This post is informational and reflects the state of the law as of April 2026. For advice on your site’s configuration, consult a licensed attorney.
A cookie banner looks like a design element. Legally, it is a representation you make to every visitor, and a wave of class actions is built on the gap between what the banner promises and what the site actually does.
A 2026 class action filed in the Northern District of California illustrates the pattern. It alleges that a national retailer’s website told users they could opt out of tracking, and then kept tracking them anyway: analytics and other third-party tools still firing after the user clicked decline. Those are allegations, not findings. But the fact pattern is the point, because it is not the failure most teams are watching for.
Two different failure modes
The one everyone knows is pre-consent loading: trackers that fire before the banner appears or before the user chooses. This case is the other one. The banner was present, and the opt-out appeared to work, but the trackers kept running regardless. That is a consent-management-platform configuration failure, and it is easy to miss precisely because the banner looks like it is doing its job.
Having a CMP is not the same as being compliant
A consent management platform only helps if it is configured to honor what it promises. When you tell every visitor that declining means they will not be tracked, and tracking continues, you have arguably made a false statement to each of them, and that is where the liability sits. The platform’s presence does not transfer the obligation; it just makes it easier to assume the problem is handled.
The two-minute check
Open your own site, click decline, and watch the network tab to see what still fires. Most legal teams never do this; they assume the vendor handles it. Do that check before you assume your banner is protecting you rather than documenting a promise you are not keeping. (For the broader privacy-litigation picture, see the firm’s Privacy & Data Security practice.)
If you are not certain your consent banner does what it says, talk to MB Legal.
This post is informational and does not constitute legal advice. The referenced lawsuit describes allegations that have not been proven. For guidance on your site, consult a licensed attorney.
Questions for MB Legal? Let's talk.
Let's Talk