Cookie Consent Banners: What GDPR Actually Requires

Most cookie banners on the web today are still non-compliant — not because teams are ignoring the law, but because "looks compliant" and "is compliant" turned out to be different things. Regulators have fined major companies specifically over banner design, not over whether a banner existed at all. Here's what GDPR actually requires, how it differs from the US approach, and what a compliant banner looks like in practice.

The core rule: opt-in, not opt-out

Under GDPR and the ePrivacy Directive, non-essential cookies (analytics, advertising, personalization) require consent before they're set — not a notice that consent is assumed unless the visitor objects. This is the opposite of how the US generally handles it: CCPA in California is an opt-out model, where tracking can start first and the visitor is given a way to decline afterward. A site serving both EU and US visitors typically needs both flows, not one banner doing double duty.

What a compliant banner actually needs

Four elements come up consistently across regulatory guidance and enforcement actions:

• Equal visual weight for Accept and Reject. A large colored "Accept All" button next to a small grey "Manage Preferences" link is a documented dark pattern regulators have specifically fined companies over — including a widely reported €150 million CNIL fine against Google in 2021 tied to exactly this kind of design.
• One click each way. If accepting takes one click and rejecting takes three (buried in a preferences panel), that's not equal choice.
• No pre-ticked boxes. Every non-essential category should default to off until the visitor actively turns it on.
• Plain-language categories. Visitors should understand what "Analytics" or "Marketing" cookies actually do before deciding, not just see a wall of legal text.

Where most banners still fail

The gap usually isn't a missing reject button — most sites have one by now. It's more subtle: a reject option that technically exists but is visually secondary, analytics scripts that fire before any click happens, or consent categories bundled together so "rejecting marketing" also silently blocks something the visitor wanted to keep. These are the patterns regulators have been targeting in recent enforcement, not the absence of a banner altogether.

Do you need a dedicated consent platform?

For a single simple site, a basic banner plugin can technically get the job done. Where a dedicated consent management platform (CMP) earns its cost is when you need: consent logged and retrievable for audits, automatic script-blocking until consent is given (rather than trusting every script on the page to check a cookie manually), and multi-region logic that shows an EU-style opt-in flow to EU visitors and a US-style opt-out flow to US visitors from the same install. CookieFirst is one option in this category — worth a look if you need that regional logic without building it yourself.

Bottom line

A cookie banner that exists isn't the same as a cookie banner that's compliant. The specific failure points — unequal button weight, pre-ticked boxes, scripts firing before consent — are exactly what's been drawing enforcement action, and they're all fixable without redesigning the whole site. For a closer look at one consent management option, read our full CookieFirst review covering setup and pricing.

This article provides general information based on publicly available regulatory guidance and is not legal advice. Consult a qualified professional for compliance decisions specific to your business.