Third-party tracking raises privacy concerns due to the covert collection, aggregation, and potential misuse of users’ personal data, undermining individuals’ sense of control and privacy online. In Europe, tracking is regulated by the GDPR and ePrivacy Directive (ePD), which require explicit user consent. In contrast, US websites, governed by a patchwork of state and federal laws, often rely on opt-out mechanisms. However, when dealing with EU residents’ data, US companies must comply with the GDPR. We present an empirical study assessing compliance with GDPR and ePD consent requirements in EU and US websites through their cookie banner implementations. We identified 19 potential violations of these regulations and developed a systematic method to detect them. Our key findings are: a) none of the examined EU or US websites fully comply with GDPR and ePD consent standards; b) both EU and US websites engage in user tracking before a choice is made and even after consent is denied; c) websites that use Consent Management Platforms (CMPs) are generally more compliant than those that do not. These findings highlight widespread non-compliance and the need for stronger enforcement and clearer guidance on valid consent mechanisms.