Privacy finding
What the consent banner does when it is tested
Privacy Error Severity: High
Part of the audit Consent banner behaviour. Finding id: privacy.consentBannerBehaviour.
What it costs you
The banner is shown and does not do what it says.
What to do
Offer reject next to accept at the same step, leave optional choices unticked, block tags until a choice is made, keep the choice on the next page and give a way to change it.
What it checks
- No consent banner where required
- Refusing is harder than accepting
- Choices already ticked
- Tracking not held back until choice
- Choice ignored on later pages
- Consent choice not passed to ad services
- No way to withdraw consent
How to fix it
Show the banner in this region
- Open the geo or region rules of the consent tool and include region [region].
- Check that a CDN or page cache does not serve the banner-free version of another region.
How to check: Run the scan from that region again.
Put reject next to accept
- Put a reject button on the first layer of the banner, with the same weight as accept.
How to check: Open the site in a private window and count the clicks for each choice. Then run this rule again.
Leave optional categories unticked
- Set every optional category to off by default in the consent tool.
How to check: Open the banner's settings layer in a private window: only the necessary category is on.
Make the tags wait for a choice
Keep the choice on the next page
- Check that the consent cookie is set for the whole domain and is not cleared or cached away.
How to check: Make a choice in a private window and open a second page: the banner stays away.
Add a permanent link to the choices
- Add a link that reopens the consent choices on every page, for example in the footer.
How to check: Accept, then use the link and withdraw. Then run this rule again.
Set a default consent state before the tags
How to check: Run this rule again: the default consent signal is 'denied' in the regions that ask for consent first.
A real case
France's data protection authority found that google.fr, youtube.com and facebook.com let visitors accept cookies with one click but made refusing them harder. In January 2022 it fined Google 150 million euros and Facebook 60 million euros and gave them three months to fix it.