Consent Failure
The gap between what the consent banner promises and what the site actually does. Policy language alone can’t cure it.
The clearest claim pattern in privacy.
A visitor clicked Reject All, and the site kept sending their data to advertising vendors. That is the fact pattern plaintiffs and regulators pursue most, and it’s evidence anyone can reproduce from outside.
Because disclosure can’t fix it, CyRisk places consent failures as Critical to Bind by default.
Pixel firing despite Reject-All selection
Example finding. Vendor names are withheld.
What CyRisk tracks.
Severity and placement are CyRisk defaults. Your team can elevate, downgrade or drop any risk to context-only, per account.
| RISK | DEFAULT SEVERITY | DEFAULT PLACEMENT |
|---|---|---|
| Pixel firing despite Reject-All selection | Critical | Critical to Bind |
| Pixel persistence after opt-out | Critical | Critical to Bind |
| Third-party cookie set despite Reject-All | Critical | Critical to Bind |
| Third-party cookie persistence after opt-out | Critical | Critical to Bind |
| Remarketing despite opt-out selection | Critical | Critical to Bind |
| Advertising tracking despite opt-out or Reject All | High | May Affect Coverage |
| Pixel or third-party cookie set prior to consent | High | May Affect Coverage |
| Fingerprinting prior to consent | High | May Affect Coverage |
| Input monitoring prior to consent | High | May Affect Coverage |
A tracker, cookie or pixel is observed in network traffic after the visitor declined, after a documented opt-out, or before they made any choice.
Reconfigure the consent manager so all advertising code is blocked until affirmative consent, then confirm with post-implementation testing that nothing fires after Reject All.
Verified by rescan. The fix shows on the next scan.
Ready-to-use language.
“Who manages the consent tool, and when was Reject All last tested?”
“Prior to bind, confirm advertising tracking stops after Reject All, verified by CyRisk rescan.”
Wrongful-collection sublimit or higher retention if the failure isn’t remediated before bind.
Keep exploring.
Laws this exposure can trigger
Related exposure families
Does having a consent banner reduce this risk?
Only if it works. A banner that appears but doesn’t stop tracking is the classic claim pattern, so CyRisk tests what the site does, not whether a banner exists.
Can we downgrade this to May Affect Coverage?
Yes. Placement is a default you can change per account, though consent failures carry private-right-of-action exposure.
How quickly does a fix show up?
On the next scan. A rescan takes about five minutes on average.
How many of your submissions fail Reject All?
Send five past submissions you’ve already bound, conditioned or declined. We score them blind, then put our disposition next to the call you made.
Severity and placement shown are CyRisk defaults and can be tuned per account. A detected exposure indicates a fact pattern common to privacy litigation, not a confirmed violation. Litigation theories explain why a finding is tracked; they are not legal advice.