Your site's cookies are now a legal matter: what Law 21.719 requires of you starting in December
Through 2026, thousands of Chilean websites will install a cookie banner. It will be the most visible response to Law 21.719, which takes effect on December 1 of this year. And that is where many companies will make the same mistake: believing the banner alone makes them compliant. At D2B we work every day with marketing measurement infrastructure, tags, pixels and analytics platforms, and what we see in the field is clear: the banner is the tip of the iceberg. What the law requires is a complete consent management system, and most of the implementations that exist in Chile today would not (for now) survive serious enforcement.
Consent is a legal obligation first and a UX decision second
Law 21.719 requires consent to be freely given, informed, specific and unambiguous. Each of those words has practical consequences for how you build the consent experience.
Freely given means you must not mislead anyone: refusing has to be as easy as accepting. If a banner puts an "Accept all" button in a bold color and hides the refusal behind a gray link that reads "configure preferences", that consent is defective. European authorities have already penalized exactly this practice: France's CNIL fined Google and Meta millions for making cookies harder to reject than to accept. Button asymmetry is a dark pattern, and consent obtained through dark patterns is legally the same as having no consent at all.
Specific means consent per purpose, not a generic "I accept everything". The user has to be able to say yes to analytics cookies and no to advertising cookies. And non-essential categories have to come unchecked by default: a pre-checked box is not an expression of will, it's a trap.
Unambiguous means that continuing to browse is not consent. The "if you keep browsing you accept our cookies" line still seen on some sites no longer has any validity. And there is a fourth condition almost nobody mentions: consent has to be as easy to withdraw as it was to give. If accepting takes one click, withdrawing consent cannot require writing an email to the legal team.
The three layers of consent that actually complies with the law.
When we audit implementations, we look at three layers. All three have to work; two out of three is not compliance.
Layer 1: Capture. This is the banner or the consent management platform (CMP). It presents the information, offers symmetrical options and records the user's decision. It's the visible layer.
Layer 2: Technical propagation. This is where compliance is either real or “cosmetic”. The user's decision has to reach every technology on the site and be obeyed: if someone rejects marketing or analytics cookies, the Meta pixel cannot fire, the Google Ads tag cannot write cookies, the analytics platform cannot build its profile. The most common failure is this: banner installed, user rejects, and the tags fire anyway, or worse, they fired before the banner even appeared! That site has a decorative banner and an active violation. Mechanisms like Google Consent Mode v2 and a correct architecture in the tag manager exist precisely so that the consent signal governs the behavior of the entire marketing or martech stack.
Layer 3: Proof and management over time. The burden of proof is on the company. Faced with an enforcement action by the Agencia de Protección de Datos Personales, you have to be able to show who consented, what they consented to, when and through which interface. That calls for an auditable consent record, with versioning: if you changed the banner text or added a new purpose, you need to know which version each user consented under. And this layer connects to something bigger: cookie consent is only one of the rights the law grants. A person can later request access, rectification, erasure or portability of their data, and the banner solves none of that. Managing the full lifecycle of consent and of data subject rights is a structural problem, not a web design one.
The questions a CMO should be asking today
If a user rejects cookies, the advertising tags do in fact stop firing. Who is going to verify that technically when the law kicks in; IT, Marketing, the agency?
What happens operationally when someone withdraws their consent? Are they removed from advertising audiences?
Would our banner hold up to the standard of symmetry and absence of dark patterns that regulators in Europe already apply?
How many sales or leads do I generate from audiences that consent will affect? And what is the possible impact on sales?
Do we know what share of our users is accepting (opt-in), and what that means for our marketing measurement?
The last two questions open up the business dimension: in Europe, between 30% and 55% of users reject non-essential cookies. That will be the new landscape for digital measurement in Chile, and the companies that understand it first, with robust first party data strategies and adapted measurement, will compete with a better signal than the ones that installed a banner just to tick the box.
