Test it yourself. Visit your ecommerce website in an incognito window, ignore the cookie banner, and open the developer tools (F12 → Application tab → Cookies). If you see cookies from Google Analytics, Meta, or any other advertising platform, your banner is not doing its job: it is displayed, but it is not blocking anything.
This is very common among European ecommerce businesses. A banner is installed to tick the compliance box, but nobody checks whether it actually works. However, managing cookie consent is not simply about displaying a notice: it means ensuring that no data is collected without prior permission and being able to prove it.
An ecommerce website typically uses a wide range of tracking technologies, such as:
Every plugin, campaign, and new integration can add cookies or send data to third parties. On top of that, online stores are constantly changing. As a result, errors accumulate without anyone noticing.
The regulatory framework your website must comply with consists of the GDPR and the cookie-related provisions derived from the ePrivacy Directive (in Spain, the LSSI), as interpreted by the Spanish Data Protection Agency (AEPD) in its guidelines on the use of cookies.
However, the key points you need to remember are:
If you sell in several EU countries, remember that each national authority publishes its own guidelines, although they all follow the same common regulatory framework.
This is the most serious and most common mistake. The solution is to use a CMP that blocks third-party scripts until consent is given, and to verify that it works using the incognito test described above.
If accepting cookies requires one click, while rejecting them means opening the settings and deselecting categories, consent is not genuinely freely given. Display both options on the first layer of the banner, giving them equal visual prominence.
Silence, scrolling, or boxes enabled by default do not constitute valid consent. Keep all non-essential categories disabled by default.
A last-minute campaign, a new plugin, or a tag added through your tag manager... If your cookie policy does not reflect what is actually happening on your website, users cannot give sufficiently informed consent. Use automatic, regular scans to keep everything up to date.
If you use Google Ads or Analytics in the European Economic Area, Google expects to receive users' consent signals. If these signals are not transmitted correctly, you may lose conversion data, audience information, and optimization capabilities. Make sure your CMP is compatible and that consent states are being transmitted correctly.
Meta, TikTok, and other social media pixels are often loaded through the store's theme or a tag manager without going through the cookie banner. Make sure each tag only loads when the corresponding consent category has been granted.
Tiny buttons, pop-ups that cover the content, or inaccessible settings. If a large share of your traffic comes from mobile devices, a consent banner that cannot be properly managed on mobile is not doing its job. Test it across several devices.
There may be no permanent link to reopen cookie preferences, or no record of what each user selected, when they made their choice, and which version of the banner was displayed. You need both: permanent access to preferences and a consent log.
| What to check | How to do it | Expected result |
|---|---|---|
| Cookies before consent | Incognito window + F12 → Cookies | Only strictly necessary cookies |
| Banner buttons | Check the first layer | "Accept" and "Reject" have equal prominence |
| Default checkboxes | Open "Settings" | Non-essential categories are disabled |
| Marketing pixels | Reject cookies and check the Network tab | No requests are sent to advertising platforms |
| Mobile experience | Test on 2 or 3 devices | Everything is accessible and readable |
| Changing preferences | Look for a link in the footer | The consent panel can be reopened |
At Lawwwing, we make it easy to find out whether your website is fully compliant. So don't wait any longer: audit your website here.
With Lawwwing, you can set up a GDPR-compliant cookie banner in just a few steps and prevent most of the mistakes we've just covered from happening in the first place:
What's more, consent is no longer just a legal matter. It also affects what Google can measure and optimize in the European Economic Area.
Lawwwing is Google-certified at Gold level. This means your banner correctly communicates each user's consent choices to Google tags, which is essential for maintaining the quality of your measurement data and audiences.
If it uses cookies or similar technologies that are not strictly necessary (analytics, advertising, or personalization), yes. This applies to almost every ecommerce business.
Cookies that are strictly necessary to provide the service requested by the user, such as keeping items in their shopping cart, are generally exempt from consent requirements, although they must still be disclosed in the cookie policy.
The guidelines issued by the AEPD and other European authorities indicate that rejecting cookies should be just as easy as accepting them. The safest option is to include a clearly visible "Reject" button on the first layer.
Potential enforcement notices or fines from the data protection authority, problems with advertising platforms, loss of measurement data, and reduced customer trust. The severity depends on each individual case.
After every significant change to your online store (new tools, campaigns, or plugins) and, at a minimum, on a regular basis.
