GDPR cookie consent: what the rules actually require
You need a visitor's consent before storing or reading anything on their device that is not strictly necessary, which covers most analytics, advertising and social cookies. Consent must be informed, specific and given by a clear action. Refusing must be as easy as accepting, and you must be able to show the choice.
Cookie rules are the part of privacy law that every visitor sees, and the part that is most often misunderstood. Two texts are involved: the ePrivacy Directive decides when you need consent, and the GDPR decides what counts as consent. This guide puts them together in plain language.
#Do I need a cookie banner?
You need one if your website stores or reads information on a visitor's device, with cookies or similar technologies such as local storage and tracking pixels, and some of it is not strictly necessary. That covers analytics, advertising, retargeting, embedded social buttons and most third-party widgets.
The rule is in Article 5(3) of the ePrivacy Directive (2002/58/EC). Consent is required, except when the storage or access is:
- for the sole purpose of carrying out the transmission of a communication, or
- strictly necessary to provide a service the user has explicitly requested.
A login session, a shopping cart, a load-balancing cookie or a cookie that remembers a consent choice are typical examples of "strictly necessary". A site with only those does not need a consent banner, although it still has to inform people.
The rule applies to the technology, not only to personal data: it covers a cookie even when the data in it is not personal.
#What counts as valid consent?
Because the ePrivacy Directive points to the GDPR for the meaning of consent, a banner has to produce consent that is:
- Freely given. The visitor has a real choice. Refusing must not block access to the site, except where the cookie is truly needed for what they asked for. The EDPB takes the view that "cookie walls" that make access depend on accepting tracking are generally not valid.
- Specific. Separate purposes need separate choices. "Accept everything" cannot be the only option when analytics and advertising are different purposes.
- Informed. Before choosing, the visitor knows who you are, what each category is for and which third parties are involved.
- Unambiguous, with a clear affirmative action. Scrolling, continuing to browse or leaving a box ticked is not consent. The Court of Justice ruled in Planet49 (case C-673/17, October 2019) that pre-ticked boxes do not give valid consent.
#Does "Reject all" have to be as prominent as "Accept all"?
The text of the law says that withdrawing consent must be as easy as giving it (GDPR Article 7(3)), and regulators apply that to the first screen. The French CNIL, for example, fined Google and Facebook in January 2022 partly because refusing cookies took more clicks than accepting. In practice, the safe design is a banner with equal "Accept all" and "Reject all" buttons and a way to choose by category.
#What must happen before the visitor chooses?
Nothing optional may run. Analytics scripts, advertising pixels and embedded content from third parties must stay blocked until consent is given. This is where many sites fail: the banner is displayed, but the trackers have already loaded underneath it. A banner that only looks right is not enough, so check what your pages really load, ideally in a real browser, with the banner untouched.
#Proving consent
The GDPR says you must be able to demonstrate that a person consented (Article 7(1)). Keep a log of choices with the date, the version of the banner text shown and the categories accepted. You do not need the visitor's IP address for this, and avoiding it keeps the log itself low-risk.
#How long does a choice last?
The law does not set a duration. Several authorities recommend asking again after about six months, and again whenever you add a new category or a tool that changes what the banner said. Cookie lifetimes themselves are also limited by some authorities, such as the 13 months the CNIL recommends in France.
#What the banner has to link to
A banner is a summary. Next to it, you need a cookie policy that lists the cookies and trackers, their purpose, their duration and who sets them, and a way to change the choice at any time, for example a "Cookie settings" link in the footer. That policy should be written from what your banner really controls, so the two cannot disagree. Your privacy policy should link to it.
#A practical checklist
- List every cookie and tracker your site sets, including those added by tag managers and embeds.
- Sort them into necessary, statistics, marketing and preferences.
- Block everything that is not necessary until the visitor chooses.
- Show equal buttons to accept and reject, with a way to choose by category.
- Keep a record of each choice, with the banner version.
- Let people change their mind from every page.
- Re-scan the site regularly: a new embed or script can undo the work.
- If you use Google tags, set Consent Mode so they follow the choice.
#FAQ
#Do I need a cookie banner for Google Analytics?
In most EU countries, yes. Analytics cookies are not strictly necessary for the service the visitor asked for, so they need consent. A few authorities exempt narrowly configured, first-party audience measurement, and the conditions are strict, so check the guidance of the authority in the country you target.
#Is "by continuing to browse you accept cookies" valid?
No. Continuing to browse is not a clear affirmative action, so it does not give valid consent.
#Do I need consent for strictly necessary cookies?
No, but you should still mention them in your cookie policy so visitors know what is set.
#Does the rule apply outside the EU?
It applies when you target or monitor people in the EU, wherever your company is. In the United States, state laws take a different approach based on opt-out rights and signals such as Global Privacy Control, and a banner can adapt to the visitor's region.
#Can I use one banner for several countries?
Yes, as long as it meets the strictest rule you are subject to. Many sites use a banner that asks first in the EU and UK and offers an opt-out elsewhere.
#Does a cookie banner make my website compliant?
No tool can promise that. A banner is one part: what your site loads, what your cookie policy says and what you do with the data matter just as much.
#Sources
Privacyboard is a guidance tool, not legal advice. This article explains general rules in plain language and was accurate on the date above; laws and guidance change. For an unusual situation, ask a qualified professional. Spotted a mistake? Write to antoine@unmake.io.