GDPR Cookie Consent: What Your Website Actually Needs to Do

The General Data Protection Regulation (GDPR) doesn't use the word 'cookie banner'. What it requires is that if you use cookies or similar tracking technologies to process personal data, you need a legal basis for that processing. For most marketing and analytics cookies, the only valid legal basis is explicit, informed, freely-given, and unambiguous consent.

This requirement comes from Article 6 (lawful basis for processing) and Article 7 (conditions for consent), read together with the ePrivacy Directive (the Cookie Law). The critical word is 'freely-given' — consent is not valid if you require it before the user can access your website, or if refusing has negative consequences.

GDPR applies if you have users in the EU/EEA, regardless of where your company is incorporated. A US company with EU visitors must comply. A UK company post-Brexit follows UK GDPR, which is substantially identical for practical purposes.

A compliant cookie consent implementation has four characteristics: it's specific (the user knows exactly what they're consenting to), it's informed (the user can understand what the cookies do), it's freely given (they can decline without penalty), and it's unambiguous (a clear affirmative action — clicking 'Accept' — rather than pre-ticked boxes or assumed consent from continued browsing).

Specific means you can't bundle all cookies into one consent. Analytics cookies, advertising/targeting cookies, and functional cookies must be presented separately so users can accept some and decline others. A single 'Accept All' button without a 'Reject All' or 'Manage Preferences' option does not meet the specificity requirement under most DPA guidance.

The 'Reject All' button must be as prominent as the 'Accept All' button. Many consent banners make accepting very easy (large button, bright color) and rejecting difficult (small link, buried in settings). Multiple EU Data Protection Authorities have fined companies specifically for this dark pattern.

Strictly necessary cookies — those required for the website to function — don't require consent under the ePrivacy Directive. These include session cookies (keeping a user logged in), shopping cart cookies, cookies that remember user interface preferences, and security cookies for CSRF protection.

Analytics cookies generally do require consent unless implemented in a privacy-preserving way that doesn't process personal data. Some configurations of Plausible and Fathom don't require consent for EU visitors because they don't identify individual users.

GDPR Article 7(1) requires that you be able to demonstrate that consent was obtained. This means storing a record of when each user consented, to which cookie categories, and what version of your consent notice was shown. If your consent management platform doesn't log this, you have a compliance gap that could be expensive in the event of a complaint.

WebEnture's Cookie & Privacy Checker scans your website for cookie categories, checks your consent banner implementation against GDPR requirements, and identifies cookies being set before consent is obtained — one of the most common and easily enforceable violations.