Is Your Cookie Banner Actually Doing Its Job?

If you’ve clicked “Accept” on a cookie banner today without reading it, you’re not alone — most people do the same thing. But that little popup that shows up the moment someone lands on your website is doing more (or less) than you might think. It can be a genuine accessibility barrier, a privacy-law gap, and a quiet drag on your conversions, all at once — and most of the pre-built banner plugins out there don’t actually fix any of the three.

We touched on this in our post about AI visibility and accessibility [[link when pillar post is published]] — the idea that a website’s foundation either holds up under real scrutiny or it doesn’t. Cookie banners are a small, easy-to-overlook example of exactly that. Here’s what’s actually going on.

What the Law Actually Requires (and Doesn’t)

If you’re a Texas business, the law most relevant to you is the Texas Data Privacy and Security Act (TDPSA), which took effect July 1, 2024, with mandatory recognition of browser-level opt-out signals (like Global Privacy Control) added January 1, 2025.

Who has to comply

TDPSA doesn’t have a revenue or data-volume threshold the way some other state laws do. Instead, it exempts businesses that qualify as “small businesses” under federal SBA size standards — but that exemption disappears entirely if you sell sensitive personal data, regardless of your size.

What’s actually required

The law doesn’t actually mandate a specific banner design. What it requires is a privacy notice, consent before processing sensitive or children’s data, an accessible way to opt out of having your data sold or used for targeted ads, and honoring those browser-level opt-out signals in real time. A banner is just the common way businesses choose to deliver that — not a checkbox the law itself demands.

Texas isn’t the only state to watch

Roughly 20 states now have comprehensive consumer privacy laws in effect, with a few more (Indiana, Kentucky, Rhode Island) joining just this year. If you serve customers outside Texas, or run any ads that could reach EU visitors, GDPR and California’s CCPA/CPRA may apply too, each with their own flavor of consent requirements.

Here’s the catch a lot of businesses miss: installing a cookie-banner plugin isn’t the same as being compliant. Several compliance reviews have flagged that many popular tools log a person’s consent choice but don’t actually stop the tracking scripts from running, or don’t honor opt-out signals automatically the way the law requires. A banner that just sits there for show can create a false sense of security.

The Accessibility Problem Almost No One Talks About

This is the part that surprises most business owners: cookie banners are one of the most consistently inaccessible elements on the modern web, and it’s not close. Independent testing has found the same handful of problems over and over.

Keyboard traps

Some banners can’t be dismissed or tabbed past using a keyboard alone — testers have found sites requiring 40+ tab presses just to reach the banner’s buttons, and others where focus escapes into hidden content behind the popup.

Low contrast text and buttons

Nearly universal across the banners tested, even on “customize your choices” screens.

Silent toggles

Screen readers often aren’t told when a setting changes — a toggle can visually switch on or off while announcing nothing to someone using assistive technology.

Tiny, unlabeled close and reject buttons

Icon-only buttons with no descriptive label are common, leaving screen reader users guessing what a control even does.

What the testing actually found

One accessibility firm tested eleven popular consent-banner tools and found only one — the UK government’s own — was fully WCAG 2.2 AA compliant. A separate screen-reader-specific test of popular WordPress consent plugins found some had a “findability” rate as low as 5–10% for screen reader users, meaning the overwhelming majority never even located the controls. A 2025 accessibility study also found that 64% of people with disabilities said making a cookie choice was difficult, compared to 44% of people without disabilities — a real, measurable gap, not a theoretical one.

To be clear: we haven’t seen evidence that cookie banners are, by themselves, a major named category of ADA lawsuits the way things like missing alt text or broken keyboard navigation are. But an inaccessible banner sitting on top of your homepage can block access to everything behind it — which absolutely feeds into the broader accessibility picture for your site.

The Part That Affects Your Bottom Line

Even setting aside legal and accessibility concerns, badly designed banners cost you engagement.

Equal-weight buttons change the numbers

Reject rates jump dramatically — from around 10% up to 50–70% — once “Accept” and “Reject” are given equal visual weight, which tells you how much “dark pattern” design has been propping up artificially high acceptance rates.

Most banners still aren’t compliant

An analysis of over 250,000 websites found only about 15% of cookie banners actually met baseline GDPR compliance standards.

Most users never make a real choice at all

Surveys consistently find a large majority of users find cookie banners annoying, and a majority simply close or ignore them without making any real choice at all — which means the data you think you’re collecting consent for may not be as clean as you assume.

What a Good One Actually Looks Like

A cookie banner that works — legally, accessibly, and for your conversion rate — has a few things in common: it’s fully operable by keyboard, it doesn’t trap focus or hide content behind it, its buttons are clearly labeled and appropriately sized, “Accept” and “Reject” get equal visual weight instead of steering people toward one option, and it actually does what it claims (blocking trackers until consent is given, honoring opt-out signals automatically).

That’s the same standard we hold every part of a website to when we build it — not bolting pieces on to check a box, but making sure the foundation actually works for the people using it. If you’re not sure whether your current site’s banner (or the rest of your accessibility posture) holds up, that’s a conversation worth having before it becomes a problem instead of after.

Reach out anytime — we’re happy to take a look and tell you honestly what we see.