Introduction

Every visitor to your website sees a legal document within a second of arriving. It is not your privacy policy, which almost nobody reads. It is your cookie banner. That makes it the most visible piece of legal compliance your business has, and in practice one of the most often broken. Many banners across the EU collect consent that would not hold up if a regulator looked at it, and they do so in public, on the busiest page of the site.

This article explains which laws sit behind the banner, what valid consent actually requires, why refusing must be as easy as accepting, which design tricks make consent invalid, and how you can check your own website in a few minutes.

Why Your Website Needs a Banner at All

Two sets of EU rules work together here. The first is the ePrivacy Directive, which contains the cookie rule. It says that storing information on a visitor’s device, or reading information already stored there, requires the visitor’s prior consent after clear information. This rule protects the device itself. It therefore applies even when no personal data is involved, and it covers far more than cookie files. Guidance from the European Data Protection Board, known as the EDPB, which brings together the national data protection authorities, has confirmed that tracking pixels, tracking links, information stored in the browser, certain tracking based on IP addresses and similar techniques can all fall under it. The second is the General Data Protection Regulation, usually called the GDPR. It defines what consent means and governs what happens to any personal data afterwards.

Not everything needs consent. Cookies that are strictly necessary to provide what the visitor has asked for are exempt. Typical examples are a shopping cart, a login session, security features, load balancing and remembering the visitor’s cookie choice. If your site cannot deliver the service the visitor asked for without it, no consent is needed.

Advertising cookies, social media pixels and embedded content that places trackers, such as some video players, sit on the other side of the line. Analytics generally does too. Some national authorities, including France’s, accept a narrow exemption for simple audience measurement that only produces statistics for the website owner and meets strict conditions. That exemption does not cover typical analytics setups, and it does not exist in the same form everywhere, so do not assume yours qualifies.

This is why the old style of banner, which says “we use cookies to improve your experience” and shows a single OK button, does not work. It does not ask for consent. It announces that tracking is already happening. A visitor scrolling or continuing to browse does not count as consent either, as the EDPB has stated clearly.

What Valid Consent Looks Like

The GDPR sets a high standard. Consent must be freely given, specific, informed and unambiguous, and the visitor must give it through a clear action. In practice this means six tests.

• Easy to withdraw. Withdrawing consent must be as easy as giving it. In practice this means a permanent link or icon on every page, not a search through your privacy policy.

• Before anything runs. Nothing that needs consent may load before the visitor makes a choice. This is the most common failure: the banner looks correct, but the tracking scripts already ran when the page opened. The law judges what your website does, not how the banner looks. The French data protection authority fined Amazon 35 million euros for placing advertising cookies before visitors had any chance to decide.

• An active choice. In the Planet49 case, the Court of Justice of the EU held that a pre-ticked box is not valid consent. The visitor must act.

• Separate purposes. Analytics, advertising and personalisation are different purposes, and each needs its own yes. One general yes to everything is not specific enough.

• Clear information. Visitors need to know who you are, what each purpose does, which third parties can access the information and how long the cookies last. 

• Records. Under the GDPR you must be able to prove consent, which means keeping a record of who agreed to what and when. Without that record, you have a banner but no proof.

Saying No Must Be as Easy as Saying Yes

The most debated question is whether a “Reject all” button is really required. The logic is simple. If accepting takes one click on the first screen, refusing should also take one click on the first screen.

The French authority turned that logic into some of the best known cookie fines so far: 150 million euros for Google and 60 million euros for Facebook, because accepting took one click while refusing took several. Google later added a reject all button to its cookie banners in Europe. The EDPB’s cookie banner taskforce also reported that most national authorities consider a first screen with an accept button, but no equally easy way to refuse, as falling short of valid consent.

Two more points matter for any business that sells online. First, under the current rules, the cookie rule is not covered by the GDPR’s one-stop-shop system, in which a single lead authority usually handles cross-border cases. The authority of any country your visitors come from may therefore be able to act directly, and every website is cross-border by default. Second, a cookie wall, which blocks the whole website unless the visitor accepts tracking, is generally not freely given consent in the EDPB’s view. The separate debate about “pay or consent” models concerns large platforms and publishers, and it is not a model for an ordinary online shop.

Design Tricks That Make Consent Invalid

Many banners have both buttons and still fail, because their design pushes people toward accepting. Regulators often call these tricks dark patterns. The most common are:

• A bright, prominent accept button next to a reject option that is pale, small or hidden as a text link. When the design pushes the choice, the choice is no longer free.

• Guilt-trip wording, such as “No thanks, I prefer a worse experience.”

• A second screen full of switches that are already turned on in the name of “legitimate interest”. Under the cookie rule, storing or reading information on a device needs either consent or the strictly necessary exemption. Legitimate interest is not an alternative, so these pre-switched toggles do not make the tracking lawful.

• A long list of hundreds of partners, where accepting takes one click but refusing takes minutes.

• Asking again and again. If a visitor refuses, respect that decision as you would respect an acceptance, and do not show the banner again a few minutes later. Several regulators recommend remembering a refusal for a reasonable period.

• Marketing cookies labelled as “strictly necessary” so that they run whatever the visitor chooses.

These problems are among the easiest in data protection to detect, because your homepage is public. Regulators run automated checks, the EDPB publishes a free website auditing tool, and privacy organisations have filed complaints about cookie banners in large numbers. Nobody needs an insider to find a broken banner.

A Quick Self-Test

Open your own website in a private browser window and ask five questions.

1. On the first screen, is refusing exactly as easy as accepting?

2. Using a free cookie scanner or your browser’s developer tools, does anything that needs consent load before you click?

3. Are all optional switches off by default, including any labelled “legitimate interest”?

4. After making a choice, can you find where to change it within a few seconds?

5. Does your cookie policy describe what actually runs on the site today?

If any answer is wrong, the banner fails. The fix is rarely a more expensive tool. Most failing sites already have a consent platform that is set up incorrectly: scripts load outside its control, the purposes do not match what the site does, or the policy describes a site that no longer exists. Major advertising platforms, including Google, have made some of their features depend on receiving valid consent signals for European visitors. A broken banner can therefore also quietly damage your advertising data.

Conclusion

In summary, the cookie banner rests on two laws: the ePrivacy cookie rule, which protects the visitor’s device, and the GDPR, which defines consent. Strictly necessary cookies need no consent, while advertising and most analytics do. A banner that only announces cookies, or treats scrolling as agreement, does not collect consent at all. Valid consent passes six tests: it comes before anything runs, it is an active choice, it is separate for each purpose, it is informed, it is recorded and it is easy to withdraw. Refusing must be as easy as accepting, and design tricks can make an otherwise attractive banner invalid.