A consent banner is only useful if the website behind it actually respects the choice a user makes.

A proposed class action against the NFL is a timely reminder of what can happen when those two things allegedly fall out of sync.

According to reporting by Courthouse News and the complaint filed against NFL Enterprises, forensic testing allegedly found 182 third-party trackers operating on NFL.com before visitors had an opportunity to make a privacy choice. The complaint further alleges that 186 trackers continued running after a visitor opted out, including cookies, canvas fingerprinting scripts, and a session-recording tool.

The plaintiff has brought claims under the California Invasion of Privacy Act (CIPA), the federal Electronic Communications Privacy Act, the California Computer Data Access and Fraud Act, the California Constitution’s right to privacy, and California’s Unfair Competition Law. These are allegations in a newly filed case, not findings of liability.

For privacy teams, though, the case raises a broader operational question:

Does your website actually do what your consent experience says it does?

The banner is only one part of consent

Consent management is often treated as a front-end problem: configure the banner, define the categories, publish the policy, and move on.

But the real environment underneath that banner is constantly changing.

Marketing launches a campaign and adds a pixel. Product introduces a new analytics tool. A vendor changes its implementation. Someone updates the tag manager. A new script starts appearing on a regional page.

None of these changes necessarily trigger a privacy review.

And that creates an important gap: the consent configuration Privacy approved and the technologies actually running on the website can gradually become two different things.

That gap is central to the NFL allegations. The plaintiff claims that tracking technologies began operating before she could make a choice and that some continued after she selected an opt-out.

Tracking goes far beyond cookies

There is another reason periodic cookie reviews are increasingly insufficient: modern websites use much more than cookies.

The NFL complaint references canvas fingerprinting and session-recording technology alongside traditional cookies. It alleges that the session-recording tool captured interactions such as mouse movements, clicks, scrolling, navigation paths, and keystrokes entered into search fields.

Whether or not those claims ultimately succeed, the operational lesson is broader.

Privacy teams need visibility into the full tracking environment — not just a static list of cookies.

An opt-out needs to change what happens next

Recording a preference isn't the same thing as enforcing it.

When a visitor declines tracking, sends a Global Privacy Control signal, or changes a previous choice, the website needs to respond accordingly.

The NFL lawsuit raises exactly this issue: the plaintiff alleges that trackers continued operating even after she opted out.

For privacy teams, the takeaway is simple: there shouldn’t be a gap between the choice presented to users and what actually happens behind the scenes.

That means knowing which technologies should be blocked, whether new scripts follow the same rules, and whether the implementation continues to behave as intended as the website changes.

Consent should be an ongoing operation

The takeaway for privacy teams isn't simply to “check the banner.”

It's to make sure consent stays aligned as the website changes.

That means continuously answering a few basic questions:

What is running on our websites?
Which cookies, scripts, pixels, trackers, and other technologies are active?

What changed?
What has appeared since the last review?

What rules should apply?
How should each technology be classified, and what should happen in each region?

Are user choices actually being enforced?
Does the technical behavior match what the visitor selected?

Can we prove it?
Do we have the consent records and audit trail to understand what happened?

That is the shift from maintaining a consent banner to actually managing consent.

See it in action: Live CMP walkthrough

On July 28, we're hosting a live walkthrough of Mine's new Consent Management Platform and showing how teams can keep consent accurate as their websites evolve.

We'll cover:

✅ Website scanning and audits
✅ AI-powered cookie and tracker classification
✅ Keeping consent aligned as websites change
✅ Script blocking and Google Consent Mode v2
✅ Consent records and audit evidence

July 28, 2026
10:00 AM PT | 1:00 PM ET | 7:00 PM CET

Save your seat for the live CMP walkthrough

‍