GPC signal but fail to notify the user that they have done so, which, in some states, is itself a violation.
If you have not specifically tested your GPC configuration, you should assume it needs attention.
Looking Compliant Is Not the Same as Being Compliant
Dark patterns are under active regulatory scrutiny, and the standard has become quite specific. An accept button and a reject button should be the same color, the same font size, and equally prominent. A large green accept button and a small plain text opt-out in the bottom corner of the banner is not a balanced choice. It is a dark pattern, and regulators are treating it as such.
The broader principle is this: your actual behavior determines your risk, not your documentation. What you promise in your privacy notice needs to match what your technology is doing operationally. If it does not, you have a compliance gap regardless of how thorough your documentation is.
One of the first things we check when we do a privacy program assessment is the obvious public-facing elements such as the main website communications around privacy with the visitor, the privacy notice, the consent banner. We check whether the notice was recently updated, whether it accurately reflects the current tech stack and vendor relationships, and whether the promises it makes match what is happening in the back end. That gap, between what the notice says and what the site actually does, is where a significant amount of enforcement risk lives.
The Enforcement Actions Are Getting Larger
Recent enforcement actions against GM, Disney, Playon Sports, and Ford point to a clear trend: fines are becoming more significant, and the violations being cited are the ones we have been discussing. GPC signals not being honored. Do not sell and do not share options not being sufficiently prominent. User preferences not being transmitted consistently across channels and systems.
The car manufacturer cases are particularly instructive because they illustrate what happens when consent management becomes complicated across channels: in-vehicle interfaces, mobile apps, websites and their registered user signals often do not travel consistently from one channel to the next. The more complex your channel environment, the more places the compliance chain can break.
One pattern worth noting: regulators have been clear that when they audit a site and find something that catches their attention, they start looking more closely at everything else. The first issue is rarely the only issue. Organizations that let one gap persist are often more exposed than they realize, because that gap becomes the entry point for a much more detailed review.
Cure Periods Are Disappearing
Another regulatory development worth flagging is this: In earlier state privacy laws, there was often a cure period, a window of time after a regulator identified an issue during which the organization could remedy found issues before enforcement action followed. That gave organizations some breathing room.
Increasingly, those cure periods are either limited to the first year or two of a law’s operation, after which they expire, or they are not included in the law at all. The practical implication is that there is no longer a reliable window in which to fix things after they have been identified. The expectation is that organizations should have been managing this already.
What Good Actually Looks Like
The organizations managing cookie consent compliance well are not necessarily the ones with the largest privacy teams or the most sophisticated technology. They are the ones that have treated this as a program rather than a project.
That means running regular scans, monthly for many organizations, not quarterly. It means having change management processes so that new tracking technologies have to pass through a privacy review before they go live. It means having an active relationship between the privacy team and marketing so that new campaigns and tech stack changes are flagged before they create compliance issues rather than after. And it means auditing regularly so that the gap between the documented program and the operational reality stays small.
The organizations that are most exposed are the ones that stood up a consent program, checked a box, and moved on. Cookie consent compliance is not a state you reach. It is something you maintain.
If you want to understand where your cookie consent program actually stands, Myna’s cookie compliance services can help. Learn more here → https://myna.com/cookie-compliance-consulting
