Consent is a build-time decision, not a banner bought later
GDPR (EU) and CCPA/CPRA (California) share a principle: tracking technologies need the user's informed consent before they run, which means the analytics tags, marketing pixels and embedded widgets that set non-essential cookies must be blocked until consent is given, not fired first and apologized for. That is architecture: the consent mechanism has to gate every script at build time. Bolting a banner onto a site whose tags already fired is compliance theater, and regulators have started noticing the gap.
What "done properly" means at build time
- Classification first. Every cookie and script on the site gets sorted: strictly necessary (always on), functional, analytics, marketing. The list drives the banner categories, and it changes when scripts are added, so it lives in documentation, not memory.
- A consent management platform (CMP) wired to the tag system. The CMP records consent state and the tag manager fires nothing without it. WordPress has capable plugins; custom builds use vetted CMPs, the requirement is the gating, not the brand.
- Reject as easy as accept. Equal-effort buttons, no guilt-nagging color games, pre-ticked boxes banned. Regulators have fined the dark patterns specifically.
- Proof of consent. Logged with timestamp and policy version, the record is what makes the consent defensible.
The boundary, stated plainly
Whether your operation falls under GDPR, whether legitimate interest can cover a category, which consent model your jurisdiction allows, those are counsel questions, and the build does not guess them. The engineering job: implement the chosen positions correctly, gate every script, keep the records, and make changing the policy a settings change rather than a rebuild. The security practices and privacy copy work ride along naturally.
The buyer's quick audit
Open your site in a private window with dev tools open: do analytics/marketing tags fire before any consent click? Is there a reject button as prominent as accept? Can you change your mind later (withdraw consent) as easily as you gave it? Three noes means the banner is decoration, a scoped fix, and the brief starts it.