Cookie Consent vs Cookie Banner: Are They the Same Thing?

A team ships a cookie banner. It has an Accept button and a Reject button. Legal signs off. Everyone moves on, reasonably confident the compliance box has been checked. Then, six months later, a researcher opens Chrome DevTools, clicks "Reject All," reloads the page, and watches Google Analytics fire anyway.

This happens far more often than most businesses realize, and it points to something important: a cookie banner and cookie consent are not the same thing. One is a UI element. The other is a promise about what your website actually does. The gap between them is where most compliance failures actually live.

The Banner Is the Question. Consent Is the Answer Being Honored.

A cookie banner's job is narrow: display a choice and record what the visitor selects. That's it. It doesn't inherently control anything. Whether the visitor's choice is honored — whether the scripts they rejected actually stop running — depends entirely on a separate layer of engineering that has to be wired up correctly behind the banner. A business can have a beautifully designed banner with equal-weight Accept and Reject buttons, full category granularity, and clean copy, and still be transmitting rejected data in the background because nobody connected the banner's output to the scripts it's supposed to gate.

Researchers have a term for this exact failure: "consent theater" — a banner that performs the appearance of choice without functioning as an actual control mechanism. It's not necessarily deliberate deception. It's usually an integration gap.

What the Largest Recent Study Found

The clearest evidence of this gap comes from a 2025 measurement study out of the University of Michigan, which built an automated auditing tool called ConsentChk specifically to test whether cookie banners honor the choices visitors make — not just whether a banner exists. The researchers crawled 1,793 globally popular websites across eight regions with different privacy laws, actually clicking "Reject" on each site's banner and then watching what cookies got placed anyway.

The results were difficult to read as anything other than a systemic problem. Between 96.18% and 97.72% of websites — depending on region — committed at least one detectable consent violation. The most common failure was what the researchers labeled "undeclared cookies": cookies placed on a visitor's browser that were never listed in the banner at all, meaning there was no way for the visitor to have rejected them even if they'd tried. These accounted for the majority of violations across every single region studied.

The second most common failure was more direct: cookies the researchers explicitly rejected being placed anyway. Depending on region, this "ignored rejection" failure showed up on somewhere between 80.74% and 88.41% of the sites tested. The most frequent offenders were the tracking cookies businesses rely on most — Google's _ga and _gid, and Meta's _fbp — the exact identifiers used for analytics and ad retargeting continuing to fire on visitors who had explicitly told the site not to track them.

Only 3.82% of the websites tested got this fully right — correctly enforcing every consent preference across every cookie the researchers checked.

Why a Compliant-Looking Banner Still Fails

The Michigan research also dug into why this keeps happening, and the answer maps cleanly onto the banner-versus-consent distinction. Most Consent Management Platforms (CMPs) — the third-party tools that generate the banner UI — rely on automatically crawling a site to detect scripts and build a cookie catalogue. But scripts that only load conditionally (an embedded YouTube video, a chat widget that activates on click, a script buried inside another script) routinely slip past that automatic crawl. The banner shows a clean, organized list of categories. The site is running cookies that were never on that list at all.

There's a second failure mode that's arguably more damning: even when a cookie is correctly declared and categorized, the actual blocking still depends on a developer having implemented it correctly. Both major CMP providers require specific technical steps — tagging script elements with particular attributes, placing the CMP's own script before every other tag in the page's head — and the researchers found that when these steps are skipped or done imperfectly, the banner's "Reject" button becomes cosmetic. The categorization is accurate. The enforcement simply isn't connected to it.

A separate strand of this research, examining the IAB Europe Transparency and Consent Framework specifically — the technical standard much of the ad industry uses to pass consent signals between publishers and advertisers — found comparable numbers: over half of banners built on that framework contained violations like pre-selected consent options or consent being logged before the visitor had made any actual choice.

The Legal Distinction Matters Too

This isn't only a technical curiosity — it maps onto how regulators actually evaluate compliance. Under GDPR's Article 7, consent has to be freely given and genuinely revocable, and recital guidance is explicit that a data subject who cannot meaningfully refuse or withdraw has not given valid consent in the first place. A banner that records a "reject" choice the underlying system doesn't act on isn't a technical bug from a regulatory standpoint — it's the same failure as never having asked at all, because the visitor's actual preference and the site's actual behavior have diverged.

Enforcement actions have already treated it this way. Regulators evaluating a company's cookie practices have looked past the banner's design and asked what data was actually transmitted after a visitor clicked reject — which is precisely the question a banner alone can never answer for you.

What Actually Closes the Gap

Getting consent right, as opposed to just displaying a banner, requires a few things working together that a banner by itself doesn't guarantee:

• Script-blocking that's actually wired to the banner's output, not running on a separate track. Rejected categories need to prevent the associated scripts from executing — not simply get logged as a preference while the scripts load regardless.
• Full detection, not just homepage detection. Since conditional and deep-linked scripts are where most undeclared cookies hide, the underlying cookie inventory needs to be rebuilt regularly, not scanned once at setup and left static.
• Verification, not assumption. The only way to know a banner is actually functioning as consent management — rather than consent theater — is to test it the way the Michigan researchers did: reject a category, reload, and check what's actually still firing.
   

The Bottom Line

A cookie banner is the part of consent management a visitor can see. Consent itself is what happens after they click — invisible, and far easier to get wrong. The research is consistent on this point across methodologies and regions: the overwhelming majority of websites with a banner still fail to honor the choices it collects. Having a banner tells you a business is aware of the requirement. It tells you nothing about whether that requirement is actually being met.