Skip to content

Product

Common Consent Signals mistakes that still ship

Missing banners on production, CMP flags left off, and "OK"-only dialogs still ship while analytics run—and they tend to surface on the client call you wanted to avoid.

· by Sam Ortega

Common Consent Signals mistakes that still ship

Uptime was green. The homepage screenshot looked polished. Then the client's privacy person opened an incognito window on the call and asked where the cookie banner went. Silence. That is a Consent controls problem wearing a project-management costume.

SlaySlop's check description matches the embarrassment: it "Reviews visible signals related to analytics and cookie consent." The mistakes below are the ones I still see in launch-week portals. None of them require exotic tooling. They require someone to stop trusting the screenshot from a cookied laptop.

Outcome if you fix these early

You reduce the chance that a handoff call turns into a live demo of trackers without a visible consent path. You also get cleaner tickets: URL, missing visible signal, CMP config owner, fix. Agencies survive launch week on process that boring.

Boundaries before the blame game

A public read-only scanner will not see consent UI behind a login you did not include. SlaySlop does not edit the site. Permission is required. Consent controls is one Legal check among others (Privacy policy, Terms page, Cookie signals). Closing a consent-UI finding does not retire the rest.

Also: a past lab screenshot of a banner on staging is not monitoring. SlaySlop keeps scanning live public sites across categories. Use lab notes and live scans honestly. Do not wave a staging GIF at a production host with the CMP key missing.

Happy path: catch the usual suspects on purpose

Walk the shipped chrome in a real browser with storage cleared.

Loading diagram.

bash
# Fresh-check reminder — open this URL in a clean profile next
echo "https://www.example.com/"
curl -sI "https://www.example.com/" | head -n 12

Mistake 1: CMP disabled on production

Staging had OneTrust / Cookiebot / a custom modal. Production env vars pointed at empty keys "temporarily." Temporarily survived launch. Visible consent signals: gone. Analytics: still there. Cookie signals will make that contradiction loud.

Mistake 2: Banner only after scroll or after a marketing hotspot

If the only consent entry point is a footer link that never mounts because the footer is behind a broken partial, the visible signal is effectively missing for most visitors. Consent controls cares about what is visible on the rendered page the scanner observed—not about a Figma frame of a footer that never shipped.

Mistake 3: "OK" as the only verb

A single accept-style control with no manage or reject path may still look like a consent signal. Whether that meets your legal bar is counsel's call. Operationally, clients still ask what happens on refusal. Document the behavior before the meeting. Pair with Cookie signals so you know what was set either way.

Mistake 4: Policy links that 404

The banner mentions a privacy policy. The href 404s. Privacy policy is a separate check ("Checks whether a public privacy policy can be found and reached"), but the client experiences it as one consent failure. Fix the link before you argue taxonomy.

Mistake 5: QA from an already-accepted profile

Your laptop accepted cookies on Monday. Thursday's QA never sees the first layer. The client's board member does. Process fix: clean profile checklist in the launch runbook, not another Slack reminder that nobody reads.

Pitfalls that create false calm

"We use Google Consent Mode" is not a visible signal. Consent Mode can be wired while the banner is broken. "We have a cookie policy page" is not a banner. Cookie inventory can look busy while Consent controls still flags missing UI.

Geo targeting without a test matrix is another trap. Someone in the agency office never sees the EU template. The scanner—or the client's EU teammate—does, or does not. Write down which regions you verified.

Mistake 6: Treating the scanner row as optional theater

Some teams mark Consent controls "N/A — counsel handles privacy." Counsel handles legal risk. The public page still either shows consent-related UI or it does not. If your SOW promised a banner, the scanner row is in scope for engineering and QA. If your SOW did not promise one, document that choice so nobody "fixes" the finding by inventing UI counsel never reviewed.

How agencies prevent the repeat

Add three lines to the launch checklist: clean-profile consent pass, production CMP key verified, privacy URL status code recorded. Put a name next to each line. Process that survives launch week is mostly names and URLs, not new tools. SlaySlop can re-check the public surface after the fix; it will not invent the checklist owner for you.

Related next step

Put Consent controls, Cookie signals, and Privacy policy on the same pre-call checklist. SlaySlop portals are useful when you only want to share the Legal findings without opening the entire workspace. Start with the tagged homepage. Cosmetic CMP animation timing can wait.

See Consent controls and the checks catalog.