← Back to Blog accessibility

The 10 Most Common CMP Mistakes That Will Be Costly After June 28, 2025

· 3 min read
EAA BFSG CMP Cookiebot Usercentrics OneTrust WCAG

On June 28, 2025, the European Accessibility Act takes effect. Consent banners that aren't accessible will then violate two laws simultaneously: the GDPR (invalid consent) and the EAA. We've audited over 500 consent banners in the past 6 months. Here are the 10 mistakes we find most often.

Mistakes 1–3: Semantics

1. Missing role="dialog"

Affected: ~62% of all banners. Screen readers don't announce the element as a dialog. Users don't know a decision is required.

Fix (Cookiebot): In Advanced Settings → Custom CSS/HTML, add role="dialog" aria-modal="true" aria-label="Cookie settings" to the outer container.

2. No aria-label on buttons

Some CMPs render buttons with only icons or generic text. Screen readers then read “Button” instead of “Reject all cookies”.

Fix (Usercentrics): Under Design → Button Labels, write out complete descriptions instead of “✕” or “OK”.

3. Nested forms

OneTrust generates nested <form> tags in some templates. This is invalid HTML that breaks semantics for assistive technologies.

Fix: OneTrust template v6.38+ fixes this. Force update under “Template Version” in settings.

Mistakes 4–6: Keyboard

4. Missing focus trap

Focus escapes behind the modal banner. Keyboard users can't operate the banner without reloading the page.

Fix: Implement a JavaScript focus trap (library: focus-trap on npm). Or enable CMP built-in settings (Usercentrics: “Accessibility Mode”).

5. Escape closes banner = implied consent

Some CMPs interpret Escape as “close banner” and then set tracking cookies. This is implied consent that won't hold up legally.

Fix: Either disable Escape or treat it as “Reject” — never as “Accept”.

6. Tab order: Accept before Reject

In 78% of banners, Tab reaches “Accept All” first. This disadvantages keyboard users who want to reject.

Fix: Tab order must be neutral. Cookiebot: adjust data-taborder. Usercentrics: switch layout to “Equal Buttons”.

Mistakes 7–8: Visual

7. Reject button in low contrast

The most common trick: “Accept” in bold green, “Reject” in light gray on white — contrast ratio often below 2:1 instead of the required 4.5:1.

Fix: Both buttons must meet WCAG SC 1.4.3. From June 28, this is not just a dark pattern but also an EAA violation with its own fine framework (up to €100,000).

8. Touch targets under 44×44px

On mobile, many CMPs render “Settings” links in 8px font. Not clickable with motor impairments.

Fix: Minimum size 44×44px (WCAG 2.5.8). Use CMP responsive templates.

Mistakes 9–10: Content

9. Banner language ≠ page language

The website is in German, the CMP banner in English (or vice versa). An accessibility problem and an EDPB “Fickle” pattern.

Fix: Couple CMP language logic to the page's lang attribute.

10. No persistent revocation link

After closing the banner, there's no visible way to revoke consent. Art. 7(3) GDPR requires: withdrawal must be as easy as granting consent.

Fix: Place a permanent “Cookie Settings” link in the footer.

Dual Legal Framework from June 28, 2025

Each of these mistakes can have two consequences:

  • GDPR: Invalid consent → tracking without legal basis → Art. 83 GDPR fine
  • EAA: Accessibility violation → fine up to €100,000 + injunctions by consumer organizations

Our methodology page details the technical audit criteria. A Forensic Report documents each finding with exact WCAG violations, contrast ratios, missing ARIA attributes, and screenshot evidence.