Most websites have a cookie banner. Far fewer are actually compliant. cookie-audit is an open-source CLI tool that scans the cookies your site sets,…
Ask any web developer whether their site is GDPR-compliant for cookies and the answer is almost always the same: "Yes, we have a cookie banner." That is not the same thing. A cookie banner is a user interface element. GDPR compliance is about what actually happens under the hood, specifically whether tracking cookies are set before a user clicks anything, whether those cookies are properly secured, and whether the site can actually prove what it is doing and why.
The gap between "we have a banner" and "we are compliant" is where most violations live. Analytics scripts that fire on page load regardless of consent. Marketing pixels that run before the user has seen the banner. Session cookies missing basic security flags that have been standard practice for a decade. These are not edge cases; they are the norm, and they are invisible unless you specifically look for them.