TL;DR; The banner is the smallest number in what consent management costs you. Data subject requests get handled by hand against two deadlines and recorded in a spreadsheet, and that cost is time. Run two questions on the tool you have: what fires after a No, and can you export the record when someone asks.
How much does consent management cost a mid-market brand?
For a mid-market ecommerce brand, the banner's invoice is the smallest part of consent management cost. Most of it is staff time: handling data subject requests by hand and keeping a record of each one. None of it arrives as a line item, so nobody adds it up.
A data subject request (DSAR) is a person asking what data you hold on them, or asking you to delete or correct it. These usually land with whoever watches the shared inbox. For every request, they:
- Verify the person.
- Find their data.
- Act on it.
- Reply inside the deadline.
- Write it down somewhere, so there is a record if anyone asks.
The deadlines are not the same either. GDPR gives you one month and CCPA gives you 45 days, so a brand selling into both is tracking two clocks. The record is usually a spreadsheet. None of that is a vendor you can cancel. The cost is time.
Why do consent tools leave the middle of the market to stitch it together?
OneTrust charges enterprise fees for full compliance. Banner-first tools like Cookiebot and CookieYes sit at the other end, where request handling is thin or sold separately. The tooling splits along price, and a brand doing $5M to $100M lands in the middle. The cheap option leaves the requests to you. The complete one is priced for a company with a general counsel. So the middle gets stitched together.
One tool asks the question, and a person with a spreadsheet handles everything after it. That works until someone asks you to prove it.
How do you test the consent tool you have?
Two questions show where your stack leaks: what fires after a No, and whether you can export the record when someone asks.
1. What fires after a No?
Open your storefront in a private window with the network tab visible, decline everything, and keep shopping. In the 300+ live storefronts we've audited, this one comes up often: the banner logs the rejection correctly, and analytics, email and session replay still fire from the theme.
This test has a limit. The network tab only shows what the browser loads, so anything sent server-side won't appear there. A clean tab clears the browser side of the store. The server side needs its own check.
2. Can you export the record when someone asks?
By record, we mean the log itself: what each visitor was asked, what they chose, and when.
Few brands come out of this with a clean pass or a clean fail. Most land somewhere in between. The gate holds for the scripts the banner knows about and leaks where it can't reach, or the log exists but doesn't go back far enough to answer the question.
What changes when consent runs as one system?
Most consent platforms already render a fine banner. The part that needs to change sits behind it: the system that records the choice should be the same one that delivers the events. Then a No is enforced before anything is sent.
Blotout Consent ships the banner, signal recovery, DSAR and consent analytics as one install on Shopify, WordPress and WooCommerce.
- Four tools become one install that takes under 30 minutes and doesn't need a developer.
- Every decision gets a browser-level timestamp and can be queried, so producing the record takes one lookup.
- Budget a little beyond the install for the swap itself. The old vendor's script has to come out of the theme, or both of them fire.
Where to start
Run the two questions this week. If you'd rather we ran it with you, email nikhat@blotout.io with your store URL. We'll report what fires before and after a choice, on your own traffic.
FAQ
1. How much does consent management cost?
The banner is usually the smallest cost. The bigger one is staff time spent handling data subject requests by hand. To see what yours costs, book a consent audit.
2. How long do you have to answer a DSAR under GDPR and CCPA?
GDPR gives you one month from receipt of the request. CCPA gives you 45 calendar days. Sell into both the EU and California and you're running two clocks, which is easy to lose track of in a shared spreadsheet.
3. How do I check whether my banner blocks scripts after a rejection?
Load your store in a private window with the network tab open, decline everything, and keep shopping. Any analytics, email or session replay requests that still appear got past the banner. The test only sees the browser. To check the server side too, book a consent audit.
4. What should a consent record include?
At minimum, what the visitor was asked, what they chose, and when. It should export on request and go back far enough to answer whatever you're asked. A privacy policy describes your process. The record shows what happened for one person.
