Integrations: Where Compliance Quietly Breaks
Redesigns typically add new integrations without updating consent governance to account for them.
Analytics
GA4 and alternatives: Modern analytics platforms set multiple cookies for session management, user identification, and conversion tracking. Google Consent Mode v2 allows adjusting behavior based on consent state, but requires specific implementation.
Heat mapping and session recording: Tools like Hotjar, Clarity, or FullStory record user sessions and set cookies for replay functionality. These require explicit consent under GDPR's requirement for informed permission.
Marketing Pixels
Meta Pixel, TikTok, LinkedIn: Each platform's tracking pixel sets cookies for conversion tracking and audience building. Your redesign must block these pixels until marketing consent is obtained.
Retargeting platforms: AdRoll, Criteo, and other retargeting vendors drop cookies to track users across sites. These absolutely require prior consent in GDPR jurisdictions.
CRMs and Customer Data
HubSpot, Salesforce Marketing Cloud: CRM integrations often include tracking scripts that identify returning visitors and associate them with CRM records. This processing requires clear disclosure and consent.
Chat Tools
Intercom, Drift, Zendesk: Live chat widgets typically set cookies for conversation continuity and user identification. These must load only after appropriate consent is obtained.
A/B Testing Platforms
VWO, Optimizely, Google Optimize: Testing tools must be configured to handle consent properly. VWO offers "Completely Block," "Partially Block," or "Do Not Block" modes—choosing wrong creates compliance violations.
Partially Block mode: Shows variations using session storage without sending tracking data to servers until consent is granted—balancing UX and compliance.
Why "We'll Add It Later" Breaks Compliance
Each integration added post-launch without updating consent mechanisms creates violations. The "soft launch then add tracking" approach seems safe but actually creates a window where unconsented tracking occurs, leaving evidence that audits and regulators will find.
Cookie Banner vs Consent Governance
A critical distinction that redesign teams consistently miss: cookie banners are UI elements; consent governance is infrastructure.
Cookie Banner = UI
The visible banner asking for consent is just the interface. By itself, it does nothing to stop cookies from being set.
Consent Governance = Infrastructure
True consent governance includes:
Scanning: Automatically detecting what cookies your site sets, including those from third-party scripts, plugins, and integrations.
Classification: Categorizing cookies as strictly necessary, functional, analytics, marketing, or other categories based on actual purpose.
Blocking logic: Technically preventing non-essential scripts from executing until consent is obtained—not just showing a banner and hoping.
Jurisdiction handling: Showing different consent experiences based on user location (opt-in for EU, opt-out for California, etc.).
Recordkeeping: Maintaining timestamped logs of who consented to what categories and when, creating audit trails for regulatory inquiries.
Preference management: Allowing users to change their minds through accessible settings on every page.
Most "cookie banner" solutions are just UI without the governance infrastructure behind them.
Agencies vs In-House Teams: Who Owns Compliance?
Redesign projects typically involve agencies, internal teams, and legal—but responsibility for compliance often falls through gaps between them.
Common Failure Modes
Agency assumes legal handles it: Development agencies focus on building functionality and assume client's legal team manages compliance requirements.
Legal assumes agency handles it: Legal teams review policies and notices but assume technical implementation of consent is the agency's responsibility.
Marketing just wants launch: Marketing stakeholders prioritize launch dates and features over compliance requirements they don't fully understand.
Checklist: Cookie Compliance During a Website Redesign
✔ Cookie audit before redesign: Document every cookie currently set, its purpose, category, and source. This baseline shows what must be replicated or replaced.
✔ Compliance requirements mapped: Identify which privacy regulations apply to your audience (GDPR, CPRA, LGPD, etc.) and document specific technical requirements.
✔ CMS-level consent integration: Choose and configure CMP with native support for your target CMS or implement CMS-agnostic solution.
✔ Script blocking pre-consent: Verify that non-essential scripts actually don't fire until consent is obtained. Test in incognito/private browsing to confirm.
✔ Jurisdiction logic validated: Test that users in different locations see appropriate consent experiences (opt-in vs opt-out, different legal text).
✔ Consent migration planned: If changing CMPs, implement logic to preserve existing consent or plan for re-prompting users appropriately.
✔ Integration inventory complete: List every third-party integration (analytics, marketing, chat, testing) and verify each is governed by consent.
✔ Tag Manager configured: If using GTM or similar, ensure tags fire based on consent state through proper triggering and consent mode configuration.
✔ Mobile and accessibility tested: Verify consent interface works on mobile devices and meets WCAG accessibility standards.
✔ Staging environment parity: Ensure staging site implements same consent logic as production to catch issues before launch.
✔ Post-launch rescan: Within 1 week of launch, run fresh cookie scan to catch any scripts that slipped through during deployment.
✔ Documentation updated: Update privacy policies, cookie policies, consent records, and internal documentation to reflect new site architecture.
✔ Preference center accessible: Verify cookie preference settings are accessible from every page through footer links or floating icons.
✔ Withdrawal mechanisms tested: Confirm users can easily revoke consent and that their choice is respected across sessions.
✔ Legal sign-off obtained: Get explicit confirmation from legal team that technical implementation meets compliance requirements.
Choosing the Right Cookie Compliance Partner During a Redesign
Redesigns are optimal moments to evaluate or switch Consent Management Platforms.
CMS-Agnostic Integration
Choose solutions that work regardless of underlying CMS, enabling consistent governance across platform migrations and future changes.
Multi-Law Support
Look for platforms that handle GDPR, CPRA, LGPD, and other frameworks simultaneously, adjusting consent experiences based on user location without manual configuration.
Easy Deployment Across Environments
Ensure the CMP can deploy to staging, development, and production environments easily, with separate configurations for testing without affecting live consent records.
Governance Features Beyond UI
Prioritize platforms offering automatic scanning, script blocking, consent record-keeping, and audit trails—not just attractive banner designs.
Performance Impact
Evaluate CMP script size and loading behavior. Heavy CMPs that block page rendering or degrade Core Web Vitals can hurt SEO and user experience.
Final Takeaway: Redesigns Are Compliance Opportunities
Website redesigns force re-evaluating technical infrastructure that's accumulated years of compliance debt. Rather than viewing compliance as a constraint slowing launch, treat redesigns as opportunities to:
Fix technical debt: Replace hard-coded tracking with properly governed tag management. Eliminate plugin bloat that created ungovernable cookie sprawl.
Future-proof compliance: Implement consent governance infrastructure that scales as you add tools, rather than patching banner configurations each time.
Build user trust: Modern users increasingly care about privacy. Demonstrating that your redesigned site respects their choices builds competitive advantage.
The cost of getting cookie compliance wrong during redesigns—measured in regulatory fines, legal costs, and reputation damage—far exceeds the incremental effort of implementing proper governance from the start. Organizations that treat consent as core infrastructure rather than last-minute compliance checkbox build more trustworthy digital experiences that regulatory scrutiny can't compromise.
