The Real Cost of Skipping Cookie Consent

You're building fast. On day one someone pastes the analytics snippet into the page head. A week later the ad pixel goes in next to it. The cookie banner lands on the "before launch" list, and when it finally ships, nobody checks what it actually controls.

That's a normal way to build. It's also the exact pattern privacy regulators keep writing up. This article looks at what loading trackers before consent has cost real companies, what changed in California this fall, and how to test and fix your own site. For the wider picture on pixel and accessibility lawsuits, see our earlier piece, Your Cookie Banner Won't Save You. This is general information, not legal advice.

What skipping cookie consent looks like in code

It's rarely a decision. It's usually one of three bugs:

• Tags load with the page. The analytics or ad script sits in your HTML, or fires on a tag manager's page-load trigger, so it runs before the visitor has even read the banner.
• Reject is cosmetic. The button closes the banner, but the scripts keep running, or the cookies they already set keep getting read.
• The browser's opt-out signal is ignored. The visitor's browser sends Global Privacy Control (GPC), which means "don't sell or share my data," and nothing on your site listens.

Most of the cases below trace back to one of them.

California: the bill arrives as a settlement

The California Consumer Privacy Act (CCPA) is enforced by the Attorney General and by the California Privacy Protection Agency, which now goes by CalPrivacy. Their tracking cases read like a list of the same mistakes:

• Sephora, $1.2 million (2022). The Attorney General said Sephora's arrangement with third-party tracking companies amounted to a sale of shopper data, and that Sephora didn't process opt-outs sent through GPC.
• American Honda, $632,500 (2025). CalPrivacy alleged Honda's privacy management tool didn't offer choices in a symmetrical, equal way, and that Honda asked for too much personal information before letting people opt out.
• Todd Snyder, $345,178 (2025). A privacy portal the retailer hadn't set up properly left opt-out requests unprocessed for 40 days. As the agency's head of enforcement put it: "Using a consent management platform doesn't get you off the hook for compliance."
• Healthline Media, $1.55 million (2025). According to the Attorney General, the site's consent banner didn't disable tracking cookies, and some advertising partners kept getting data after people opted out.
• Tractor Supply, $1.35 million (2025). CalPrivacy found it didn't give consumers an effective way to opt out, including through signals like GPC.
• Disney, $2.75 million (2026). When people opted out with GPC, Disney applied it only to the device they were using, not to their account or its other services.
• PlayOn Sports, $1.1 million (2026). CalPrivacy alleged the ticketing company made people agree to tracking before they could use their tickets, pointed them to industry opt-out sites instead of offering its own, and didn't recognize opt-out preference signals.

The fine is often the smaller part of the bill. Tractor Supply also has to scan its digital properties to inventory its tracking technologies, and a corporate officer has to sign off on its compliance every year for four years. Healthline has to make sure its opt-out mechanisms work correctly and keep a CCPA compliance program running. That's engineering time and leadership attention, for years.

The per-violation math is why the numbers climb. Since January 1, 2025, CCPA penalties can reach $2,663 per violation, or $7,988 per intentional violation. One caveat: the CCPA only covers businesses that cross its thresholds (annual revenue above $26,625,000 is one of them), so ask a lawyer whether it applies to you. The habits it punishes are worth fixing either way.

CIPA lawsuits, and what SB 690 changed

Regulators aren't the only ones looking. The California Invasion of Privacy Act (CIPA) is an older wiretapping law that courts have applied to websites, and it lets private plaintiffs seek $5,000 per violation without proving actual harm, according to the Assembly privacy committee's analysis. Most recent website suits used its pen-register section. The bill's author, Senator Anna Caballero, says those suits grew from about 600 to nearly 4,000 after SB 690 was introduced in 2025.

On September 30, 2026, Governor Newsom signed SB 690, which ends private lawsuits under that pen-register and trap-and-trace provision when the conduct happens on a website or app. According to Pillsbury's analysis, the change takes effect January 1, 2027, after which only the Attorney General can bring those claims, and it also reaches pending claims filed in the two years before that date.

Don't read that as a free pass. SB 690 leaves CIPA's wiretapping and eavesdropping sections alone, and private plaintiffs can still sue under those. The Governor's signing message itself says other parts of CIPA are open to abuse and asks the Legislature to keep working on it next year. And none of it changes the CCPA cases above.

Europe: consent means before, not after

Under the EU's ePrivacy rules, storing or reading information on someone's device needs their consent, apart from narrow exceptions for what's strictly necessary. The European Data Protection Board's 2024 guidelines spell out that this reaches tracking pixels and similar techniques, not just cookies.

France's regulator, the CNIL, shows what that costs. In September 2025 it fined Shein €150 million after finding that advertising cookies were placed as soon as visitors arrived, and that new cookies were still placed, and existing ones read, after people clicked "Refuse all." The inspection behind it took place in August 2023, so the bill arrived two years after the bug was spotted. The same day, the CNIL fined Google €325 million, partly over how cookie consent was collected when people created a Google account.

Global Privacy Control: the signal you can't ignore

GPC is a browser setting that tells every site you visit not to sell or share your data. Under the hood it's an HTTP header, Sec-GPC: 1, plus a JavaScript property, navigator.globalPrivacyControl, defined in a W3C draft specification. Brave and DuckDuckGo turn it on by default, and Firefox offers it as a setting, according to the GPC project.

In California, a business that sells or shares personal information has to treat that signal as a valid opt-out. Under the updated CCPA regulations, in effect since January 1, 2026, it also has to show on its site whether it processed the signal. Colorado has required covered businesses to honor GPC since July 1, 2024. And California's Opt Me Out Act requires browsers to offer an opt-out signal from January 2027, so more of your visitors are likely to arrive with one switched on.

How to fix it before launch

The fix is a loading pattern, not a prettier banner. Keep every non-essential vendor script out of your HTML, and load it only from your consent tool's callback after the visitor has said yes to that category:

// Illustrative pattern: no vendor tags in your HTML.
// `consent` is your consent tool's API.
// `addScript` appends a <script> tag.
const gpcOn = navigator.globalPrivacyControl === true;

consent.onChange(({ analytics, ads }) => {
  if (analytics) addScript("https://analytics.example/a.js");
  // GPC on = opted out of selling and sharing
  if (ads && !gpcOn) addScript("https://ads.example/pixel.js");
  // Withdrawn: delete first-party ad cookies, then reload
  if (!ads) clearAdCookies();
});

A few things that trip people up:

• Tag managers count. Every tag inside one needs a consent condition, and the container shouldn't pull in third-party tags on page load.
• Reject has to undo things. When someone withdraws consent, delete the first-party cookies those tools set and stop reading them. That's the exact failure the CNIL found at Shein.
• Server-side counts too. If your server forwards events to an ad platform, the visitor's choice has to travel with each event.
• A consent tool isn't the fix on its own. Remember the Todd Snyder quote above: it still has to be configured, tested and watched.

Then make sure it stays fixed. Tags drift every time someone adds a campaign pixel. Keep a list of every third-party host your site is allowed to call, and when, and repeat the same three loads (no choice, Reject, GPC on) on every release. It's the same kind of tracker inventory Tractor Supply's settlement now requires, and it's far cheaper to start before anyone asks.

Where a pre-launch audit fits

None of these checks is hard. They're just easy to skip when you're shipping, and they break quietly. In a LaunchGate audit we load your key pages with no choice made, after Reject, after withdrawing consent and with GPC switched on. We record every third-party request and cookie, and you get that log as evidence next to each finding, along with the fix we'd recommend.

We report what we find, based on the checks we run. We're not a law firm and we don't give legal advice: whether the CCPA, CIPA or EU rules apply to you, and what your banner and privacy policy need to say, are questions for an attorney, and some findings will need one. If you'd like a first look, the Free Launch Check is a preliminary public-surface review — not a full audit — and it costs nothing.