A cookie banner is the notice that appears when a visitor first arrives on a website. Its job is to explain what cookies and tracking technologies the site uses, and to collect the visitor's consent before any non-essential cookies are set on their device. Behind the scenes, a working banner also blocks scripts, logs consent records and sorts cookies by purpose.
The reason cookie banners exist at all comes down to one line of law. Article 5(3) of the ePrivacy Directive states that storing information on, or accessing information from, a user's device requires prior consent, unless it is strictly necessary for a service the user explicitly requested. The GDPR then defines what valid consent looks like: freely given, specific, informed and unambiguous, delivered through a clear affirmative action.
Pre-ticked boxes do not count. Neither does scrolling, continuing to browse or closing the banner without making a choice. In its 2019 Planet49 judgment (C-673/17), the Court of Justice of the EU held that a pre-ticked checkbox does not give valid consent to cookies, whether or not the data stored is personal data.
What happens behind the banner
A visible pop-up is only one piece of the system. A properly implemented cookie banner relies on several technical processes working together.
Cookie scanning identifies every cookie, tracker, pixel and script active on the site. Categorisation sorts them into groups, typically strictly necessary, functional, analytics and marketing. Pre-consent blocking stops non-essential scripts from firing until the visitor makes an active choice. Consent logging records what each visitor agreed to, when and how, so you can show it later.
A banner that looks right but does not block cookies before consent fails at the first step. France's data protection authority, the CNIL, showed this in September 2025 when it fined SHEIN's Irish subsidiary 150 million euros. Investigators found that advertising cookies were placed the moment a visitor landed on shein.com, before the visitor had any chance to interact with the banner, and that new cookies were still placed after a visitor refused.
Cookie categories a banner must present
Regulators expect banners to give visitors granular control. That means presenting cookie categories individually, so a visitor can accept analytics but reject marketing, or reject everything except strictly necessary cookies.
| Category | Purpose | Consent required in the EU? | Examples |
|---|---|---|---|
| Strictly necessary | Core site functions: sessions, security, load balancing | No | PHPSESSID, csrf_token |
| Functional | Preferences: language, region, layout choices | Yes (in most EU countries) | pll_language, currency_pref |
| Analytics | Traffic measurement, page performance, user behaviour | Yes, with narrow national exceptions | _ga, _ga_[id], _hj cookies |
| Marketing and advertising | Ad targeting, retargeting, cross-site tracking | Yes | _fbp, IDE, NID |
Non-essential cookies, meaning anything beyond the strictly necessary category, stay blocked until consent is recorded. Some jurisdictions treat functional and first-party analytics cookies differently, as the UK section below shows, but asking for opt-in consent is the approach that works in every EU country.
Cookie banner requirements in the EU
Regulators across Europe have been specific about what they expect. In January 2023, the European Data Protection Board adopted the report of its Cookie Banner Taskforce, which records the common positions the national authorities agreed while handling complaints from the privacy group noyb. On the most common problem, a first layer with no way to refuse, the report is direct:
"a vast majority of authorities considered that the absence of refuse/reject/not consent options on any layer with a consent button is an infringement of the consent requirement"
In practice, a banner shown to EU visitors needs these parts:
- A first layer that names the purposes and the companies that will receive data, with a link to the cookie policy.
- An Accept all and a Reject all button with equal visual prominence: same size, same weight, same level.
- A Manage preferences option that leads to a second layer with a switch per category, every optional one off until the visitor turns it on.
- Information on each category's purpose, how long cookies last and who sets them.
- A way to change or withdraw the choice later that is as easy as giving it, such as a small Cookie settings button.
- A record of each choice, so you can show what the visitor agreed to and when.
The parts of a cookie banner
National authorities have gone further on some points. The French CNIL expects Accept and Reject to be treated equally on screen. In May 2026, Austria's Federal Administrative Court upheld a decision ordering the public broadcaster's site ORF.at to give its Accept and Reject buttons equal prominence, finding that a coloured Accept button next to a less conspicuous Reject misleads visitors. And in the 325 million euro decision against Google of 1 September 2025, the CNIL found that consent to advertising cookies at Google account creation was not valid, because "it was more difficult to refuse cookies linked to personalised advertising than to accept them".
Legal requirements by region
Cookie banner rules differ depending on where your visitors are located, not only where your business is based. The GDPR's territorial scope means a website in Toronto that offers goods or services to people in the EU, or monitors their behaviour, still needs a banner for those visitors.
EU and EEA
The ePrivacy Directive and the GDPR work together. Article 5(3) of the ePrivacy Directive requires consent before setting non-essential cookies, and Article 7 of the GDPR sets the conditions for valid consent. National authorities enforce both, sometimes with different emphases. The CNIL exempts some audience measurement from consent under strict conditions, while German authorities grant no general exemption for analytics under section 25 of the TDDDG beyond what is strictly necessary.
The European Commission's Digital Omnibus proposal of November 2025 would move cookie rules from the ePrivacy Directive into the GDPR and add exemptions for some low-risk purposes such as aggregated audience measurement. As of October 2026, it is still a proposal: the Council's text of 18 June 2026 dropped the article on browser-based consent signals, and the European Parliament has not yet voted. Until a reform is adopted, the current opt-in rules stay in force.
United Kingdom
The UK GDPR and the Privacy and Electronic Communications Regulations (PECR) follow the same opt-in approach, with new exceptions. Since 5 February 2026, Schedule A1 of PECR, added by the Data (Use and Access) Act 2025, lets UK sites use first-party analytics for statistics and storage that adapts the site's appearance or functions without consent, provided visitors are told and can object. It also lists security, fraud prevention, fault detection and authentication as strictly necessary. Advertising cookies still need consent. The UK cookie exemptions have their own guide.
The ICO is also checking banners at scale. In January 2025 it raised concerns with 134 of the top 200 UK websites and widened the review to the top 1,000. By 4 December 2025, 979 of the top 1,000 sites met its checks, 564 of them only after the ICO contacted them, and it had issued 17 preliminary enforcement notices.
United States
The CCPA, as amended by the CPRA, uses an opt-out model rather than opt-in. Websites must disclose cookie use and provide a "Do Not Sell or Share My Personal Information" link. Consent banners are not legally required in most US states, but websites serving both EU and US traffic need geo-targeted banners that show the right consent model for each visitor's location.
Brazil, South Africa and Canada
Brazil's LGPD requires a lawful basis for processing personal data, with consent the most common for cookies. POPIA in South Africa follows a similar consent-based model. PIPEDA in Canada requires meaningful consent for cookie-based data collection, though its rules say less about banner design.
Dark patterns that trigger fines
Manipulative banner designs, known as dark patterns, are among the highest-risk issues. The violations regulators target include asymmetric buttons (a bold Accept next to a faded Reject link), extra steps to reject, pre-checked switches for non-essential cookies, consent walls that block access until cookies are accepted, and confusing language that hides the visitor's actual choice.
Decisions do not always stand. In September 2024 the Belgian data protection authority ordered the publisher Mediahuis to change its cookie banners, and on 19 March 2025 the Market Court annulled that decision. The EDPB report and the Austrian ORF.at ruling point the same way, though: equal choices on the first layer.
Google Consent Mode and cookie banners
Google Consent Mode v2 has been required since March 2024 for websites using Google advertising and measurement products with visitors in the EEA and the UK. A banner has to send accurate consent signals to Google's tags. If a visitor rejects marketing cookies, the banner signals ad_storage, ad_user_data and ad_personalization as denied, and analytics refusals set analytics_storage to denied.
Without those signals, Google limits features such as remarketing audiences and personalised ads for EEA and UK traffic. Publishers that show Google ads through AdSense, Ad Manager or AdMob to visitors in the EEA, the UK or Switzerland also need a Google-certified consent platform that integrates with the IAB Transparency and Consent Framework (TCF).
If a share of your visitors refuses, you can still measure marketing results with consent in place, through modelled conversions and aggregated reporting.
How to set up a cookie banner that works
Start with a cookie scan. You cannot write accurate disclosures or configure blocking if you do not know what cookies your site actually sets. Many websites find cookies from third-party scripts, embedded videos or social media widgets they did not know about.
Choose a consent management platform (CMP) that blocks scripts before consent, logs consent, detects the visitor's region and sends Google Consent Mode signals. Scan again on a schedule, because new cookies can appear any time a developer adds a plugin or analytics tool.
Configure region-specific rules. EU visitors see an opt-in banner. US visitors covered by the CCPA see an opt-out notice. Visitors from jurisdictions with no specific cookie law may see a simplified notice or none at all.
Test the banner after setup. Check that non-essential cookies are blocked before consent and that rejecting cookies actually stops tracking. Review cookie durations too, so no cookie lasts longer than its purpose needs.
Cookie banner questions, answered
Does every website need a cookie banner?
If your website sets any non-essential cookies and has visitors from the EU, UK, Brazil or other jurisdictions with consent requirements, yes. A website that uses only strictly necessary cookies, with no analytics, marketing or functional cookies, does not need a consent banner under most laws, though this is rare in practice.
Can I use a cookie wall that blocks access until visitors accept?
The EDPB, the CNIL and the ICO have all taken the position that consent walls, where a visitor cannot use the website without accepting cookies, generally do not give freely given consent. Some narrow exceptions exist for paid or alternative access models, but for most websites a cookie wall does not produce valid consent.
How often should I rescan my website for cookies?
At least monthly. New cookies can appear whenever a developer adds a plugin, updates a script or embeds third-party content. Scheduled scans catch these changes, so your banner disclosures stay accurate.
What happens if my Reject button does not actually block cookies?
Regulators treat this as a serious failure. The CNIL fined SHEIN 150 million euros in 2025 partly because new cookies were still placed, and existing ones still read, after visitors refused. A reject button that does nothing still leaves the cookies set without consent.
Do US websites need a cookie banner?
No US federal law requires a cookie consent banner. The CCPA and CPRA require an opt-out link for data sales and sharing, but not a pre-consent pop-up. If your US-based website serves EU or UK visitors, you need a geo-targeted banner for those users.
Is legitimate interest a valid legal basis for setting cookies?
Under the current ePrivacy Directive, no: non-essential cookies need consent whatever GDPR legal basis covers the later processing. The Digital Omnibus proposal of November 2025 would exempt some low-risk purposes, such as aggregated audience measurement, from consent, but as of October 2026 it has not been adopted.
How long can a consent preference last before I need to ask again?
It depends on the regulator. The CNIL treats keeping a choice for 6 months as good practice, Ireland's DPC sees 6 months as the outer limit for storing consent, and Spain's AEPD allows up to 24 months. If a visitor accepted, you do not need to show the banner again until the stored consent expires.
Check your banner against the EU rules
Scan your site, block scripts before consent, present equal Accept all and Reject all options, and log every choice. Kukie.io blocks known trackers until visitors agree, shows a different banner per region, sends Google Consent Mode v2 signals and keeps a Consent Log of every choice.
To see how your current banner measures up, run the free GDPR compliance scanner on your homepage. It checks which cookies and trackers load before a choice and whether the banner offers a reject button.
