GDPR cookie consent: what a compliant banner actually needs

Under EU law, most cookies and similar trackers can only be set after the user has given consent. This comes from the ePrivacy Directive, with the GDPR defining what valid consent looks like. In practice, a compliant cookie banner has to satisfy a short but strict checklist.

1. Consent must be prior

Non-essential cookies cannot be set before the user agrees. A banner that loads analytics on page view and only then asks for permission is not compliant. This is why prior-blocking — holding scripts until opt-in — matters so much.

2. Consent must be granular

Users should be able to accept some categories and reject others. Bundling analytics and marketing into a single Accept button removes meaningful choice.

3. Reject must be as easy as accept

Regulators across the EU have made clear that a prominent Accept all with a buried reject option is a dark pattern. Offer a Reject all button with equal visual weight on the first layer of the banner.

4. Withdrawal must be easy

Users need to change their mind later just as easily as they consented. A persistent settings link or floating icon that reopens the preferences is the standard solution.

5. You must be able to prove it

If a regulator asks, you need records: who consented, to what, and when. An audit log of consent events is your evidence.

Common mistakes

• Loading Google Analytics or the Meta pixel before consent.
• Pre-ticked category checkboxes (never valid consent).
• Cookie walls that block all access unless the user accepts.
• No way to withdraw consent after the banner is dismissed.

Getting these right is mostly a technical problem once you understand the rules. The legal framing is stable; the hard part is enforcing prior-blocking and keeping an accurate cookie inventory as your site changes.