Something we keep running into (we work on the consent side): a cookie banner that looks compliant but isn't actually blocking anything. It shows the notice, you click around, and GA4 plus the Meta pixel already fired on page load, before anyone consented. Under the GDPR that's the part that actually matters, and a banner that only displays a notice without holding the scripts is basically decorative.

Easy way to check your own site: open it in an incognito window with dev tools on the Network tab, load a page, and watch what fires before you click anything. If you see analytics or ad requests going out pre-consent, the banner isn't doing its job.

When people actually test their sites, what do you find? For us it's nearly always one of two things: tags hardcoded outside GTM, or a caching plugin reordering the consent script. What's it usually for you?