Cookie consent best practices: lawful banners under GDPR & ePrivacy (2026)

A cookie banner is not decoration — it is the user-facing edge of two laws. The ePrivacy Directive (2002/58/EC) requires prior consent before storing or reading any information on a user's device except where "strictly necessary" (Art. 5(3)), and the GDPR defines what counts as valid consent (ePrivacy Directive text; GDPR.eu — Art. 7). Most banners fail not because they are missing, but because they look compliant while violating the specific criteria in Art. 7 and Recital 32. If your site uses analytics, ads, pixels, or social embeds, you need a lawful banner — full stop. The broader obligations sit in the GDPR compliance guide.

1. Which cookies need consent?

Only strictly necessary cookies are exempt — session/auth tokens, shopping-cart state, load balancing, security tokens. Everything else needs opt-in before it loads: analytics, advertising, functional/preference, and social-media embeds (CookieYes — EU cookie compliance). "Strictly necessary" is narrow: analytics and personalisation do not qualify, even first-party. You still disclose strictly-necessary cookies in your cookie policy.

2. The five criteria for valid consent (Art. 4(11) + Art. 7)

All five must hold at once; failing one invalidates the whole consent:

  • Freely given — no bundling, no cookie wall, no disadvantage for refusing. Reject must be as easy as Accept.
  • Specific — separate, granular consent per purpose (analytics, ads, personalisation). One "Accept all" toggle is not specific.
  • Informed — name the categories, purposes, and third parties in plain language up front.
  • Unambiguous — a clear affirmative action. Pre-ticked boxes, "by continuing you agree," and scroll-as-consent are invalid (Recital 32).
  • Withdrawable — as easy to withdraw as to give (Art. 7(3)); keep a persistent preferences link.

3. Consent records and blocking by default

You must be able to prove consent was given (Art. 7(1)): timestamp, choices, banner version. And you must block non-essential scripts until consent — loading Google Analytics or a Meta Pixel before the click is a prior-consent failure, the single most common enforcement finding (GDPR Advisor — 2026). A Consent Management Platform (CMP) handles blocking, granular toggles, and records.

4. Enforcement is real and recent

Regulators have moved from guidance to fines. In September 2025 France's CNIL fined Google €325 million and Shein €150 million for cookie violations, and the Dutch DPA fined Kruidvat €600,000 for pre-ticked consent boxes (CookieYes). The pattern: buried reject buttons, no reject-all on the first layer, and scripts firing before consent. The maximum GDPR exposure remains €20M or 4% under Art. 83.

5. A cookie-consent checklist

  1. Audit every cookie your site sets (see PII detection methods for scanning approaches).
  2. Classify strictly-necessary vs everything else.
  3. Block non-essential by default until opt-in.
  4. Show Reject-all with equal prominence on layer one.
  5. Use granular toggles, no pre-ticked boxes, no cookie wall.
  6. Record consent and offer easy withdrawal.
  7. Keep your cookie policy listing every cookie and third party.
  8. Treat a breach of consent as an item in your breach prevention plan.

Decision-support note. PrivScan surfaces likely gaps in your consent setup — non-essential scripts that load before consent, missing reject-all parity, and undisclosed trackers — and returns a prioritized checklist. It scans; it does not give legal advice or certify that a banner is valid.