Cookies, pixels & trackers
Cookies, pixels, and trackers are under intense regulatory scrutiny. Getting consent right is both a legal obligation and a user experience consideration.
By Sergio Maldonado Elvira, Attorney, State Bar of California · FIP, CIPP/US, CIPP/E, CIPT
Published · Last reviewed
Key points
- →Implement proper consent management platform
- →Categorize trackers by purpose and necessity
- →Block non-essential trackers before consent
- →Document tracker vendors and data flows
Implement a proper consent platform
Cookie banners with only an 'Accept' button don't cut it. You need a full Consent Management Platform (CMP) offering: granular category choices, easy rejection, preference persistence, and consent logging. Tools like OneTrust, Cookiebot, or open source options work.
Categorize trackers correctly
Not all cookies are equal. Strictly necessary cookies (authentication, shopping cart) don't need consent. Everything else does: analytics (performance), advertising (targeting), social media. Categorize accurately—miscategorization invites enforcement.
Block before consent
Non-essential trackers must not fire until users consent. This requires technical implementation: tag management with consent mode, scripts that wait for consent signals. Soft consent (assumed from scrolling) is not valid under GDPR.
Document your tracker ecosystem
Maintain a tracker inventory: what it is, who provides it, what data it collects, where that data goes. This feeds your privacy policy disclosures and audit responses. Review regularly as your marketing stack evolves.
Related reading
This guide is general information, not legal advice. Reading it does not create an attorney-client relationship. The law is stated as of January 23, 2026.
Got questions?
Every business is different. Let's discuss how these principles apply to your specific situation.
Book a call