Add a consent banner that defaults to declining
Only if you take EU or UK traffic: both require an active opt-in before any non-essential cookie is set, and a pre-ticked box is not consent. Default-on tracking is the fine, not the banner.
Step 1.4.3
Time: 45m · For: EU/UK traffic
Done when
Load the site fresh and quote the consent banner's options. Declining must be available without hunting, and nothing non-essential may run before a choice. (Proof: the exact words.)