  As a result of the GDPR and the ePrivacy Directive, European users encounter
cookie banners on almost every website. Many of such banners are implemented by
Consent Management Providers (CMPs), who respect the IAB Europe's Transparency
and Consent Framework (TCF). Via cookie banners, CMPs collect and disseminate
user consent to third parties. In this work, we systematically study IAB
Europe's TCF and analyze consent stored behind the user interface of TCF cookie
banners. We analyze the GDPR and the ePrivacy Directive to identify legal
violations in implementations of cookie banners based on the storage of consent
and detect such violations by crawling 22 949 European websites. With two
automatic and semi-automatic crawl campaigns, we detect violations, and we find
that: 141 websites register positive consent even if the user has not made
their choice; 236 websites nudge the users towards accepting consent by
pre-selecting options; and 27 websites store a positive consent even if the
user has explicitly opted out. Performing extensive tests on 560 websites, we
find at least one violation in 54% of them. Finally, we provide a browser
extension to facilitate manual detection of violations for regular users and
Data Protection Authorities.
