> there are off-the-shelf solutions (CMPs, for example) and easy checklists for complying in the setting of a static public-facing website. In my experience, t

> there are off-the-shelf solutions (CMPs, for example) and easy checklists for complying in the setting of a static public-facing website. In my experience, the people implementing these often don't understand enough about the technology to be allowed to implement this. I wonder if "easy to use" tag managers are to blame, by allowing non-experts to add JS and other includes to webpages without process or scrutiny. Check a few big brand-name websites, and look at whether they place (third party) cookies before the CMP has even been interacted with. I can think of some major high street labels where the consent prompt is mere theatre.