Cookie banners are the most visible privacy control on the web and among the most frequently non-compliant. Regulators across the EU have issued a steady stream of decisions on them, and the pattern of what fails is now well established.
#The legal basis is not GDPR alone
Cookies in the EU and UK are governed primarily by the ePrivacy Directive, implemented in national law. It requires consent before storing or accessing information on a user's device, for anything not strictly necessary.
GDPR then defines what valid consent means. The two operate together: ePrivacy says when consent is required, GDPR sets the standard it must meet.
This is why "we have a legitimate interest in analytics" does not work for cookies. ePrivacy requires consent regardless of whether you could identify a GDPR basis.
#The six requirements
1. Consent before the cookie is set. Not on the next page view, not after a scroll. Non-essential scripts must not execute until consent is given. This is the requirement most banners fail — the analytics tag fires on page load and the banner appears afterwards.
2. Refusing must be as easy as accepting. If "Accept all" is one click, rejecting all must also be one click, at the same level. A prominent accept button with rejection hidden behind "Manage preferences" has been repeatedly ruled invalid.
3. Granular by purpose. Users must be able to consent to some categories and not others — typically necessary, functional, analytics and advertising. A single all-or-nothing toggle is not valid consent.
4. Informed. Before consenting, users need to know who is setting cookies, for what purpose and for how long. A link to a cookie policy listing them satisfies this; "we use cookies to improve your experience" does not.
5. Unambiguous and affirmative. Pre-ticked boxes are invalid. Continuing to browse is not consent. Scrolling is not consent. Closing the banner is not consent.
6. Withdrawable and logged. Users must be able to change their mind as easily as they gave consent — usually a persistent link or floating icon. You must retain a record demonstrating consent was obtained.
#The dark patterns that invalidate consent
Regulators have specifically ruled against:
- Colour and contrast manipulation — a bright accept button against a greyed-out reject
- Rejection behind extra clicks while acceptance is immediate
- Cookie walls that deny access entirely unless you accept advertising cookies
- Pre-ticked category toggles
- Legitimate interest toggles pre-enabled for advertising purposes
- "Reject" that does not actually reject, where scripts fire anyway
That last one is worth emphasising. A banner is a user interface; compliance depends on what happens in the code behind it. A perfectly worded banner that does not gate script execution is decorative.
#What "strictly necessary" covers
Only what is essential for a service the user explicitly requested:
- Session and authentication cookies
- Shopping cart contents
- Load balancing
- Security and fraud prevention
- Remembering the cookie consent choice itself
It does not cover analytics, even privacy-focused analytics, A/B testing, personalisation, or anything advertising-related. This is the most common misclassification, and reclassifying analytics as necessary is not a defence.
#Google's additional requirement
Beyond the law, Google's EU user consent policy requires publishers serving Google ads or using Google Analytics to obtain consent from EEA, UK and Swiss users through a certified Consent Management Platform, and to pass consent signals via Consent Mode. Non-compliance can mean ad serving being limited in those regions.
This is a contractual obligation independent of regulatory enforcement, and it is enforced faster.
#Implementing it
Use a certified CMP if you serve advertising. Building your own is possible for a simple site, but the Google requirement effectively mandates a certified platform for EEA traffic.
Block by default. Every non-essential script should be gated behind consent. Tag managers make this manageable; hardcoded script tags do not.
Implement Consent Mode. Google's Consent Mode adjusts tag behaviour based on consent state, allowing modelled measurement without cookies where consent is refused.
Log consent. Record the timestamp, the version of the notice shown, and the categories accepted. Without a record you cannot demonstrate compliance, which is the burden GDPR places on you.
Provide a persistent control. A footer link or floating icon that reopens the preference centre.
Re-ask periodically. Consent does not last forever. Twelve months is a common convention, and shorter where processing changes.
#For non-EU sites
If you have no EU, UK or EEA visitors the ePrivacy consent requirement does not apply, but in practice most sites have some. Geo-targeting the banner is common: a full consent banner for EEA and UK visitors, a simpler notice with an opt-out elsewhere. Several US state laws now require honouring Global Privacy Control signals regardless of banner logic. Your privacy policy should describe the cookie categories in detail; the banner is the mechanism, the policy is the disclosure.
Frequently asked questions
Do I need a cookie banner if I only use Google Analytics?
If you have EU, UK or EEA visitors, yes. Analytics cookies are not strictly necessary, so consent is required before they are set — regardless of whether the data is anonymised or aggregated.
Is "by continuing to browse you accept cookies" valid consent?
No. Consent must be an unambiguous affirmative action. Continuing to browse, scrolling and closing a banner have all been explicitly ruled insufficient by EU regulators.
Can I block access to users who refuse cookies?
Cookie walls that condition access on accepting non-essential cookies are generally considered invalid because consent is not freely given. Some regulators permit a paid alternative to consent, but the position varies and remains contested.