When the Banner Says One Thing and the Website Does Another: The Legal Risk of Privacy Choices That Are Not Operationalized

A cookie banner is not just a design element; rather, it is a statement to every visitor about what the business will and will not do with their data, and the privacy notice behind it is a second, more detailed statement. When a visitor clicks “Reject All” and tracking continues, or an opt-out stops one data flow while others keep running, the business has made a representation that its systems do not keep.

That gap between promise and practice has become one of the most active sources of privacy risk in the United States. For example, California and numerous other state privacy and related regulators now test whether opt-outs actually work, not just whether a link exists. The FTC has long treated broken privacy promises as deception. And a growing wave of class actions targets banners that, in plaintiffs’ words, do not do what they say.

We have written about cookie banner and consent compliance and about what consent management platforms can and cannot do. This article focuses on the step that sits between them: making sure the choices a business offers are carried out everywhere the data goes, and the legal consequences when they are not.

How the Gap Opens

Most mismatches are not deliberate. They come from privacy choices being presented in one place, by one team, while data moves through systems configured by others. Regulators and plaintiffs have focused on a handful of recurring patterns:

• Tracking before the choice. Scripts load as the page opens, before the visitor has interacted with the banner.
• A “reject” that rejects some things. The banner blocks certain tags, but others are miscategorized as “strictly necessary” or were never placed under the consent tool at all.
• Opt-outs that stop at the edge of one property. A choice is honored on one website, device or app but not on the related services the business links to the same person for advertising.
• Signals that are ignored. Browser-based opt-out signals such as the Global Privacy Control are not detected, or are applied to one session rather than the account.
• Data that travels after collection. Information gathered under one permission is passed on through server-side connections, platform integrations or data uploads that never consult the visitor’s choice.
• Notices that drift. The privacy policy describes practices as they stood a year or two ago, before new vendors and tools were added.
• Contracts that do not match the promise. Vendors receive data under click-through terms that permit uses the privacy notice says will not happen.

Each of these turns a compliant-looking interface into a misstatement. The technical details vary but the legal problem is the same.

A Current Example: Analytics Data Routed to Ad Platforms

A recent analysis by Wheelhouse DMG, a marketing agency serving regulated industries, illustrates the post-collection problem well. Its focus is Google Analytics 4. A consent banner can let a visitor accept analytics while refusing advertising, and the banner can correctly block the advertising tags. But if an administrator has linked the GA4 property to Google Ads or Meta, analytics data collected under the first permission can flow to an advertising platform through a server-to-server connection that never checks the second.

Wheelhouse also points out that GA4 stores full page URLs, which commonly carry ad-click identifiers, so data described as “aggregated” can be traceable to individual visits. Its recommendation for healthcare and other closely regulated advertisers is to stop using these integrations.

Google has started to respond. Under its 2026 data control changes, Google Ads consent settings will govern how linked GA4 data is used. Those changes depend on correct configuration, apply only to Google’s own products, and by Google’s own description restrict sharing by default only for European users.

The legal point is broader than any one tool. A visitor who declined advertising cookies was told, in effect, that their data would not be used for advertising. Any connection that sends their data to an ad platform anyway makes that statement untrue, whether it runs through an analytics integration, a customer data platform, an offline conversion upload, or a server-side tag.

Regulatory Exposure

Regulators have stopped grading privacy programs on paper. The question in nearly every recent action is whether the choices a business offers actually change what happens to the data.

California: opt-outs must work end to end

Every public CCPA enforcement action to date has involved the right to opt out of sale or sharing, and the theme is consistent: a mechanism that exists but does not fully function is a violation.

• Tracking triggers the obligation. CalPrivacy fined PlayOn Sports $1.1 million for tracking-based sharing with no effective way to opt out. Its email and phone opt-out channels could not stop pixels from firing, and its privacy policy said it did not sell or share data when it did.
• Partial opt-outs are not opt-outs. The Attorney General’s $2.75 million settlement with Disney rested on mechanisms that each stopped some data flows but left third-party ad tech and other services running. The principle: if a business can connect a person’s devices and services for advertising, it must connect them to honor that person’s opt-out.
• Misleading choices are deceptive. The Disney injunction bars interfaces suggesting a cookie setting is a complete opt-out when it is not, and the AG framed incomplete opt-outs as a deception problem under the Unfair Competition Law.
• Friction and asymmetry count. CalPrivacy has penalized Honda for lopsided choices and Ford for adding friction to opt-outs, and Tractor Supply for opt-out failures.
• Contracts must back up the promise. Healthline, Honda and Todd Snyder all involved ad-tech or vendor relationships without the contractual limits the CCPA requires, so data left the business without restrictions consistent with what consumers were told.

California, Colorado and Connecticut are also running a coordinated sweep on Global Privacy Control compliance, and CalPrivacy settlement orders now require periodic scans of tracking technologies and, since January 1, 2026, formal risk assessments.

The FTC: privacy promises are advertising claims

Under Section 5 of the FTC Act, a privacy statement that does not match practice can be a deceptive act, with or without a specific privacy statute. The FTC’s case against GoodRx turned on sharing health information with advertising platforms contrary to the company’s privacy promises; BetterHelp followed the same pattern. State attorneys general bring parallel claims under their own consumer protection laws; Connecticut’s 2026 settlement with TaxAct over data shared with Meta and Google through tracking tools is a recent example discussed in our pixel litigation guide.

Other states and Europe

Most comprehensive state privacy laws grant a right to opt out of targeted advertising, require consent for sensitive data, and require assessments for advertising-related processing. In Europe, where consent is generally required before non-essential cookies are set, regulators have issued large fines specifically for reject buttons that did not work: France’s CNIL fined SHEIN €150 million and the publisher of vanityfair.fr €750,000, in part because refusing or withdrawing consent did not stop cookies from being set or read.

Litigation Exposure: The “Broken Banner” Class Action

Businesses added cookie banners in large part to defend against CIPA wiretapping claims. Plaintiffs have now turned the banner itself into evidence. As ZwillGen put it this spring, “no good deed goes unpunished,” as the mitigation measure has become the target: complaints allege that a site offered “Reject All” and then kept loading advertising technology anyway.

The filings in 2026 alone include suits against Kenneth Cole, GoFundMe, Ace Hardware and Farmers Insurance. The Farmers complaint quotes the banner’s own promise that visitors could reject targeting cookies, and alleges the company’s dashboards showed data still flowing after opt-outs. Several of these cases are getting past the pleading stage:

• A federal court allowed invasion of privacy and intrusion claims against Burger King’s parent to proceed, finding that a promised opt-out followed by continued sharing could amount to a concrete loss of control over personal information.
• Claims against MyFitnessPal survived in part in February 2026, including a California constitutional privacy claim based on not honoring banner opt-outs.
• Dollar Tree lost a motion to dismiss privacy, intrusion, and CIPA claims over its banner before the plaintiff voluntarily dismissed.

Three features make these cases dangerous for defendants.

They do not depend on wiretap technicalities. Claims for intrusion upon seclusion, invasion of privacy under the California Constitution, fraud, breach of an implied promise, and unfair competition rest on the mismatch itself. That matters because the wiretap theories are narrowing: SB 690, signed on September 30, 2026, ends private pen register claims for website and app conduct starting January 1, 2027, in California. Section 631 wiretap claims remain, and the broken-banner theories are unaffected.

They borrow regulatory standards. The CCPA gives consumers no private right of action for opt-out failures, but plaintiffs cite its opt-out rules as evidence of what a reasonable person expects, then sue under laws that do allow private suits.

They defeat the consent defense. Consent is the strongest defense to most tracking claims. Courts have accepted it when banners and terms were clear and functional, as in Lakes v. Ubisoft, discussed in our pixel litigation guide. A banner that records a refusal does the opposite: it documents that the visitor said no.

Higher Stakes for Health and Other Sensitive Data

When the data involved reveals health conditions, the same mismatch triggers additional laws with stricter rules and, in some cases, private rights of action.

• HIPAA. Covered entities and business associates cannot disclose protected health information to tracking or advertising vendors without a business associate agreement or authorization. Google, for example, states that it does not sign BAAs for Google Analytics. Federal wiretap claims gain force here, because courts have applied the ECPA’s “crime-tort” exception where the disclosure itself would violate HIPAA.
• Consumer health data laws. Washington’s My Health My Data Act requires separate consent to collect and to share consumer health data and allows private suits; Nevada and Connecticut have related rules. New York’s Health Information Privacy Act, vetoed in 2025, returned in revised form and passed the State Senate in June 2026.
• The FTC. Beyond Section 5, the Health Breach Notification Rule can treat an unauthorized disclosure of health app data to an advertising platform as a reportable breach, as in GoodRx.
• Comprehensive state laws. Most require opt-in consent for sensitive data, and Maryland’s law bars its sale outright.

For healthcare providers, telehealth, MedTech and wellness brands, a consent mechanism that does not reach every data flow is not a compliance gap to fix later. It can amount to an unauthorized disclosure of health information. Our health information privacy practice covers these overlapping regimes.

Making the Promise Match the Practice

The fix is less about any one tool than about treating every privacy statement as a commitment that someone is responsible for keeping.

1. Start with the promises. Collect every statement the business makes about data use: banner text and categories, preference center labels, the privacy policy, app store disclosures, and marketing claims. List what each one commits the business to.
2. Map each promise to the systems that must honor it. For every choice a visitor can make, identify each place their data can go: tags, SDKs, server-side connections, platform integrations, customer data uploads, and vendors. Admin-level links between accounts, such as analytics-to-advertising integrations, belong on this list.
3. Test in practice, not just in configuration. Verify behavior with no choice, after acceptance, after rejection, and with GPC enabled, across properties, devices, and logged-in states. Regulators and plaintiffs test this way, and so should the business.
4. Fix the language or fix the system. Where a statement and a data flow disagree, either change the flow or rewrite the statement so it is accurate. Labels like “strictly necessary” deserve particular scrutiny.
5. Align the contracts. Make sure each vendor and platform receiving data is bound by terms consistent with what consumers were told, including the CCPA’s required restrictions. Click-through platform terms often are not. Our DPA practice handles this review.
6. Keep the privacy notice current. Update the privacy policy at least annually, and whenever a new vendor or integration is added. We discuss why annual updates have become an enforcement priority.
7. Put changes under governance. Require privacy review before anyone adds a tag, links accounts, or onboards an ad-tech vendor, and limit who has the admin rights to do so.
8. Monitor and document. Run periodic scans of tracking technologies, keep records of tests and fixes, and complete the risk assessments California and other states now require for advertising-related processing. That record is also the best evidence of good faith if a regulator or plaintiff comes calling.

The Bottom Line

A cookie banner, preference center, or privacy notice is only as good as the systems behind it. When those systems do not honor what the business has told people, the banner stops being a shield and becomes evidence for regulators testing opt-outs and for plaintiffs building class actions. The businesses best positioned today are the ones that treat each privacy choice as an obligation to be carried out everywhere their data goes, and that can show they checked.

---

RICHT helps businesses audit and align their cookie banners and consent mechanisms, privacy notices, targeted advertising practices, and CCPA compliance, so that what they promise is what actually happens. Contact us to discuss a review.

---