Many U.S. cookie compliance programs look sound on paper but fail in practice. Regulators and plaintiffs continue to find mismatches between what companies say they do and how their websites operate. This article provides actionable guidance for organizations to reduce their cookie-related risk amid surging litigation and aggressive enforcement. It distills commentary and a detailed cookie compliance roadmap that professionals from McDermott Will & Schulte, T-Mobile, U.S. Bank and Volkswagen presented at the IAPP Global Summit 2026, as well as insight from a Kroll expert who spoke to the Cybersecurity Law Report. See “Lessons From the Trenches: Winning Strategies for Defeating Pen Register Lawsuits” (Jun. 12, 2024).
