On-demand session

“Say It, Do It, Prove It”: Best Practices for Building a Closed-Loop Consent & Preference Audit Program at Scale

A consent management platform is very good at one job: deciding what should happen. You define categories, map scripts to them, set the banner logic for each region, and it does exactly what you configured. What it cannot tell you is what the browser actually did on page 400 of your site this morning, after a visitor clicked Reject.

Deploying a consent management platform configures rules. It does not verify they work at runtime, across every page, in every consent state, after every release.

From the session

Ian Wardell went to law school, practised, then went back to engineering; he now builds consent controls at Reddit. In this IAPP web conference he and Feroot CEO Ivan Tsarynny work through why a configured consent program and a provable one are not the same thing.

They frame it as three gaps, each one opening somewhere different in the chain:

• Gap 1 Policy → implementation. Consent rules are defined in the platform but never validated at runtime. The policy says one thing; what fires on the page may say another.
• Gap 2 Banner choice → runtime outcome. A visitor declines. What actually loads afterwards? Without verification across every consent state, nobody knows.
• Gap 3 Point-in-time → continuous. Releases, tag manager updates and new vendor tags can break consent controls overnight. A quarterly check will not see it.

Ivan then walks through the three ways a tracking pixel gets past a cookie banner, technically:

• 01 Pre-consent fire. The pixel loads on page load, before the banner has been interacted with at all. The most common violation pattern — and it happens even with a properly integrated platform.
• 02 Tag manager drift. A marketer adds a new pixel through the tag manager without touching the consent platform’s category rules. The platform has no knowledge of the new tag, so the pixel goes uncontrolled.
• 03 iFrame blind spot. Third-party forms, chat widgets and embedded content run inside an iframe — effectively another website on your page. Consent platforms cannot inspect or block JavaScript inside a frame they do not own.

Scaling the testing is its own problem. The scenario matrix is pages × properties × geographies × languages × consent states × vendor behaviours, and it stops being clickable by hand almost immediately.

The operational half of the session is a six-step loop and the five measures that tell you it is working:

• Drift ratePages whose behaviour changed since last scan
• Violation densityVendors firing in the wrong consent state
• Time to remediateFinding to verified fix
• Evidence coverageProperties with a full audit chain
• Program trendImprovement or regression over time

Ivan adds a distinction worth keeping: auditing consent is not itself required by any statute he is aware of. Respecting and enforcing the user’s choice is. The audit is how you find out whether you are doing the thing that is required — and how you show it later.

Worth watching if you own:

• A consent program that passes review but has never been verified at runtime
• Privacy engineering, and you need tests that run on a schedule rather than before an audit
• Legal or compliance, and you need evidence rather than a vendor’s configuration screen