01
The banner
Many websites show a cookie banner with “Accept” and “Reject” buttons.
COOKIE COMPLIANCE
Consent should work, not just appear on screen.
Before choosing, on accepting, on rejecting and on withdrawing.
01 / 08The banner
A website asks permission to use cookies
The banner offers to accept or reject. The question is whether the website respects what the visitor chooses.
02 / 08Before choosing
Tracking starts before the answer
The visitor has not clicked anything yet and advertising cookies are already stored in their browser.
03 / 08The rejection
Rejecting changes nothing
The visitor clicks “Reject”, the banner closes and the advertising cookies are still there. The banner is displayed, but it does not work.
04 / 08The rule
Consent comes before cookies
Regulation 6 of PECR requires consent before storing or reading information on a device, unless an exception applies, and the ICO expects rejecting to be as easy as accepting.
05 / 08The test
Three clean visits to the same site
We open the website in three independent sessions, with no trace of earlier visits: one to accept and then withdraw consent, one to reject and one to customise.
06 / 08The inventory
We watch what appears at each step
Before choosing, after each action and after reloading the page, we record the cookies, local storage and network requests, and separate the necessary ones from the advertising and tracking ones and from those whose purpose is still pending.
07 / 08The evidence
Every visit is documented
We keep screenshots, video, a network log and a timeline of each session, in signed files that a third party can verify.
08 / 08The result
Findings that can be reproduced
The report states what was observed at each step, so that your team can fix the banner or assess a supplier. This is technical evidence of a specific visit. A third party can verify it and repeat the test; its legal assessment is a matter for the competent authority, a court or a professional.
Consent has to work, not just be displayed.
Description of each scene
- A website asks permission to use cookies. The page of an ordinary website opens and, at the bottom, the banner “This site uses cookies” appears with two buttons of the same size, “Accept” and “Reject”, joined by an equals sign. On the right, a bitten biscuit with a question mark and the question “Is the choice respected?”.
- Tracking starts before the answer. The banner is still open and the cursor has not clicked either button. On the right, the panel “Cookies in the browser” opens and three cookies appear one by one: “ads_uid”, “ad_click” and “retarget_id”, each with the red label “Advertising”. Three red dots light up in the browser’s toolbar. A red counter reads “Before choosing” and “3 advertising cookies”, and a timeline places “Tracking under way” before “Choice pending”.
- Rejecting changes nothing. The cursor clicks “Reject” and the banner closes. In the panel “Cookies in the browser” the three advertising cookies remain, outlined in red, and an arrow points outwards under the heading “Requests to third parties”. Below, two opposed cards separated by a “not equal to” sign: “What they chose”, with the “Reject” button, and “What happens”, with three cookies in red.
- Consent comes before cookies. Two cards: “Consent first”, with the reference “PECR, reg. 6”, and “Reject as easily as accept”, with the reference “ICO guidance”. Below, two example banners: one with “Accept” and “Reject” buttons of the same size, with the note “Equal options” and a tick; and another with a large “Accept” button and a small, barely visible “Reject”, with the note “Reject is hidden” and a cross.
- Three clean visits to the same site. The page loads again with its banner and the VigiaLabs lighthouse casts a beam over it. On the right, three lanes, one per session: “Accept and withdraw”, “Reject” and “Customise”. In each one, the checkpoints light up one after another.
- We watch what appears at each step. A scan line runs down the page under the light of the lighthouse. On the right, a table fills in, with the columns “Necessary”, “Advertising” and “Pending” and the rows “Before choosing”, “After accepting”, “After rejecting” and “After withdrawing”. Each row shows one necessary cookie and one pending; there are three advertising cookies in the first three rows and none after withdrawing. The advertising cookies under “Before choosing” and “After rejecting” are highlighted in red.
- Every visit is documented. Corner brackets frame the page and a flash marks the capture. On the right, a folder titled “Case file” opens with four pieces of evidence: “Screenshot”, “Video”, “Network log” and “Timeline”. Below it, the seal “Signed manifest” appears, next to the lighthouse.
- Findings that can be reproduced. A document titled “Report” shows four lines: “Before choosing”, with a cross; “After accepting”, with a tick; “After rejecting”, with a cross; and “After withdrawing”, with a tick. Then the page is shown corrected: the cursor clicks “Reject”, the banner closes, the red dots in the browser’s toolbar go out and the panel “Cookies in the browser” keeps only “consent_choice”, with the label “Necessary”. The counter is no longer red and reads “After rejecting” and “0 advertising cookies”.
IN SHORT
Cookie banners that are shown, but not respected.
A banner offers a reject option, but the website may not respect that choice. We review the information and test behaviour before a decision, after acceptance and after rejection, under PECR and, where applicable, the UK GDPR.
02
Before choosing
On some, advertising cookies are stored before the visitor chooses.
03
The rejection
On others, they are still there even if the visitor clicks “Reject”.
04
The rule
The law requires permission before cookies are used, apart from a few exceptions such as those that are strictly necessary.
05
The test
VigiaLabs visits the website, tries each button and notes which cookies appear at each step.
06
The evidence
It keeps the evidence in signed files and delivers a report. It is not a legal certificate.
HOW WE TEST IT
Four steps, from the visit to the report.
Reproducible findings to help technical and privacy teams prioritise improvements.
Moments that are recorded
- Before choosing
- After accepting
- After rejecting
- After withdrawing
Technical evidence, not a certificate
This is technical evidence of a specific visit. A third party can verify it and repeat the test; its legal assessment is a matter for the competent authority, a court or a professional.
- 01
Three clean visits to the same site
We open the website in three independent sessions, with no trace of earlier visits: one to accept and then withdraw consent, one to reject and one to customise.
- 02
We watch what appears at each step
Before choosing, after each action and after reloading the page, we record the cookies, local storage and network requests, and separate the necessary ones from the advertising and tracking ones and from those whose purpose is still pending.
- 03
Every visit is documented
We keep screenshots, video, a network log and a timeline of each session, in signed files that a third party can verify.
- 04
Findings that can be reproduced
The report states what was observed at each step, so that your team can fix the banner or assess a supplier.
Illustrative caseVL / CMP
What they choseThis site uses cookies
What happensads_uidAdvertisingad_clickAdvertisingretarget_idAdvertising
Cookies & UK GDPR
A consent management platform (CMP) does not guarantee cookie compliance
A consent management platform (CMP) displays the cookie banner and stores the visitor’s choice. Whether that choice is respected depends on how the CMP is connected to every tag, pixel and script on the website.
That is why a website with a CMP can still set advertising cookies before the visitor accepts or after they reject:
- 01tags that load outside the CMP
- 02a default setting that treats permission as already given
- 03third-party scripts added after the CMP was installed
- 04cookies that are not removed when consent is withdrawn
What you gainVigiaLabs does not replace a CMP: it checks, in separate visits, whether the website respects what the visitor chooses. The report describes what was observed; it is not a compliance certificate either.
GLOSSARY
The terms and the sources, in plain view.
Every case is documented with sources and context. Scope is agreed for each market; the references on this page are to the law of the United Kingdom.
- Cookie
- A small file that a website stores in the visitor’s browser.
- Advertising cookie
- A cookie used to track browsing for advertising purposes, for example to show or measure adverts.
- Necessary cookie
- A cookie that is essential to provide the service the visitor asks for, such as remembering their choice in the banner.
- Cookie banner
- A message that tells visitors about cookies and asks permission to use them.
- CMP
- Consent management platform: a tool that displays the cookie banner and stores the visitor’s choice.
- Clean session
- A visit with a browser that has no cookies or data from earlier visits.
- Regulation 6 of PECR
- The UK rule that requires consent before storing or reading information on a device, unless one of the exceptions in Schedule A1 applies.
- ICO
- The UK regulator for data protection and cookies, which publishes guidance on storage and access technologies.
- Signed manifest
- A list of the files of a test with their digital fingerprint and a signature, to check that they have not been altered.
FREQUENTLY ASKED QUESTIONS
Those who ignore consent gain an unfair advantage.
A website that keeps tracking after a rejection measures and advertises with data that those who comply do not have. Checking it and documenting it is the first step towards competing on equal terms.
A competitor sets tracking cookies without consent. How can I prove it?
With a technical test that can be repeated. VigiaLabs opens the website in three clean sessions, one to accept and then withdraw consent, one to reject and one to customise, and records the cookies, local storage and network requests before any choice and after each action. The report states what was observed at each step, with screenshots, video and a network log in signed files.
What does the law on cookies require in the UK?
In the UK, regulation 6 of the Privacy and Electronic Communications Regulations (PECR) requires consent before information is stored or read on a device, unless one of the exceptions in Schedule A1 applies, such as cookies that are strictly necessary. The ICO, the UK regulator for data protection and cookies, expects rejecting to be as easy as accepting and publishes guidance on storage and access technologies.
My website already has a consent management platform (CMP). Does it still need to be checked?
Yes: having a CMP does not guarantee compliance. The platform displays the cookie banner and stores the visitor’s choice, but whether that choice is respected depends on how the CMP is connected to every tag, pixel and script on the website. A website with a CMP can still set advertising cookies before the visitor accepts or after they reject.
Can a consumer organisation, a data protection officer or a privacy team use it?
Yes. A consumer organisation can check the websites its members use, such as banks, shops or service providers; a data protection officer or a privacy team, those of their own organisation and of its suppliers. The method is the same, and the report describes what was observed so that whoever is responsible can assess it.
Can the report be used as evidence before the ICO?
The report is technical evidence of a specific visit, which a third party can verify and whose test can be repeated. Its legal assessment is a matter for the competent authority, a court or a professional: it is not a compliance certificate and it is not a ruling.
LET’S LOOK FURTHER
A clearer view starts
with a conversation.
Tell us what you want to monitor. Together, we will define a scope that makes sense for your business.
Discuss your projectcontact@vigialabs.ai
A focused conversation about your goals, markets and priorities.