Three stories landed in the same week, and they are the same story. On 25 September a jury in Santa Fe found Meta liable for what it said about privacy. On 22 September iPhone owners found that the banners Apple had added to Settings would not go away, however often they tapped “Don’t Show Again”. And all week, the cookie banner on your own site asked visitors a question you probably cannot prove you honoured.
That last one is the only one you control. So we measured it: we fetched the homepage of 100 Irish websites and checked whether anything in the page actually holds the tracking tags back until consent is given. Two can prove it does.
TL;DR
- A New Mexico jury found Meta liable for 43,899,720 violations arising from 26 public statements about privacy, not from the Cambridge Analytica leak itself. At up to $5,000 each, the theoretical exposure is roughly $219.5 billion.
- We fetched 100 Irish homepages on 27 September. Of the 70 that returned a usable page, 37 ship both a consent banner and tracking tags. Two hold every tag back in a way you can verify with curl.
- 30 of those 37 load at least one tracker tag with no visible brake. Only 7 of the 30 declare a Google Consent Mode default of “denied” in the page.
- We fetched the public Google Tag Manager container for 22 of the rest. It is not an audit surface: the consent boilerplate is present in all of them, including a site that provably does gate correctly.
- GDPR Article 7(1) does not ask you to collect consent. It asks you to be able to demonstrate it. For most Irish sites, nobody outside the browser can.
The jury priced the statements, not the breach
The detail most coverage skipped is the one that matters to your business. The New Mexico case was not decided on the 2018 data leak. It was decided on 26 public statements Facebook made about privacy, hate speech, misinformation and its own handling of the Cambridge Analytica affair. The jury found those statements produced 43,899,720 violations of the state’s consumer protection law. A judge, not the jury, now sets the figure.
Read that as an engineer rather than as a lawyer. The liability attached to the gap between a published claim and an implemented mechanism. Your cookie banner is a published claim, probably the most-served privacy statement your company makes, and it asserts something specific: that the visitor’s answer changes what happens next.
Apple’s “Don’t Show Again” does not show again
Apple spent September demonstrating the same gap at consumer scale. Promotional banners for iCloud+, Apple Music, Apple TV+ trials and AppleCare+ appeared near the top of Settings, and users reported dismissal controls that either did not exist or did not stick. One account, which reached 815 points on Hacker News, described an AppleCare prompt that “will not go away for me, no matter how many times I select ‘Don’t Show Again'”.
It is the same defect as the long-running complaint that iOS updates re-enable Apple Intelligence for people who had switched it off. The button is real; the persistence is not. The failure is specific and very common: the code path that re-asserts the default never reads the record of the refusal. Store “declined” as the absence of a row, and any new feature version, renamed flag or fresh install reads no row and helpfully assumes yes.
What we found on 100 Irish sites
On 27 September we made one HTTPS GET to the homepage of 100 Irish domains: news, banking, energy, retail, transport, universities, insurance, property and business bodies. No JavaScript was executed. We looked only at what the server sends anyone who asks, which is what an auditor reading your page would see.
Ninety-seven responded. Nineteen returned 403 to a non-browser client and one a 405, so we restricted every finding to the 70 that returned a real page. Of those, 46 ship a recognisable consent platform, led by OneTrust (27), TrustArc (11), Cookiebot (10) and Quantcast (10). 52 ship at least one tracking tag, with Google Tag Manager in 43. 37 ship both, and those 37 are the population that matters.
Thirty of the 37 serve at least one tracker tag with nothing in the markup holding it back. That is not proof a tracker fired. It is proof that nothing you can read in the page prevents it. Of those 30, only 7 declare a Google Consent Mode default of “denied” in the page itself, which is the other legitimate way to apply the brake. That leaves 23 sites where the banner makes a promise and the page contains no visible mechanism to keep it.
Separately, 17 of the 70 set an analytics, advertising or profiling identifier in a Set-Cookie header on that first response, before any banner could be answered: four Sitecore SC_ANALYTICS_GLOBAL_COOKIEs, ad cookies across five regional news titles, a Google Ads publisher-provided ID, an Optimizely end-user ID and two Salesforce Commerce customer IDs. Load balancer and bot management cookies were excluded.
The two that can prove it
Two sites, supervalu.ie and myhome.ie, gate every tracking tag in the markup. The pattern is worth copying:
<script type="text/plain" class="optanon-category-C0002">
!function(f,b,e,v,n,t,s){ /* Meta Pixel */ }
</script>A browser will not execute a script whose type is text/plain. It is inert markup. The consent platform rewrites that attribute to text/javascript only after the visitor accepts, and only for the categories accepted. The enforcement is not a policy, a ticket or a setting in somebody else’s dashboard. It is a property of the document, and anyone can check it in one request.
That is the transferable idea, and it travels well beyond cookies: the attribute is the access control. The same instinct that says a lint rule beats a style guide entry says a non-executable type beats a promise that a tag manager will behave.
The container is not an audit surface
We gave the other 23 the benefit of the doubt, because consent defaults can be configured inside the GTM container rather than in the page, and fetched the public container for the 22 that exposed an ID.
The check has no discriminating power, and that negative result is worth printing. All 22 reference ad_storage and analytics_storage, and all 22 contain the string “denied”. So does supervalu.ie’s container, and supervalu.ie provably does gate its tags. One site that enforces consent and one whose enforcement is unknown returned a 628 KB bundle with the same six occurrences of “denied”. The boilerplate ships regardless of configuration.
For most of these sites, nobody outside the browser can tell whether the banner does anything at all: not you, not your data protection officer, not a regulator.
What the law actually asks
In Ireland, non-essential cookies require prior consent under Regulation 5(3) of SI 336/2011, and the Data Protection Commission is explicit that analytics is not strictly necessary. The sharper obligation is in the GDPR. Article 7(1): “the controller shall be able to demonstrate that the data subject has consented.” Article 7(3): “It shall be as easy to withdraw as to give consent.”
Demonstrate. Not collect, not intend, not configure. If your only evidence is a screenshot of a banner and a vendor’s assurance, you have the Meta problem in miniature: a published claim with no mechanism you can show anyone.
What to do this week
- Run the one-request test on your own site. Fetch your homepage with curl and grep the HTML for your tag manager, pixels and analytics. Live script tags rather than
type="text/plain"means the page proves nothing. - Check your
Set-Cookieheaders on the first response, before any interaction. Sitecore, Salesforce Commerce and similar stacks will set a visitor identifier server-side without asking. - Move enforcement into the artefact you own, so the brake is visible in the document rather than buried in a container.
- Store refusals as first-class state. A missing row is not a “no”. Record it with a timestamp and a version, and make every path that re-asserts a default read it.
- Re-test after every deploy. Consent enforcement is not a project, it is a regression test.
At REPTILEHAUS we build and audit this plumbing across web, SaaS and DevOps work, and the consent layer is almost always the part nobody owns: marketing chose the vendor, legal approved the wording, and no engineer was asked to prove the two are connected. If you want to know what one curl request says about your site before somebody else runs it, get in touch.
Your banner is a statement about privacy. A New Mexico jury has just finished pricing those.
Methodology: one HTTPS GET per homepage on 27 September 2026, no JavaScript executed. An ungated tag is evidence of absent proof, not of a violation, and a container may be correctly configured where we cannot see it. Sites returning 403 were excluded. Detection is signature-based.
📷 Photo by fotokomplizin.de on Unsplash
