Consent Management Is an Ongoing Process, Not a One-Time Setup

The install-and-forget trap

Most teams treat cookie consent as a project. You pick a tool, install a banner, scan the site once, write a policy, tick the box, and move on. That model is why so many sites that were compliant on launch day are violating the rules a year later. Nothing about your website holds still. Marketing adds tools, developers ship pages, plugins update, vendors change what they collect, and laws move. A consent setup frozen on day one describes a site that no longer exists.

The regulators who write these rules already see consent as continuous. The technology teams who implement it often don't. This guide is about closing that gap, treating consent as an operating discipline with a cadence, owners, and a maintenance calendar, the same way you treat security or uptime.

The law already assumes it's ongoing

The GDPR's accountability principle, in Article 5(2), requires you to demonstrate compliance on a continuing basis, not to prove you were compliant once. Supervisory authorities read that as an obligation to review and update, not to file and forget. Consent has a shelf life too: France's CNIL and the UK's ICO both point to re-asking for consent at appropriate intervals, commonly around six months, and the CNIL caps analytics cookie lifespans at 13 months. None of that works if consent is a one-time event.

Enforcement follows the same logic. The trackers that drew France's roughly 486.8 million euros in 2025 sanctions weren't usually deliberate. They were drift, changes that slipped in after the initial setup and were never caught, because nobody was looking after launch.

What actually changes after launch

To manage consent continuously, you have to know what moves. Four things drift, on different clocks:

• Your cookies and trackers. New tools, plugin updates, embeds, and partner scripts add trackers you never approved. This is the fastest-moving and most common source of trouble.
• Your consent records. Old consent goes stale and needs refreshing. Material changes, new purposes or new vendors, can invalidate consent you already hold.
• Your vendors. The tools you use change what they collect, and you swap tools entirely. Each swap reshuffles your cookie inventory and your data recipients.
• The law. New state privacy laws, updated regulator guidance, and requirements like Google Consent Mode v2 change what compliant looks like. What passed last year may not this year.

An operating cadence that keeps consent current

Turn "stay compliant" into a schedule. A workable rhythm for most organizations:

Continuous (automated)

Runtime drift detection watches live pages for new trackers between scans. This is the always-on layer that catches fast changes. See monitoring for consent violations and drift.

Monthly (automated)

A full-site re-scan to refresh your cookie inventory and catch slow drift. See how often to re-scan.

Quarterly (human)

A structured review: reconcile the scan against your cookie policy, check consent rates and records, confirm categories still map correctly, and scan for new legal requirements. See your quarterly consent review.

Annually

A full audit and a re-consent sweep for consent that's aged past your chosen interval. See consent expiry and re-consent.

Event-driven (anytime)

Trigger an off-cycle scan and disclosure update whenever you add a tool, swap a vendor, or launch a new section. See the new tracking tool runbook and switching vendors.

Give it an owner, or it won't happen

The single biggest reason consent maintenance fails isn't tooling, it's that nobody owns it. Consent sits between marketing (who add the tools), engineering (who ship the code), and legal or privacy (who carry the risk), so it falls between all three. Name one accountable owner. That person doesn't have to do every task, but they own the calendar, they get the drift alerts, and they're the one who signs off that the site still matches its policy.

Practically, that means the drift digest lands in a real inbox, the quarterly review is on someone's calendar, and adding a new marketing tag routes through a known process rather than a copy-paste into the page. Governance beats heroics. A boring, documented cadence outperforms an occasional deep clean by a motivated individual who then leaves.