Your consent banner works. Your tags might not.

That worry is rational. In the Netherlands, the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) fined a drugstore chain 600,000 euros for, according to its published decision, tracking website visitors without consent. What made the story travel was not the amount but the nature of the data: the AP noted that basket contents in a drugstore can reveal sensitive information, such as pregnancy tests.

The drugstore is not an outlier. In 2025 the AP sent warning letters to more than 200 Dutch organisations about their cookie banners and scripts loading before consent. The regulator now scans thousands of websites at once with automated tooling, gives you three months to fix what it finds, and expects you to report back. Elsewhere in Europe the numbers are larger. The French equivalent of the Dutch AP, CNIL fined SHEIN 150 million euros after inspectors found that clicking “Refuse all” still placed new cookies, and that withdrawing consent did not stop existing ones from being read.

Notice what these cases have in common. None of these companies lacked a consent banner. They all had one. The banner was there, the CMP was configured, someone had signed off on it years ago. What failed was the layer underneath: tags that fired before the visitor clicked anything, tags that ignored a refusal, tags that kept running after consent was withdrawn.

Why the marketer carries this risk

Consent sits in an organisational gap. The developer implemented the banner and moved on. The privacy officer reviewed the policy text, not the network traffic. The marketer added tags over the years, each one reasonable at the time. Everyone assumes someone else verified that the whole arrangement actually holds when a visitor clicks “refuse”. Almost nobody has looked at it since the banner went live.

When it goes wrong, the consequences do not land evenly. The developer gets a ticket. The marketer gets the AP letter forwarded with “can you look into this?”, the internal questions about why the tracking they own was misfiring, and, in the bad scenario, their brand in a headline about privacy violations. The regulators publish these decisions on purpose. The CNIL has said explicitly that publicity is part of the sanction.

The honest answer most marketers would give, if asked whether every tag on their site respects every consent state, is “I think so.” That answer used to be acceptable because verifying it was expensive. It is not acceptable anymore, because the regulators have automated their side of the inspection and you probably have not automated yours.

What made verification cheap

The technical shift behind this is the Model Context Protocol, an open standard published by Anthropic in 2024 and since adopted across the industry. MCP lets an AI assistant call external systems directly instead of working only with whatever you paste into a chat window. In our Springbok Analyst Stack we connect the assistant to BigQuery, GA4, Google Tag Manager, Cloud Logging, Cloud Storage, gcloud and a headless browser. Those cover most of the places where a consent problem can hide: the container, the page source, the actual network traffic, the raw event data.

Tool access alone is not enough, though, and this is where most AI experiments in agencies stall. Ask an assistant to “check our consent setup” on a Monday and a Thursday and you get two different answers at two different depths with two different definitions of good. Useful for exploration, useless as something you would show a regulator or a board.

So we at Springbok wrote the procedure down. A skill, in our setup, is a markdown file describing one task: required inputs, steps in order, how to score the result, what the report must look like, and what the assistant is not allowed to do. The file is reviewed through pull requests and distributed to every analyst’s machine. When the task matches, the assistant follows the file. Around it sit guardrails (every connection is read-only by default, nothing is ever published by an agent) and hooks: scripts that check every tool call against policy before it executes, and that fail closed. If the check errors, the action is denied. An assistant investigating your consent setup should never be one ambiguous sentence away from modifying a live container.

The consent audit, step by step

Consent was one of the first procedures we wrote down, precisely because it is high-stakes, frequently skipped, and provable with evidence. The skill has five steps.

Discovery. Read the page source: which CMP is loaded, where the GTM snippet sits, and whether a consent default is declared above it. Order matters here, and it is one of the most common mistakes.

Static analysis. Download gtm.js and check whether Consent Mode is configured, whether it includes the v2 signals Google has required from EEA advertisers since March 2024, and which tags carry no consent requirement at all.

Browser testing. Open the site in a clean session and walk through the states: refuse everything, accept analytics only, accept everything. Record which requests actually leave the browser and which cookies get set in each state. This is exactly the test that caught SHEIN, and it is the step the container export cannot answer, because the export and the live site disagree more often than anyone is comfortable admitting.

Scoring. A hundred points across five categories, with a written pass criterion per item, so the number is not a matter of taste.

Reporting. A fixed template with the score per category and a prioritised fix list naming the location of each problem.

The rules at the bottom of that file do more work than the checklist. No pass without evidence: every green mark traces back to a network log, a console output or a line of source. Anything unverified is recorded as not checked, never as compliant. And no legal advice: the skill reports on technical implementation, and whether that satisfies a legal basis is a conversation for people. These rules exist because language models are agreeable by default. Left alone, an agent asked to audit something will produce a reassuring audit, and a reassuring audit is exactly what you do not want the week before the AP’s scanner reaches your domain.

What it finds, in both directions

What the audit typically finds matches the enforcement cases: a site where the banner works, the analytics tags behave, and one or two marketing tags quietly ignore the whole arrangement. Those one or two tags are usually the difference between a clean audit and a warning letter.

The problems run the other way too, and this is the part the fear tends to obscure. In the environments we audit, often setups we inherit from previous parties, we find roughly as many tags that are blocked when they should not be. a conversion tag with an overly strict consent requirement, quietly underreporting a channel for months. That is lost attribution and misallocated budget, paid for out of the same marketing spend the fine would come from. Fixing it recovers data the client already paid to collect.

From “I think so” to “here is the log”

None of these findings require AI. A competent analyst with an open network tab would find them in an afternoon. What changed is the cost. A check that takes fifteen minutes instead of half a day gets run monthly instead of once, in a panic, after the warning letter arrives. Problems surface within weeks of a developer or an agency touching the container, instead of surfacing in a regulator’s report.

And because the format is fixed, you can show movement. A consent score that went from 62 to 91, with the evidence attached, is a conversation a marketing director can have with a board and, if it comes to that, with a regulator. “We improved our consent setup” is not. The AP expects organisations that received a warning to report proactively on what they fixed; a scored before-and-after audit is precisely that report.

The judgement stays human, and so does the responsibility. This audit is an extra layer of verification on top of the checks that already exist, never a replacement for them. The marketer at the client remains responsible for what fires on their site, and every report passes an analyst before it reaches anyone. The scoring model reflects our opinions about what matters, and the agent only tests what it has been told to test.

What does get better over time is the procedure itself. Every audit teaches us something: a tag pattern we had not seen, a CMP that behaves differently, a check that produced a false positive. Those lessons go back into the skill file through a pull request, so the next audit runs against a sharper checklist than the one before. Writing the method down was never about removing people from the loop. It was about making sure that the next time you read about a consent fine over breakfast, your reaction is to glance at last month’s audit score instead of wondering whether your name is next.

Curious or looking for more information? Springbok Agency is sponsor of DDMA Digital Analytics Summit 2026. More information and tickets for Digital Analytics Summit taking place on 1 October at Hotel Casa in Amsterdam.

Nino Kusters

Data Analyst | Springbok Agency

• LinkedIn