Every website that uses analytics, advertising pixels or third-party scripts needs a working cookie consent setup before those tools are allowed to run. The legal requirement is not new, but enforcement has caught up. On 1 September 2025 France's CNIL fined Google EUR 325 million and SHEIN EUR 150 million, in particular for breaking the rules on cookies, according to the CNIL's announcement. In the UK, the ICO raised concerns with 134 of the top 200 websites in January 2025, and by December 2025, 979 of the top 1,000 met its checks, 564 of them only after the ICO contacted them, according to its December 2025 update.
If you have not set up cookie consent yet, this is the practical, step-by-step process. If you are still deciding between building it yourself and using a tool, start with the difference between cookie consent and a consent management platform.
Step 1: Scan your website for cookies
Before configuring anything, you need a complete inventory of what your site actually sets. Cookies come from your own code (first-party) and from third-party services like Google Analytics, Meta Pixel, chat widgets and embedded videos. Most site owners find more than they expected.
Use a cookie scanner to crawl your site and produce a list. The scan should capture the cookie name, domain, expiry, and whether it is first-party or third-party. You can also inspect cookies manually using Chrome DevTools (Application tab, then Cookies in the sidebar), but a scanner catches cookies set on subpages and after user interactions that a quick manual check might miss.
Record what you find. You will need this list for your cookie policy and for categorising cookies in the next step.
Step 2: Categorise each cookie
Privacy laws distinguish between cookies that are strictly necessary for the site to work and those that are not. The categories most consent tools use are:
| Category | Examples | Consent required? |
|---|---|---|
| Strictly necessary | PHPSESSID, cart tokens, CSRF tokens, load-balancing cookies | No (exempt under Article 5(3) of the ePrivacy Directive) |
| Functional | Language choice, accessibility preferences, login persistence | Yes in the EU. In the UK, cookies that adapt the site's appearance to a visitor's preferences are exempt since 5 February 2026 if visitors are told and can object. |
| Analytics | _ga, _ga_<container-id>, _hjSessionUser | Yes in the EU. In the UK, statistics used only to improve your site are exempt since 5 February 2026 if visitors are told and can object. Opt-out in California. |
| Marketing and advertising | _fbp, _gcl_au, IDE | Yes everywhere (opt-in in the EU and UK, opt-out in the US) |
The UK exceptions come from Schedule A1 to PECR, added by the Data (Use and Access) Act 2025. Getting the categories right matters because your banner presents these groups to visitors. Miscategorising an analytics cookie as strictly necessary is one of the most common failures regulators flag.
Step 3: Choose a consent management platform
A consent management platform (CMP) handles the banner, stores visitors' preferences and blocks scripts. You can build one from scratch, but a dedicated CMP saves months of development and is updated as the rules change.
When evaluating a CMP, check whether it offers automatic script blocking (not just tag manager integration), region-based consent rules and Google Consent Mode v2 support. If you show Google ads as a publisher through AdSense, Ad Manager or AdMob, you also need a CMP certified by Google that uses IAB TCF v2.3, which Google requires for every TC string generated since 1 March 2026. Google has required Consent Mode v2 signals for ad personalisation and measurement with EEA traffic since March 2024.
Install the CMP by adding its script tag to your site's <head> section, before any analytics or advertising tags. The CMP script must load first so it can intercept and block other scripts until consent is given.
Step 4: Configure your cookie banner
The banner is the part visitors see, and regulators scrutinise its design closely. In April 2025 the Dutch data protection authority warned 50 organisations about misleading cookie banners. Common problems are a missing reject button on the first layer, pre-ticked boxes and a reject option made less visible than accept.
A cookie banner that follows regulators' guidance needs these elements on the first screen:
A clear explanation of what cookies are used for, in plain language
An Accept all button
A Reject all button with equal visual prominence (same size, same styling weight)
A link to category-level preferences
A link to your cookie policy
Avoid dark patterns. Do not use colour contrast tricks to make Reject harder to see. Do not require extra clicks to reject compared with accepting. Toggles that default to "on" are a problem too. The ICO's January 2025 review found concerns at 134 of the top 200 UK websites, many related to exactly these design issues.
Step 5: Block scripts before consent
Displaying a banner is only half the job. The other half is making sure non-essential cookies do not fire until the visitor actively consents. This is where many setups fail. In the SHEIN decision, the CNIL found advertising cookies placed on visitors' devices as soon as they arrived on the site, before they interacted with the banner.
There are two main blocking approaches:
CMP-level auto-blocking: The CMP detects known tracking scripts and prevents them from running until consent is recorded. This is the simplest approach and works well for standard services like Google Analytics 4, Meta Pixel and Hotjar.
Tag manager conditional firing: If you use Google Tag Manager, configure each tag to fire only when the relevant consent category is granted. GTM does not block cookies on its own. It only controls when tags run. You still need the CMP to pass consent status to GTM through the data layer or a Consent Mode integration.
After setting up blocking, test it. Open your site in a private browser window, inspect cookies before interacting with the banner, and verify that only strictly necessary cookies are present. Then accept all cookies and confirm that analytics and marketing cookies appear only after consent.
Step 6: Set up region-specific rules
Cookie consent rules differ by jurisdiction. The EU requires opt-in consent before any non-essential cookie fires, and the UK does too, apart from the narrow exceptions above. California follows an opt-out model where you disclose cookies and let users refuse the sale or sharing of personal information. Brazil's LGPD relies on consent for most tracking, with notices in Portuguese. Canada's PIPEDA requires meaningful consent for tracking.
A CMP with geo-detection identifies the visitor's location from their IP address and shows the matching consent model. EU visitors see a full opt-in banner with all non-essential cookies blocked by default. California visitors see an opt-out notice with a "Do Not Sell or Share My Personal Information" link, as the CCPA and CPRA require. Visitors from jurisdictions without specific cookie laws might see a simplified notice or no banner at all.
If your CMP does not support geo-detection, default to the strictest standard (EU opt-in) for all visitors.
Step 7: Write your cookie policy
Your cookie policy documents what cookies your site uses, why, how long they last, and whether any data is shared with third parties. It should list every cookie by name and category, not just offer a vague reference to "analytics tools".
Link to the cookie policy from your banner, from your privacy policy and from your website footer. Keep it updated: scan again whenever you add new tools or plugins, and on a regular schedule, weekly or monthly for most sites.
Step 8: Connect to Google Consent Mode
Google Consent Mode v2 passes consent signals to Google's tags so they adjust their behaviour to what the visitor allowed. It uses four parameters: ad_storage, analytics_storage, ad_user_data and ad_personalization. Google requires these signals for ad personalisation and measurement with visitors in the EEA and UK, under its EU user consent policy.
When a visitor has not consented, Google tags in advanced mode send cookieless pings that support conversion modelling without storing identifiers. This recovers some measurement data that would otherwise be lost. Your CMP should send gtag('consent', 'update', ...) calls automatically when the visitor makes a choice.
Set region-specific defaults with Google's consent default command, so that ad_storage and analytics_storage start as denied for EEA and UK visitors. Then no tracking happens in the gap between page load and the visitor's choice.
Step 9: Test, verify and monitor
Testing is not optional. Check your setup across several browsers and devices. Use the browser's DevTools Network tab to confirm that tracking requests only fire after consent. Verify that rejecting all cookies actually stops all non-essential scripts, rather than only hiding the banner while cookies keep running in the background.
After launch, monitor consent rates and look for anomalies. An accept rate far above what comparable sites see might mean the banner pressures visitors, and regulators look for exactly that pattern.
Scan your site again after any change to your marketing stack. New plugins, updated SDKs and tag manager changes can all introduce cookies that bypass your consent setup.
Quick answers for first-time setups
Do I need cookie consent if my site only uses Google Analytics?
In the EU, yes: the _ga and _ga_<container-id> cookies need opt-in consent before they load. In the UK, analytics used only to improve your site can run without opt-in since 5 February 2026 if visitors are told and can object. Under the CCPA you must at least disclose it and honour opt-outs.
Can I use a cookie wall that blocks content until consent is given?
Usually not in the EU. The EDPB's Guidelines 05/2020 on consent say that consent is not freely given when access to content depends on accepting cookies. Consent or pay models are a separate question with their own conditions.
What happens if I do not set up cookie consent at all?
You risk fines from any data protection authority with jurisdiction over your visitors. GDPR fines can reach EUR 20 million or 4% of global annual turnover, and the CNIL's two cookie fines of September 2025 alone totalled EUR 475 million.
How often should I re-scan my site for new cookies?
On a regular schedule, weekly or monthly, and always after adding plugins, changing analytics tools or updating your tag manager. Scheduled scans catch cookies from third-party scripts that change without you touching your site.
Is Google Consent Mode v2 required for my website?
If you use Google Ads or GA4 advertising and measurement features with visitors in the EEA or UK, Google requires Consent Mode v2 signals. Publishers who show Google ads through AdSense, Ad Manager or AdMob must also use a Google-certified CMP.
Set up your first consent banner
Setting up cookie consent properly the first time saves retrofitting it later. Kukie.io scans your site, suggests a category for each cookie it finds, blocks known trackers until visitors choose and sends Google Consent Mode v2 signals.
