Cookies and consent: a banner that follows the law

A cookie banner is fine when it doesn't put anything non-essential on a visitor's phone or computer before they click "Accept," when saying no is as easy as saying yes, and when people can change their decision at any time. Colors, copy and placement only matter to the extent that they don't trick anyone into accepting.

What the law says, without the jargon

The basic rule comes from the EU ePrivacy Directive, Article 5(3): a website may store or read information on a user's device only with their consent, after telling them clearly and fully what it's for. There are two exceptions: what is strictly needed to transmit the communication, and what is strictly needed to provide the service the user explicitly asked for.

Each EU country applies the directive through its own national law. The conditions for valid consent, though, come from the GDPR, which says plainly that silence, pre-ticked boxes or inactivity are not consent. The GDPR also says withdrawing consent must be as easy as giving it.

In 2019, in the Planet49 case, the EU Court of Justice settled three useful points:

• a pre-ticked box that people have to untick to refuse is not valid consent;
• the rule covers any information on the device, not only personal data;
• people must be told how long cookies stay active and whether third parties can access them.

Which cookies need consent and which don't

No consent needed for what is strictly necessary for what the user asked for: the shopping cart, the login session, the cookie that remembers the choice made in the banner itself. European regulators have also listed cookies that store a user's preferences for a service as essential.

Consent needed, as a rule, for traffic analytics, ad pixels and embedded third-party content that sets its own cookies.

The hard part is the list. Cookies change when you add a new plugin, a chat widget or a map. Regulators have said a fixed list of "essential" cookies is hard to pin down and that keeping the list current is the website owner's job.

What European regulators said in January 2023

In January 2023, the European Data Protection Board (EDPB) published the report of its task force on hundreds of complaints about cookie banners. The report isn't law and doesn't hand out a seal of approval, but it shows the minimum bar regulators accept:

1. Reject on the first screen. A large majority of regulators consider it a violation when there's no reject option on the same layer as the accept button.
2. No pre-ticked boxes in the detailed settings.
3. Don't hide the reject option. A reject link buried in body text, with nothing visual to point it out, does not produce valid consent.
4. Contrast. There's no general color rule; each case is judged on its own. But a reject button whose text barely shows against its background is considered misleading.
5. "Legitimate interest" can't replace consent for placing cookies.
6. Don't hold the site hostage. The banner shouldn't suggest that you can't see the content without clicking "Accept."

A compliant banner, step by step

1. Open the site in a private window and check the cookies section in the browser's developer tools. Before any click, only strictly necessary cookies should be there.
2. On the first screen: "Accept," "Reject" and "Settings," with "Accept" and "Reject" the same size and equally visible.
3. In "Settings": categories with a short explanation, all unticked.
4. In the banner text or on the cookie page: which cookies you use, why, who has access (third parties) and how long they last.
5. A permanent link, for example "Cookie settings" in the footer, so people can change their mind.
6. After "Reject," the site works normally. Check again in a private window that nothing extra showed up.
7. Every time you add a new plugin, update the list.

Step 1 is where most surprises turn up. A theme or plugin can load analytics scripts before the banner gets a chance to ask anything. The banner looks right but blocks nothing.

The banner is part of the site, not an add-on

When we build a website, we build the banner with it instead of bolting it on at the end. That way we know which scripts fire and when. If you want us to check an existing site, or start a new one with this handled from day one, see our web studio services.