Cookie consent, the way regulators check it.
In the EU, no analytics or advertising tracker may run before the visitor agrees, and refusing must be as easy as accepting. Privacyboard’s banner holds trackers back, logs each choice and checks your site in a real browser.
Free to set up · No credit card · Checked 12 November 2026
In short
- Applies to
- Every website used by people in the EU, UK or Switzerland
- The rule
- No optional tracker before consent
- Who enforces
- National authorities, such as the CNIL
- In Privacyboard
- Banner on every plan, Free included
What cookie law asks, and how the banner answers
Pick a duty to see the screen that handles it.
What the law asks
Regulators check what a page loads, not what the policy says.
In Privacyboard
Your site opened in a real browser, every cookie and service listed.
Every planAutomatic scans on Pro
Show all 6 duties as a list
ScanKnow what your site loadsEvery plan
What the law asks: Regulators check what a page loads, not what the policy says.
In Privacyboard: Your site opened in a real browser, every cookie and service listed. Automatic scans on Pro.
ePrivacy Art. 5(3)Ask before any tracker runsEvery plan
What the law asks: Consent first for anything not strictly necessary.
In Privacyboard: Optional scripts stay blocked until the visitor chooses.
GDPR Art. 7(3)Make refusing as easy as acceptingEvery plan
What the law asks: Refusing on the same screen, as easily as accepting.
In Privacyboard: Accept all and Reject all side by side, same weight.
ChecksCheck nothing loads too earlyEvery plan
What the law asks: A pixel firing before the choice is what most fines are about.
In Privacyboard: Services contacted before the choice are reported to you.
GDPR Art. 7(1)Prove each choiceEvery plan
What the law asks: You must be able to show who agreed, to what, and when.
In Privacyboard: Every choice logged without IP address, kept 13 months. Exports on Business.
SignalsPass the choice to your tagsEvery plan
What the law asks: Google requires consent signals for EEA ads since March 2024.
In Privacyboard: Google Consent Mode v2 and Global Privacy Control built in.
What regulators have decided
CNIL fine against Google, September 2025
CNIL fine against Shein, same day
to keep a choice before asking again, per the CNIL
Most decisions target ordinary sites: trackers before the choice, or a hidden refusal.
How the rules got here
Consent required
Storing anything on a device needs consent.
Planet49
Pre-ticked boxes are not consent.
CNIL guidelines
Refusing must be as easy as accepting.
Consent Mode v2
Google requires consent signals in the EEA.
Digital Omnibus
Council position agreed. Still a proposal.
What Privacyboard covers, and what it does not
Covered
- Trackers blocked until the visitor chooses
- Equal Accept all and Reject all
- A scan in a real browser
- Alerts for anything loaded too early
- Consent log without IP addresses
- Consent Mode v2, GPC, regional rules
- One-click install on Webflow, WordPress, Shopify
Not covered
- Trackers inside mobile apps
- Blocking server-side tags (they are reported)
- Deciding whether your own cookies are strictly necessary
Privacyboard is a guidance tool, not legal advice.
Your first hour
- 1
Scan your site
The services it loads are listed.
- 2
Declare them
Each in its category, described for you.
- 3
Install the banner
One click, or one script tag.
- 4
Check it
Anything loading too early is reported.
Go online for free. Grow when you need to.
Free puts you online. Pro adds requests, monitoring and your team; Business, security questionnaires and only your brand.
Free
$0 forever
No card, no time limit
For getting compliant and going online on your own.
Start for freeKey features:
- Privacy and cookie policies
- Vendor and processing registers
- Requests and breaches tracked
- Impact assessment screening
- AI Act screening
- Privacy center on privacyboard.io
- Cookie banner on 1 domain
- 1 person
- And 1 more on the pricing page
No card needed
ProRecommended
$20 per month
Billed $240 a year Save $48
For founders who want to be compliant in a few clicks and stay that way.
Start with ProEverything in Free, plus:
- DPA for your clients
- Vendor monitoring
- Reminders for documents and reviews
- Request form and replies
- Your own domain
- Banner on 3 domains, every choice logged
- Weekly site scan
- Complete DPIAs and TIAs
- AI assistant connector
- 2 people
- And 1 more on the pricing page
Cancel any time
Business
$109 per month
Billed $1,308 a year Save $240
For the person in charge of privacy: every detail in order, a team with roles, and proof for audits and customers.
Start with BusinessEverything in Pro, plus:
- Up to 50 people, with roles
- PDF and Excel exports
- Signed agreements on vendors
- Activity log kept 3 years
- Security questionnaires answered for you
- No Privacyboard mention
- Center in English and French
- Evidence pack in one click
- Banner on 10 domains, daily scan
- Two-step verification required
- And 3 more on the pricing page
Bank transfer on request
Questions, answered.
Do I need a banner for Google Analytics only?
In the EU, yes in most cases: analytics cookies are not strictly necessary.
Is a “Reject all” button mandatory?
Refusing must be as easy as accepting, on the same screen. An equal Reject all is the safe design.
How long can a choice be kept?
The CNIL considers 6 months good practice. It is Privacyboard’s default.
Does the Digital Omnibus change the rules?
Not yet. It is a proposal; Article 5(3) still applies as it is.
Official sources
- Directive 2002/58/EC (ePrivacy), EUR-Lex
- CNIL, consolidated cookie recommendation
- CNIL, fines against Google and Shein
- Digital Omnibus procedure, EUR-Lex
- Google, EU user consent for advertising
Checked on 12 November 2026. Laws and guidance change: read the official text before you rely on a figure.
Read more
Guides on the blog
- Is Google Analytics allowed in the EU? What regulators have said9 min read
- How to find every cookie and tracker on your website (step by step)8 min read
- Google Consent Mode v2 explained for small businesses5 min read
- GDPR cookie consent: what the rules actually require5 min read
- Global Privacy Control (GPC): what it is and who has to honour it9 min read
- GDPR checklist for small businesses: 15 things to have in place7 min read