Consent Drift: Why Last Quarter's Audit Expired

Suppose your consent banner was tested in July. It blocked the ad pixels, the Global Privacy Control signal shut off sharing, and everyone signed off. Since then marketing has shipped a few tag changes and a vendor has updated its script. Is the July result still true? A passing check only describes the day it ran.

What consent drift is

Consent drift is the gap that opens between the setup you verified and what your production site does today. Nobody has to make a mistake for it to happen. Sites change constantly, and the consent rules apply to the site as it is now, not as it was when someone last checked.

The usual sources are ordinary:

• A marketing team adds a pixel through a tag manager, outside the rule set your consent tool was configured with.
• A script you already approved starts loading further third-party scripts after a vendor update. This is pixel piggybacking, and it was never in the original configuration.
• A site release changes page templates, a cookie name or the order scripts load, so a blocking rule no longer matches.
• A consent platform setting is edited for one region and changes behavior for another.

Why it matters under the CCPA

The regulations don't ask whether you configured an opt-out; they ask whether it works. Under § 7025, a business that sells or shares personal information must treat a qualifying opt-out preference signal such as GPC as a valid request to opt out for that browser or device. If a tag added in September keeps sending data after a visitor's GPC signal arrives, the July test doesn't help you. The exposure is in the live behavior, and that is also what regulators and plaintiffs can observe from the outside.

What website owners should do

Treat verification as something you repeat, not something you finish. Re-check after any release that touches templates, the tag manager or the consent platform. Between releases, schedule a recurring check anyway, since third-party scripts change on their vendors' timetables rather than yours.

Each time, test the live site as a visitor would: load a page with a GPC signal and look at the network requests, then decline the banner and look again. Our walkthrough of what fires before consent covers the browser-side steps, and shadow pixels and piggybacking explains the cases that tend to slip through.

Where Privisy fits

A consent platform reports on the setup it manages, and it's good at that job; many include their own scanners. Privisy adds an independent view: it loads the live site, with and without a GPC signal, and records what actually fires on the network. Continuous Monitoring repeats that audit on a schedule, so a change shows up as a dated difference between reports instead of something you find later. See the plans for how it runs.