# Consent gating must be verified, not assumed ## Claim A consent banner is only doing its job if it actually blocks third-party script execution until the visitor opts in — a banner that displays but doesn't enforce the gate is functionally the same as having no consent mechanism at all. ## Evidence **Source**: [[3. Resources/Literature Notes/3 Things All Website Owners Need to Check for Privacy Compliance Hans Skillrud]] ## Scope & conditions - Holds when: a site runs any consent-management plugin or banner in front of non-essential third-party scripts (analytics, ad pixels, marketing tags). - Breaks when: the script in question is essential/first-party (login, session, security cookies), which sits outside CIPA-style third-party-tracking scope even though other regimes like GDPR may still require consent for it. ## Links - [[3. Resources/Permanent Notes/Default-On AI Activation Inflates Adoption Metrics at the Cost of Consent]] — contrasts: that note is about a vendor defaulting a feature ON without asking; this one is about a site defaulting a script OFF but failing to actually enforce it — same underlying failure (a claimed consent state that isn't real), opposite direction of drift <!-- atomicity: 1 idea ✓ --> - [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] — applies-in: Privacy compliance for WordPress sites sits nearest this hosting and security cluster.