Consent Gating Failures Are Leading to Expensive Privacy Lawsuit Settlements

For 40 days in 2023, a clothing retailer’s website showed visitors a cookie preferences link. Clicking it opened a consent banner that immediately disappeared, so no one could use it to opt out of the sale or sharing of their data. The company’s opt-out signal handling was not working either. In May 2025, California’s privacy regulator announced a $345,178 enforcement action against the retailer, Todd Snyder, Inc. According to law firm summaries of the order, the agency found that the company relied on a third-party privacy management tool without understanding its limits or validating that it worked. Nothing about that story involves a hacker, a data breach or a sophisticated scheme. It is a consent gating failure: a website that looked compliant, because it displayed a banner, while behaving non-compliantly, because the banner did not control what actually ran. It is also the failure pattern that feeds the machinery of privacy litigation. In Coalition’s State of Web Privacy report, one of the four plaintiff firms that drive most web privacy demand letters built its playbook around exactly this problem, sending letters about misconfigured privacy controls in which users were allegedly tracked even after opting out.

Consent Gating, Defined

A banner is an interface. A gate is an enforcement mechanism. The difference is the whole story. Consent gating is the technical control that decides, before any non-essential script, tag, pixel or cookie runs, whether the visitor’s recorded choice allows it. A working gate keeps three states correct at all times:

• Before a choice is made. Non-essential tracking technologies stay off until the visitor opts in, in jurisdictions and contexts where consent is required.
• After the visitor opts in. Only the categories and vendors the visitor accepted are allowed to run.
• After the visitor opts out or sends a signal. A rejection, a withdrawal of consent or a Global Privacy Control signal immediately and persistently stops the relevant tracking, including on later pages and later visits.

A consent gating failure is any gap between the choice the visitor made, or should have been given the chance to make, and what the website actually did. The banner can look flawless. The preference center can record every click. If a third-party pixel still fires, the gate has failed.

Why the Stakes Are High

Three data points frame the risk.

• Most privacy claims begin on websites. In Coalition’s data on wrongful collection claims, 77 percent arose from website activity, and nearly three-fourths of web privacy claims alleged violations of the California Invasion of Privacy Act, a statute that carries statutory damages of $5,000 per violation in the demand-letter practices the report describes.
• The usual targets are the usual tags. The Meta Pixel was cited in 43 percent of web privacy claims, and 34 percent alleged wrongful sharing with third-party vendors. When a pixel fires without valid consent, it matches the pattern of the claim.
• Having a banner is not enough. Coalition’s scans found that only 19 percent of websites displayed a consent banner at all, but the more important lesson is what regulators and plaintiffs test: not whether a banner exists, but whether it controls behavior.

The insurance data points the same way. CyRisk, an insurance-facing risk analytics firm, reports that CIPA cases now account for 34 percent of all third-party cyber liability claims, up from 7 percent in 2023. Every one of those claims turns on what a website did and what the visitor agreed to before it happened.

The Seven Ways Consent Gating Fails

Failures cluster into seven recurring modes. Each is common, and each is detectable by someone with a browser and a few minutes.

Failure mode	What happens	How it is typically found	Claims it can feed
1. Race conditions and hard-coded tags	The tag loads before the consent platform initializes, or is hard-coded in a theme, plugin or template outside the gate	Loading a page with a clean browser and recording network requests before any interaction	Wiretapping, pen register and unauthorized sharing allegations
2. A banner that does not block	The banner appears and records choices, but tags fire regardless of the selection	Comparing network activity before and after clicking reject	Allegations that consent was illusory; tracking after opt-out
3. Opt-outs that do not stick	A rejection or withdrawal is recorded but already-loaded tags keep running, or the choice is not remembered across pages, subdomains or return visits	Navigating several pages and revisiting after rejecting	Tracking after opt-out; deception claims about preference tools
4. Tag manager bypass	Tag manager triggers are not tied to consent state, custom tags ignore the gate, or a vendor’s tag loads other vendors	Reviewing tag manager containers and watching for secondary requests	Claims counting each undisclosed vendor as a separate violation
5. Ignored signals	Global Privacy Control, IAB TCF or GPP signals are not honored or not passed to downstream vendors, or consent mode is not wired correctly	Testing with a GPC-enabled browser and inspecting consent strings	State privacy law enforcement; opt-out signal claims
6. Server-side and app paths	Server-side events, conversion APIs and mobile SDKs send identifiers regardless of the web banner state	Reviewing server logs, event configurations and app traffic	Sharing claims that never touch the browser
7. Drift	A redesign breaks the banner, a vendor update adds sub-vendors, a marketer adds a tag, or the consent platform fails open during an outage	Recurring scans that compare behavior with the approved configuration	All of the above, arriving silently

Design problems create a related exposure. California’s regulator fined American Honda Motor Co. $632,500 in March 2025, in part because its cookie banner required two steps to opt out but only one to opt in, and because it lacked compliant contracts with downstream advertising vendors. A gate that works technically can still fail legally if the choice it records was not freely and fairly presented.

How a Gating Failure Becomes a Demand Letter

Gating failures are attractive to plaintiffs because the evidence is cheap to collect and the damages theory scales.

1. Detection. A plaintiff firm or its vendor loads the page in a controlled browser, with and without interacting with the banner, and records the network requests and a screen capture. No access to your systems is required.
2. Documentation. The recording shows which third-party domains received requests, when and under which consent state. A tag that fires before a choice, or after a rejection, is the exhibit.
3. Template. The finding is dropped into a demand letter. Coalition’s data shows that four firms represented the claimants in 72 percent of web privacy claims, using templated letters designed to settle before a lawsuit is filed.
4. Multiplication. Because statutory damages are generally a fixed amount per violation, each third-party vendor that received data can be counted separately. Coalition describes a demand of $5,000 per vendor on a site with at least 56 vendors, which totaled $280,000 for a single page load.
5. Pressure. The business must weigh a modest settlement against the cost of investigating, defending and potentially litigating, which is why Coalition reports that some targets lean toward nuisance-value settlements.

Why consent is the defense that gating failures destroy

Many wiretap and privacy theories give the defense a path through consent: if the visitor validly agreed before the data flowed, the claim weakens. That is why gating matters so much. Consent obtained after a tag has already fired does not cure the earlier transmission, and a banner that records a rejection but does not stop the tag converts what could have been a defense into evidence of knowledge. Whether any given theory succeeds depends on the statute, the court and the facts, but a business that cannot show valid, prior, enforced consent has surrendered its best argument.

What the litigation record shows

Pixel and tracking litigation has produced large outcomes. Coalition cites healthcare pixel settlements of $18.4 million (Mass General Brigham, 2022) and $12.25 million (Advocate Aurora Health, 2023), and our breakdown of the $18.7 million Aspen Dental pixel tracking settlement shows what a case looks like when tracking and consent collide. In August 2025, a jury found Meta liable under the California Invasion of Privacy Act in Frasco v. Flo Health, a case involving tracking code in a health app, while Flo Health, Google and Flurry settled for a combined $59.5 million. California’s SB 690, signed on September 30, 2026, removes the private right of action under the pen register provision for conduct on websites and apps starting January 1, 2027. That eliminates one popular theory, but it leaves the wiretapping and recording provisions, other states’ laws, federal law and regulatory enforcement in place. Those remaining theories all depend, in some way, on what the visitor consented to and what the website did. As the pen register theory fades, consent gating becomes more important, not less.

The regulator’s version of the same story

Regulators test the same things. The enforcement actions against Todd Snyder and Honda both turned on opt-out mechanics: a banner that did not work, a signal that was not honored, a process that was harder to use than it should have been, and a vendor relationship that had not been verified. The lesson that law firms drew from the Todd Snyder order is blunt: businesses cannot deploy a consent tool and assume compliance, and must audit and validate the tool’s actual operation.

What a Working Gate Requires

A consent platform can be excellent and still fail if it is deployed carelessly, and a modest one can hold up under scrutiny if it is configured and verified well. These ten requirements apply to any vendor.

1. Block, don’t just signal. Non-essential scripts should not load until consent is recorded. Telling a vendor’s tag that consent is denied is weaker than keeping the tag off the page.
2. Load first. The consent platform must initialize before any other tracking script, and no tracker should be hard-coded outside its control.
3. Cover every route. Tag managers, plugins, themes, embedded widgets, iframes, single-page app navigation and server-side events must all respect the same consent state.
4. Honor signals automatically. Global Privacy Control must be recognized without the visitor taking extra steps, and TCF or GPP strings must be passed accurately to downstream vendors where those frameworks are used.
5. Make opt-outs persistent. A rejection or withdrawal must stop tracking immediately and be remembered across pages, subdomains, sessions and devices where it can be.
6. Present fair choices. Rejecting should be as easy as accepting, with symmetrical paths and neutral wording.
7. Fail closed. If the consent platform is slow, blocked or unavailable, tracking should stay off rather than defaulting to on.
8. Configure by jurisdiction. Opt-in and opt-out regimes differ, and a gate that treats every visitor identically will either over-collect or over-block.
9. Keep records. Timestamped consent and opt-out records show what each visitor saw and chose.
10. Verify continuously. A gate that worked at launch can break after the next site change, so independent, recurring testing is part of the control, not an extra.

The last item is where most programs fall short. The Todd Snyder order is a case study in what happens when a business assumes the tool works and does not check.

Test Your Own Gate in an Hour

You do not need special software to find the most common failures. Use a clean browser profile and your browser’s developer tools to record network activity. Repeat on your highest-traffic pages and your checkout, form and login flows.

Test	How to run it	A failure looks like
1. Before any interaction	Load the page and record requests for a minute without touching the banner	Requests to advertising, analytics or social domains before a choice
2. Reject all	Reject everything, reload and navigate several pages	Non-essential requests continue, or the banner returns repeatedly
3. Accept selectively	Accept only one category, then review requests	Tags from declined categories still fire
4. Opt-out signal	Enable Global Privacy Control in a supporting browser and load the site	Tracking proceeds despite the signal
5. Withdraw consent	Accept, then reopen preferences and withdraw	Tags continue to run after withdrawal
6. Navigation and subdomains	Move between pages, subdomains and a single-page app route	Consent state resets or tags reappear
7. Embedded and server-side paths	Check embedded widgets, forms and server-side event configurations	Identifiers sent regardless of consent
8. Change test	Repeat after any site, tag manager or marketing change	A new tag appears outside the gate

Save the results with dates and screenshots. If you find a failure, fix it with counsel’s guidance and document the remediation. A record of prompt testing and correction is itself valuable evidence of good faith.

Where Captain Compliance Fits

Consent gating failure is the problem Captain Compliance is built around, and we want to describe our approach precisely, including its limits. No consent platform, ours included, can promise immunity from privacy or wiretapping claims. Outcomes depend on the facts, the jurisdiction, the statute and the court. What a well-built platform can do is make the gate enforceable, make it configurable to your risk and jurisdictions, and make it provable. That is how we approach it.

• A gate designed to block before consent. Our consent management platform is built to hold non-essential tags until a visitor opts in, to honor Global Privacy Control signals and to record each choice, across the properties a business operates. It is used on more than 8,000 websites and processes more than 50 million consent choices per month.
• Configurable to your jurisdictions and risk posture. Opt-in and opt-out regimes, vendor and category rules, and the treatment of sensitive properties can be tuned to the business, which matters because the right gate for a patient portal is not the right gate for a recipe blog.
• Independent verification that it worked. Patrol scans a live URL the way a plaintiff’s tool or a regulator would. It inventories trackers and cookies that fire before any consent interaction, runs a dedicated Global Privacy Control pass that simulates a visitor with the signal enabled, validates IAB TCF v2 and GPP signals, detects Google Consent Mode, and checks for dark patterns such as asymmetric consent paths and missing reject options. Findings are mapped to the privacy statutes they implicate.
• Evidence you can use. Patrol’s output is SHA-256 verified and includes screenshot archives and dated scan records documenting the consent interface at the time of the scan, which supports regulatory response and litigation readiness.
• Disclosures that match reality. Hosted privacy notices and vendor disclosures update as your technology changes, so what you say stays aligned with what your site does.
• Help with the hard part. Switching platforms is where many gating failures begin, so our team handles configuration, migration, testing and launch to help you upgrade without disrupting your site or operations.
• Litigation support, under defined terms. Captain Compliance also offers Compliance Shield, which provides defined litigation support for qualifying deployments under separate terms. If protection against claims is part of what you are buying, read those terms; they, not marketing copy, define what is covered.

For more on how these claims arise, see our pages on CIPA and our analysis of Coalition’s State of Web Privacy data. If you want to see how your own site behaves before a visitor’s choice, run a free privacy audit or book a demo.

Ten Questions to Ask Any Consent Platform Vendor

These are the questions we think every buyer should ask, of us and of everyone else. A vendor that cannot answer them clearly is a vendor you should test before you trust.

1. Does the platform block scripts before consent, or only signal consent state to them?
2. How does it guarantee it loads before other tracking scripts, and what happens to tags hard-coded outside it?
3. How does it handle tag manager containers, embedded widgets, iframes and single-page apps?
4. Is Global Privacy Control honored automatically, and how can we verify it?
5. How do server-side events and mobile SDKs respect the same consent state?
6. What happens if the platform fails to load or is blocked? Does it fail closed?
7. Can we configure rules by jurisdiction, vendor and category, and see an audit trail of configuration changes?
8. What records does it keep for each visitor, and can we produce them for a regulator or in discovery?
9. What independent testing do you recommend, and how often?
10. What exactly will you do if a gating failure is found on a live site, and who is responsible for the remediation?

Frequently Asked Questions

What is consent gating failure?

Consent gating failure is any gap between a visitor’s consent choice and what a website actually does, such as a tracking pixel that fires before consent, after a rejection or despite a Global Privacy Control signal. The banner may look compliant while the underlying scripts ignore it.

How does a consent gating failure lead to a lawsuit?

Plaintiff firms can record a website’s network activity with and without interacting with the banner, then use the results in templated demand letters. Because consent is a key defense in many privacy and wiretapping theories, a tag that fired without valid prior consent weakens that defense, and fixed statutory damages can be multiplied across vendors.

Does having a cookie banner protect my website?

Not by itself. A banner protects you only if it controls what loads. Regulators have fined businesses whose banners were misconfigured or whose opt-out mechanisms did not work, and plaintiff firms have built letter campaigns around users who were tracked after opting out.

What was the Todd Snyder enforcement action?

In May 2025, California’s privacy regulator announced a $345,178 enforcement action against Todd Snyder, Inc. over, among other things, a cookie banner misconfiguration that for 40 days prevented consumers from opting out and the company’s failure to validate its privacy management tool.

Does California’s SB 690 reduce the importance of consent gating?

No. SB 690 removes the private right of action under the pen register provision for conduct on websites and apps starting January 1, 2027, but it leaves the wiretapping and recording provisions, other state laws, federal law and regulatory enforcement in place. Those remaining theories all turn on what the visitor consented to.

Can a consent management platform guarantee protection from privacy claims?

No platform can guarantee outcomes. A well-built, well-configured and continuously verified platform can reduce exposure and provide records that support a defense, but results depend on the facts, jurisdiction and court. Any promise of protection should be read against the vendor’s written terms.

How often should I test my consent banner?

Test at launch, after every site, tag manager or marketing change, and on a recurring schedule through automated scanning, because gating failures often appear silently when something changes.

Why do consent gates fail after launch?

Common causes are marketing adding tags outside the gate, vendor updates introducing sub-vendors, site redesigns breaking the banner, caching or regional detection errors, and a consent platform failing open during an outage. This is why continuous verification matters.