The agency left. The signature stayed.
What you bought, and what you needed
The invoice said responsive redesign. And that’s what was delivered — a design. Consent, records, and evidence were never in the scope of work, because nobody puts them there: the agency doesn’t sell them, leadership doesn’t ask for them, and the platform’s terms quietly make them your problem. So the site renders beautifully, the cookie banner appears on cue, and underneath it: nothing is written down. The banner stores its answer in the visitor’s own browser. Your company keeps no copy.
The question that decides everything
Only one question matters when a regulator, a plaintiff’s firm, or your own counsel calls: “Produce the record.” Show that this visitor consented — or declined — at this time, in this session, and show what ran under that choice. European law puts the burden of proof on you, not the visitor. American wiretap statutes add private lawsuits with statutory damages per session, no regulator required — the theory behind the session-recording class actions that reached household-name retailers. In every one of those cases the defining fact was the same: the company could not produce a record, because its banner never made one.
The fix does not reopen the project
Two lines of code, in the theme you already paid for. They work on whatever the agency built — Shopify, Magento, BigCommerce, WordPress, Adobe, a custom stack, or several of them at once — because they don’t touch the design at all. From the moment they’re in place, every yes and every no is written to a record your company holds: timestamped, tied to the session, joined to what actually fired under it. When someone says produce the record, it’s an export, not an excavation.
What it costs
Less than one change order on the build you already bought. No replatform, no migration, no new project to get approved. And if you ever remove it, removal is a deletion — not a teardown.
One honest limit
The record starts the day the tags go in. Nothing can create evidence for the years the banner kept no records — which is exactly why the day it starts matters. Every week it runs, your defensible history gets a week longer.
What changes for you
In an audit, a deposition, or a board meeting, your answer changes from a pause to a sentence: “We hold the record — here is the export.” That sentence is the difference between the person who signed for a website and the person who signed for a system that can defend itself.
The certificate answers for last year. The agency answered for the launch. The record answers for you.
See a live register →Start with two tags →