The same banner everywhere is wrong in at least one place

What it is

Rules about storing information on a visitor device, and about the tracking that storage enables. In the EU and UK the relevant rule comes from the ePrivacy Directive as implemented nationally, alongside the GDPR standard for consent. In the US the question is framed through state privacy statutes and their opt-out rights.

Does it apply to you

• You set anything on a visitor device beyond what is strictly necessary to deliver what they asked for. That includes analytics, advertising pixels, session recording, and many embeds.
• Your visitors are in a region with such a rule, which for most business websites means at least one.

What being wrong costs

In the EU and UK, enforcement sits with data protection authorities, and cookie banners have been a repeated focus of coordinated enforcement action. In the US, state attorneys general have brought actions over failures to honor opt-out signals. A banner that records consent it did not properly obtain is worse than none, because it creates a record asserting something untrue.

What it demands

• In the EU and UK, consent before non-essential storage is set. Pre-ticked boxes, implied consent from continued browsing, and a banner that loads the tags anyway do not meet the standard.
• Refusing must be as easy as accepting. A prominent accept button beside a link to a settings page is the pattern regulators have criticized.
• Withdrawal must be available later, and as easy as giving consent.
• In opt-out states, honoring a universal opt-out preference signal such as the Global Privacy Control.

What WebSpark does

• Nothing third-party loads before a grant. The gate is in the code path itself, and a test loads the site from an EU geography and stops the publish if any third-party request fires.
• Region determines the treatment: prior consent where required, opt-out with Global Privacy Control respected where that is the standard.
• The cookie table is built from the same vendor declarations that drive the content security policy, so a vendor nobody declared is blocked by the browser, and the table stays true.

What you can show

• A consent log by region showing what was presented and what was chosen.
• A dated pre-consent request test showing zero third-party requests.
• A cookie table that matches what the site actually sets.

What stays yours

• Deciding whether you want the tracking at all. The cheapest way to comply is to stop collecting what you never use, and that is a business decision.