Government websites follow the same cookie consent rules as any other website: Article 5(3) of the ePrivacy Directive requires consent before non-essential cookies, and the GDPR governs the personal data they collect. Two things make the public sector different. A citizen cannot go to a competitor for a passport, so cookie walls and pressure to accept do not produce valid consent. And public bodies have their own accessibility law, the Web Accessibility Directive, which reaches the cookie banner too.
Government websites are not exempt from cookie rules
Public sector organisations sometimes assume that their status as government bodies exempts them from cookie consent requirements. It does not. The GDPR applies to any organisation that processes personal data of individuals in the EU, and Article 5(3) of the ePrivacy Directive covers all websites, whether a private company or a government ministry runs them.
Government websites often handle sensitive citizen data, which makes proper cookie consent even more important than on a standard commercial site.
Why public sector cookie consent differs from the private sector
The legal framework is the same, but the practical considerations diverge. Government websites serve captive audiences. A citizen renewing a passport or filing a tax return cannot choose a competitor. This creates a power imbalance that regulators take seriously when they assess whether consent is freely given, as GDPR Article 7 requires.
The EDPB has been clear that consent must be freely given, and that where there is a clear imbalance of power between the individual and the controller, consent is unlikely to be valid. Public authorities should therefore rely on consent for cookies only where refusing carries no negative consequences for the citizen.
This means a cookie wall on a government website is very hard to defend. A citizen cannot be denied access to essential public services because they declined analytics cookies.
Accessibility requirements add another layer. Public sector websites fall under the Web Accessibility Directive (Directive (EU) 2016/2102), not the European Accessibility Act, which covers private-sector products and services. Its harmonised standard, EN 301 549, follows WCAG 2.1 Level AA, so a government cookie banner must be accessible: keyboard operation, screen reader support and sufficient colour contrast.
Which cookies government websites commonly set
A typical government website sets fewer cookies than a commercial site, but the ones it does set still need proper classification and, in most cases, consent.
| Cookie type | Examples | Consent required? | Notes |
|---|---|---|---|
| Strictly necessary | PHPSESSID, authentication tokens, CSRF tokens | No | Must be genuinely essential to deliver the service |
| Analytics | _ga, _ga_*, Matomo cookies | Yes in the EU, with narrow exemptions, and a UK exception since February 2026 | Measures site performance and usage |
| Functional | Language choice, accessibility preference cookies | Usually no, when they remember a choice the visitor made | A language selector the visitor uses is part of the service requested |
| Marketing and advertising | _fbp, retargeting pixels | Yes | Rare on government sites, but sometimes present through embedded social content |
Many government websites embed third-party content without realising the cookie implications. A YouTube video embed can store identifiers on the visitor's device. Google describes its privacy-enhanced mode (youtube-nocookie.com) as limiting personalisation from views, not as an embed that stores nothing, so it does not remove the consent question. Social sharing buttons from Facebook or X can set cookies the moment the page loads. Loading embeds only after consent, with a placeholder until then, solves both, and that is what iframe blocking does.
Analytics on government websites: consent or exemption?
Under the ePrivacy Directive, analytics cookies are not exempt from consent. Article 5(3) exempts only storage that is strictly necessary for the service the user explicitly requested. Some national regulators and, since 2026, the UK allow narrow exceptions.
In France, the CNIL exempts audience measurement from consent under strict conditions, set out on its page on audience measurement tools. The trackers must serve only the site's own measurement and must not allow tracking across sites. The CNIL gives tool providers a self-assessment rather than naming approved products, and says offers whose provider reuses the data for its own purposes fall outside the exemption unless that reuse can be switched off. Standard Google Analytics set-ups therefore need consent in France.
In the UK, the Data (Use and Access) Act 2025 added an exception in force since 5 February 2026. Under paragraph 5 of Schedule A1 to PECR, a site may use storage whose sole purpose is to collect statistics about how its service or website is used, to improve it, without consent, as long as visitors get clear information and a simple, free way to object. UK public bodies can use first-party statistics on that basis. Advertising and cross-site tracking still need consent.
How to structure consent on a government website
A government cookie banner follows the same rules as any other. The EDPB's cookie banner taskforce reported in January 2023 that most European authorities treat a layer with an "accept all" option but no reject option as an infringement. Pre-ticked boxes for non-essential cookies are not valid consent.
Government websites should adopt a consent-first approach:
- Block all non-essential cookies until the visitor makes an active choice
- Provide a clear "reject all" button with the same visual weight as "accept all"
- Avoid dark patterns such as colour-biased buttons or hidden reject options
- Make withdrawing consent as easy as giving it, through a persistent link or floating icon
- Make sure the banner meets the WCAG 2.1 AA requirements of EN 301 549
Given the power imbalance between government bodies and citizens, legitimate interest is generally not available to public authorities for processing carried out in the performance of their tasks: Article 6(1) of the GDPR says so directly. For non-essential cookies, Article 5(3) of the ePrivacy Directive requires consent anyway.
Enforcement risks for public sector bodies
Regulators review public and private sites alike. In January 2025, the ICO said it had assessed the UK's 200 most visited websites, written to 134 of them about their cookie banners and extended the review to the top 1,000. By December 2025, 979 of the top 1,000 met its checks, and 17 had received preliminary enforcement notices.
Since 5 February 2026, the ICO can fine breaches of the Privacy and Electronic Communications Regulations up to GBP 17.5 million or 4% of global turnover, up from GBP 500,000. For public bodies it can also issue reprimands and enforcement notices.
In France, the CNIL imposed 83 sanctions totalling EUR 486.8 million in 2025 across everything it enforces, and 21 organisations were sanctioned that year over cookies and other trackers, according to its 2025 enforcement summary. The largest fines targeted private companies, but the rules apply equally to public bodies.
Government departments should also weigh reputational risk. A public authority found breaking privacy rules it may itself administer sends a damaging signal to citizens.
Practical steps for public sector cookie consent
Run a thorough cookie audit
Start with an automated scan to identify every cookie and tracker on your website. Many government sites have accumulated third-party scripts over years of development by different teams, and an audit often finds tracking scripts that no one on the current team authorised or knew about.
Classify cookies accurately
Do not label analytics cookies "strictly necessary" because they feel important. The test under Article 5(3) is whether the cookie is strictly necessary for the service the user explicitly requested. Performance measurement does not meet that threshold, outside the narrow French and UK exceptions above.
Choose privacy-preserving analytics
Consider switching to privacy-preserving analytics tools that can run without cookies, or with first-party cookies configured to meet the CNIL's conditions or the UK exception. Tools such as Matomo, configured without cookies, or Plausible Analytics can provide useful traffic data, and whether they need consent depends on how you configure them and where your visitors are.
Document everything
Keep records of your cookie audit results, consent configuration and the legal basis for each cookie category. If a regulator opens an investigation, a clear audit trail shows how your organisation made its decisions.
Questions about cookie consent for government websites
Do government websites need a cookie banner?
Yes, if they set non-essential cookies. The GDPR and the ePrivacy Directive apply to public sector bodies as well, so a government website needs prior consent for non-essential cookies, given through a banner with equal accept and reject options.
Can a government website use Google Analytics without consent?
Not in the EU in a standard set-up. Analytics is not strictly necessary, and the CNIL's audience measurement exemption excludes tools whose provider reuses the data for its own purposes. In the UK, first-party statistics can run without consent since 5 February 2026 if visitors are told and can object.
Are cookie walls allowed on public sector websites?
Very hard to defend. Because citizens often have no alternative provider for public services, consent given to get past a cookie wall is unlikely to be freely given and therefore unlikely to be valid under the GDPR.
What penalties can government bodies face for cookie breaches?
Under the GDPR, fines can reach EUR 20 million or 4% of annual turnover, though some countries limit fines on public bodies. In the UK, PECR fines can reach GBP 17.5 million or 4% of global turnover since 5 February 2026, and regulators can also issue reprimands and enforcement notices.
Which accessibility law applies to a government cookie banner?
In the EU, the Web Accessibility Directive (Directive (EU) 2016/2102), which covers public sector websites and apps. Its harmonised standard, EN 301 549, follows WCAG 2.1 Level AA. The European Accessibility Act covers private-sector products and services instead.
How should government websites handle embedded social media content?
Embedded content from platforms like YouTube, Facebook or X often stores identifiers on the visitor's device, and YouTube's privacy-enhanced mode does not remove the consent question. Load embeds only after consent, with a placeholder until then, or replace them with plain links.
Check your public sector site before a citizen does
Most public sector cookie problems come from scripts nobody remembers adding. Kukie.io's GDPR compliance scanner opens one page the way a new visitor would and reports cookies and trackers set before any choice and a missing reject button, and its accessibility-focused banner is designed against WCAG 2.2 Level AA. For other countries' rules, see the guide to privacy laws around the world.
