Privacy & Compliance · Guide

Cookie Consent Banners: What GDPR Actually Requires

By Richard Z. Updated Documentation-based guide
CookieFirst
Visit CookieFirst

Most cookie banners on the web today are still non-compliant — not because teams are ignoring the law, but because "looks compliant" and "is compliant" turned out to be different things. Regulators have fined major companies specifically over banner design, not over whether a banner existed at all. Here's what GDPR actually requires, how it differs from the US approach, and what a compliant banner looks like in practice.

The core rule: opt-in, not opt-out

Under GDPR and the ePrivacy Directive, non-essential cookies (analytics, advertising, personalization) require consent before they're set — not a notice that consent is assumed unless the visitor objects. This is the opposite of how the US generally handles it: CCPA in California is an opt-out model, where tracking can start first and the visitor is given a way to decline afterward. A site serving both EU and US visitors typically needs both flows, not one banner doing double duty.

What a compliant banner actually needs

Four elements come up consistently across regulatory guidance and enforcement actions:

  • Equal visual weight for Accept and Reject. A large colored "Accept All" button next to a small grey "Manage Preferences" link is a documented dark pattern regulators have specifically fined companies over — including a widely reported €150 million CNIL fine against Google in 2021 tied to exactly this kind of design.
  • One click each way. If accepting takes one click and rejecting takes three (buried in a preferences panel), that's not equal choice.
  • No pre-ticked boxes. Every non-essential category should default to off until the visitor actively turns it on.
  • Plain-language categories. Visitors should understand what "Analytics" or "Marketing" cookies actually do before deciding, not just see a wall of legal text.

Where most banners still fail

The gap usually isn't a missing reject button — most sites have one by now. It's more subtle: a reject option that technically exists but is visually secondary, analytics scripts that fire before any click happens, or consent categories bundled together so "rejecting marketing" also silently blocks something the visitor wanted to keep. These are the patterns regulators have been targeting in recent enforcement, not the absence of a banner altogether.

The enforcement cases behind these rules

These requirements are not theoretical; they come from specific rulings and fines:

  • Planet49 (Court of Justice of the EU, 2019). The court ruled that a pre-ticked checkbox does not amount to valid consent for cookies. Consent has to be an active choice by the visitor.
  • CNIL fines against Google and Facebook (announced January 2022). France's data protection authority fined Google a combined €150 million and Facebook €60 million because rejecting cookies took more steps than accepting them. The practical lesson: refusing must be as easy as accepting.
  • Coordinated regulator guidance. European data protection authorities have since published shared positions on banner design, flagging practices such as missing reject buttons on the first layer, deceptive colors and contrast, and claiming "legitimate interest" for cookies that require consent.

Sites that use Google advertising or measurement products with visitors in the European Economic Area also need to pass consent signals to Google. Google Consent Mode v2 adds the ad_user_data and ad_personalization signals alongside ad_storage and analytics_storage. Without them, remarketing and some conversion features stop working for EEA traffic. Most consent management platforms send these signals automatically once configured, which is one of the practical reasons teams move from a hand-built banner to a CMP.

The US side: opt-out and Global Privacy Control

Under California's CCPA as amended by the CPRA, sites that "sell" or "share" personal information for cross-context advertising must offer an opt-out, commonly a "Do Not Sell or Share My Personal Information" link. California regulators also expect businesses to honor the Global Privacy Control (GPC) browser signal as a valid opt-out request. Several other US states have passed privacy laws with similar opt-out rights, so a US-facing site increasingly needs its own flow rather than simply reusing the EU banner.

A quick self-check

Before calling a banner compliant, open the site in a private window with developer tools open and check four things: no analytics or advertising requests fire before a choice is made; "Reject all" is available on the first layer with the same prominence as "Accept all"; every non-essential category starts switched off; and a way to change or withdraw consent stays available after the banner closes.

For a single simple site, a basic banner plugin can technically get the job done. Where a dedicated consent management platform (CMP) earns its cost is when you need: consent logged and retrievable for audits, automatic script-blocking until consent is given (rather than trusting every script on the page to check a cookie manually), and multi-region logic that shows an EU-style opt-in flow to EU visitors and a US-style opt-out flow to US visitors from the same install. CookieFirst is one option in this category — worth a look if you need that regional logic without building it yourself.

Try CookieFirst

Bottom line

A cookie banner that exists isn't the same as a cookie banner that's compliant. The specific failure points — unequal button weight, pre-ticked boxes, scripts firing before consent — are exactly what's been drawing enforcement action, and they're all fixable without redesigning the whole site. For a closer look at one consent management option, read our full CookieFirst review covering setup and pricing.

This article provides general information based on publicly available regulatory guidance and is not legal advice. Consult a qualified professional for compliance decisions specific to your business.

Related Compliance & Privacy Reviews

Read Full CookieFirst Review → • View All Software Categories →

Frequently asked questions

Does every website need a cookie consent banner?
If a site serves visitors in the EU/EEA and sets any non-essential cookies (analytics, advertising, personalization), GDPR requires consent before those cookies are set. Sites that only use strictly necessary cookies generally don't need a consent banner for that requirement, but few sites run analytics without one.
What's the difference between GDPR and CCPA cookie requirements?
GDPR requires opt-in consent before non-essential cookies are set. CCPA in California generally follows an opt-out model, where tracking can begin and the visitor is given a mechanism to decline afterward. A site serving both audiences typically needs to handle each differently rather than using one flow for both.
Is a pre-ticked "Accept" checkbox allowed under GDPR?
No. Regulatory guidance is explicit that non-essential cookie categories must default to off; a visitor has to actively opt in rather than having consent assumed by default.
Can I use one cookie banner design for both EU and US visitors?
It's possible but often means the banner doesn't fully satisfy either standard — an opt-in-first design that also needs to work as opt-out functionality for US visitors. Some consent platforms handle this by detecting visitor location and showing the appropriate flow automatically.
Are pre-ticked cookie boxes allowed under GDPR?
No. The Court of Justice of the EU ruled in the Planet49 case (2019) that pre-ticked checkboxes do not constitute valid consent. Non-essential categories must start switched off.
Does a US-only website need a cookie banner?
US law generally follows an opt-out model rather than prior consent, but laws such as California's CCPA/CPRA require an opt-out for selling or sharing personal information and honoring the Global Privacy Control signal. Requirements vary by state and by what data you collect.