Your Privacy Policy Is Not a Consent Banner

The category error at the heart of it

Ask a room of business owners whether their website has consent for its analytics and advertising trackers, and a lot of them will answer with some version of: "Yes — it's all in our privacy policy." That answer feels right. The policy lists the cookies. It names the vendors. It explains what data is collected and why. Surely that covers it?

It doesn't — and the reason is a genuine category error, not a technicality. A privacy policy and consent are two different legal instruments that do two different jobs. Conflating them is like confusing a restaurant posting its allergen information with a customer telling the kitchen it's fine to use nuts. The disclosure is necessary. It is not the same as the agreement.

Here's the distinction in one line, because everything else follows from it:

A policy is a one-way notice: it sits on a page and states your practices. It requires no response from the visitor to exist. Consent is a two-way act: it only exists when the visitor does something — clicks, toggles, agrees — that unambiguously signals agreement. You can have a flawless, comprehensive, lawyer-drafted privacy policy and zero valid consent, because nobody ever agreed to anything. The policy just described what you were going to do anyway.

Disclosure vs consent, side by side

Laying the two next to each other makes the gap obvious — and shows why one can never quietly become the other:

Notice the last row of each column, because it's where the legal exposure lives. Consent has to be given before the tracking happens — that's the entire premise of the CIPA and GDPR "prior consent" standard. A privacy policy, by its nature, can't satisfy that: it just sits there while the page loads and the trackers fire. There's no moment where the visitor agreed, because a policy doesn't ask for agreement. It only informs.

The ruling that said it out loud

If this were only a theoretical distinction, you could argue about it. But in August 2026 a federal court applied it to a real company and a real privacy policy — and the policy lost.

In Asercion v. Ulta Salon, Cosmetics & Fragrance, Inc. (N.D. Cal., Aug. 21, 2026), the plaintiff visited Ulta's website in May 2025 to browse for Mother's Day gifts. He alleged that Ulta had embedded code causing third-party trackers to install on his browser, collect his browsing activity in real time, and transmit it to third parties for targeted advertising — without his consent. Ulta moved for judgment on the pleadings, and its central argument was exactly the one this article is about: our posted privacy policy gave him consent.

The court rejected it. It denied the motion and let the CIPA claims proceed, holding that a posted privacy policy alone was not enough to establish consent to install tracking technology. As one legal analysis put it plainly:

Two other parts of the decision are worth noting because they close off the usual escape routes. The court let the §631 interception claim proceed because the trackers allegedly captured the substantive contents of the visitor's activity — product views and more — while in transit. And it let the §638.51 pen register claim proceed too, rejecting Ulta's argument that the provision only reaches telephone technology. (The allegations remain unproven at this stage; the ruling is about whether the case can go forward, and it can.)

Why "by continuing to browse, you agree" fails

There's a specific move sites make to try to bridge the gap between a policy and consent — and it's the exact move courts reject. It's the line you've seen a hundred times: "By continuing to browse this site, you agree to our Privacy Policy." Or a small banner that says "We use cookies" with only an "OK" or an X to dismiss it.

The problem is that these try to manufacture consent out of inaction. Continuing to scroll, or not leaving the site, or dismissing a notice, are not affirmative acts of agreement — they're just… using the website. Consent has to be an unambiguous, affirmative choice, and "the visitor didn't leave" is neither unambiguous nor a choice. The visitor may not have read the notice, may not have understood it as a request for agreement, and certainly never did anything that means "yes."

This is why the "informed" part of consent and the "agreement" part are separate requirements. Your privacy policy can supply the informed element — it's where the detail lives. But it cannot supply the agreement element, because agreement is something only the visitor can give, by doing something. A notice that a visitor passively receives, however well-written, is a disclosure wearing the costume of consent.

Browsewrap vs clickwrap: the line courts actually draw

Courts have a well-developed vocabulary for this exact distinction, borrowed from decades of contract law: browsewrap versus clickwrap. Understanding which one you have tells you immediately whether you're relying on a disclosure or actually collecting consent.

Your own CIPA case tracker is full of this line being drawn. In Camplisson v. Adidas, terms buried in a website footer were treated as "no consent at all" — a footer-only disclosure failed the conspicuousness a valid consent defense requires. In Podraza v. Nourish, the site relied on browsewrap — a buried notice users were deemed to accept by visiting — and the court found it inadequate, letting the wiretapping claims survive. Compare Sisti v. Bosley, where the site used clickwrap that required affirmative acceptance before access, and the claims were dismissed with prejudice. Same statute, opposite outcomes — and the deciding factor was whether the visitor was made to actually agree, or merely deemed to.

The same rule, on the other side of the Atlantic

This isn't a California quirk. The EU reached the identical conclusion years earlier, and stated it even more crisply — which is useful if any of your visitors are in Europe.

Under the GDPR, consent must be freely given, specific, informed, and unambiguous, and given by a clear affirmative act (Article 4(11)). That last phrase does the same work as the browsewrap/clickwrap line: it rules out anything passive. Europe's top court made the point concrete in Planet49 (2019), holding that a pre-ticked box is not valid consent — if the user has to un-tick something to refuse, they never affirmatively agreed. A later case, Orange România (2020), went further and put the burden on the business to prove the visitor gave consent by active behaviour.

The through-line is the same as CIPA's: a privacy policy is the "informed" ingredient, not the consent itself. The policy (and the banner's first layer) supply the information a visitor needs to make a real choice. But under both regimes, the choice still has to be made — actively, by the visitor, before non-essential trackers run. "Continued browsing" and "by using this site you agree" fail in Brussels for exactly the reason they fail in California. For the full EU picture, see our guide to what GDPR cookie consent actually requires.

So what actually counts as consent?

If a privacy policy is the disclosure and not the agreement, what does the agreement have to look like? The requirements are consistent across CIPA-era US litigation and GDPR, and none of them is exotic:

• An affirmative act, before trackers fire. The visitor clicks or toggles a real choice on a consent interface — and non-essential trackers stay blocked until they do. The order matters: consent given after tracking has started can't retroactively cure it.
• Informed — which is where your policy comes back in. The visitor needs to know what they're agreeing to. That's the job the privacy policy and the banner's first layer actually do: they supply the information. So the policy isn't useless — it's essential — it's just the informed ingredient, not the whole recipe.
• Specific and granular. A single "Accept everything" isn't specific consent to five different purposes. Categories — analytics, advertising, and so on — should be separable choices.
• Freely given. A real reject option, roughly as easy and prominent as accept. A choice between "Accept" and a hard-to-find "Settings" link isn't freely given.
• Recorded. You need to be able to show the agreement happened — when, and to what. (Proving it is its own topic; we cover the evidence side in cookie banner vs. real compliance.)

And one more point that trips people up, because it sits right next to this one: even a real consent banner fails if it doesn't actually block the trackers until the visitor agrees. That's a different failure from the one in this article — it's a banner that asks for consent but doesn't enforce it — and we cover it separately in why most cookie banners are "fake." The two problems stack: relying on a policy instead of a banner is one failure; having a banner that doesn't block is another. You need to clear both.

How ConsentPixel fits

This is the gap ConsentPixel is built to close. A privacy policy is the disclosure layer — and ConsentPixel can even generate one from your real scan data so it's accurate. But the part a policy can never be is the consent mechanism: ConsentPixel blocks third-party trackers from firing until the visitor gives an affirmative opt-in, honors opt-out signals, and logs each decision so the agreement is provable. The policy tells visitors what you do; the pixel is how they actually agree — and how you make sure nothing fires until they have. Together they cover both halves; the policy alone only ever covered one. This is information, not legal advice — your policy and your specific situation are still worth reviewing with counsel.

Frequently asked questions

Information, not legal advice. This article explains the general distinction between a privacy policy and consent for educational purposes and does not constitute legal advice or create an attorney–client relationship. Case descriptions — including Asercion v. Ulta (N.D. Cal., Aug. 21, 2026) — reflect publicly reported court records as of September 2026; the allegations in that matter remain unproven and the ruling concerns whether the case may proceed, not final liability. The $5,000-per-violation figure reflects statutory damages under California Penal Code §637.2; actual exposure varies by case. How CIPA, the GDPR, and related laws apply to your website depends on your specific facts — consult qualified counsel. ConsentPixel — Privacy · Verified is not a law firm, and no single tool or document by itself makes a website compliant with any law.