Amey-Thakur Cookie compliance
The rules cover any storage or reading on a user's device, not just cookies, and they apply before the storage happens. Most sites fail not at the banner but at the tags that fire while the banner is still on screen.
Method
- Inventory what actually gets set. Load the site with a clean profile and list every cookie, local storage entry, and pixel, along with what set it. Inventories written from memory are always wrong.
- Classify each as strictly necessary or not. Session, security, and load balancing are necessary; analytics, personalisation, and advertising are not, and the necessary category is narrower than most teams assume.
- Block non-essential scripts until consent. The tag must not load at all, rather than loading and being told to behave. This is the single most common failure (see consent-management).
- Cover embeds and third-party widgets. Video players, maps, chat widgets, and social embeds set storage on load, so gate them behind consent placeholders that explain what accepting enables.
- Keep the disclosure accurate and current. The cookie notice should match the inventory, including purpose and duration, and it drifts every time a tag is added, so re-check on release.
- Make withdrawal work in-session. Revoking should stop further collection immediately and clear what it can, not merely record a preference for next time.
Boundaries
- Rules differ by jurisdiction in what counts as necessary and whether consent must be prior; the technical mechanism is the same but the thresholds are not.
- A consent platform blocks tags it knows about; anything added outside it stays unblocked, so the inventory remains your responsibility.
- Server-side tracking is not exempt merely because it avoids cookies (see data-minimization).