GDPR Cookie Consent: The Complete Guide for Websites (2026)
Almost every European website has a cookie banner. A lot of them wouldn't survive a regulator opening the page.
This guide covers what the law actually requires, the specific banner behaviours companies have been fined over, and the reform working its way through Brussels that may eventually change some of it.
Two laws, not one
Cookie rules come from two instruments that work together, which is where most of the confusion starts.
The ePrivacy Directive governs storing or accessing information on a user's device. Article 5(3) is the operative bit: you need consent before you store or read anything on someone's terminal equipment, unless it falls into a narrow exemption. Note what that covers. Cookies, yes, but also localStorage, pixels, SDKs, device fingerprinting, anything that touches the device. It applies whether or not the data is personal.
The GDPR governs what happens to personal data afterwards, and supplies the definition of consent that ePrivacy leans on.
ePrivacy tells you when you need consent. The GDPR tells you what consent has to look like.
What doesn't need consent
Article 5(3) has two exemptions. The first is transmission: storage or access carried out solely to transmit a communication over a network. The second is strict necessity: storage or access strictly necessary to provide a service the user has explicitly requested.
"Strictly necessary" is a lot narrower than most implementations assume. Session cookies that keep a user logged in, a shopping basket, load balancing, CSRF tokens: all comfortably exempt. Analytics isn't, even first-party analytics. Nothing advertising-related is. Sites classify analytics as essential all the time, and regulators keep catching it. It's one of the fastest ways to fail an audit.
Everything else needs consent first: analytics, A/B testing, heatmaps, session recording, advertising, social embeds, most third-party widgets.
What makes consent valid
The GDPR sets four conditions. Consent must be freely given, specific, informed, and an unambiguous indication of the user's wishes given by a clear affirmative action.
Translated into banner terms:
Freely given means a genuine choice. If refusing costs the user something disproportionate, or is materially harder than accepting, the consent isn't free.
Specific means per purpose. One toggle covering analytics and advertising together fails. Users need to accept one and refuse the other.
Informed means they knew what they were agreeing to before they agreed: who's processing, for what purposes, which third parties are involved.
Unambiguous, by affirmative action rules out silence, continued scrolling and pre-ticked boxes. The Court of Justice settled the pre-ticked box question in Planet49 back in 2019. It's still one of the most widely ignored rulings in the field.
The banner rules regulators actually enforce
Beyond the statutory text, supervisory authorities have converged on a set of specific behaviours. The EDPB's cookie banner taskforce reported on these and national regulators have enforced them.
A refusal option has to be on the first layer. If the opening banner offers "Accept all" and "Manage preferences" with no way to decline in one action, that's a violation, and it's the single most common finding.
Refusing has to be as easy as accepting, not merely possible. We cover this one separately in the equal-prominence rule.
No deceptive design. A bright, high-contrast accept button next to a greyed-out reject link is a dark pattern even when both are technically present.
Nothing fires before consent. Non-essential cookies must not be set while the banner is still on screen. Sites fail this constantly, usually without knowing. See cookies set before consent.
Legitimate interests won't carry advertising. Some banners offer "reject" for consent-based purposes and then keep processing advertising under legitimate interests. Regulators have shut that down for tracking-based advertising.
Withdrawal has to be as easy as giving. Article 7(3) is explicit about it. In practice that means a persistent, reachable control. Not an email address, and not a buried preferences page.
What enforcement has looked like
In January 2022 the French regulator fined Google 150 million euro and Facebook 60 million euro because refusing cookies took more clicks than accepting them. Not because refusal was impossible. Because it was harder.
It hasn't slowed since. In 2025 the CNIL fined Google 325 million euro over cookie practices alongside advertising placed between emails.
None of these are obscure technical breaches. They're banner design decisions, visible to anyone who loads the page.
Consent duration and re-asking
Neither instrument fixes a lifetime. Regulators have offered guidance though, and the French authority's position, that consent stays reasonable for around six months, is a widely used benchmark.
Two adjacent rules matter more than the exact number. Re-prompting a user who has just refused, on every page view, undermines the freely-given requirement. And storing a consent record for far longer than the consent itself stays coherent is hard to justify.
Keeping records
You have to be able to demonstrate that consent was obtained. In practice: what the user consented to, when, which banner version and text they saw, and how they signalled it. If you can't reconstruct that for a given user, you can't evidence compliance.
What the Digital Omnibus would change, and why it doesn't apply yet
The Commission published the Digital Omnibus proposal in November 2025. It's a proposal. Not adopted, not in force, and nothing in this guide changes because of it today. Still worth understanding, because it moves in a different direction to the current regime.
The proposed Article 88a would shift consent for terminal-equipment access out of ePrivacy and into the GDPR, with a closed list of purposes permitted without consent: transmission, providing a service the user explicitly requested, aggregated usage statistics used solely by the operator of that service for its own purposes, and maintaining or restoring service security. Everything else would need an ordinary GDPR legal basis.
Article 88b is the more interesting half. It would require controllers to accept consent decisions expressed through automated, machine-readable means and to respect them, making browser-level signals binding instead of advisory. There's a carve-out for media service providers, which has drawn criticism.
Two cautions. This is draft legislation and the text may change substantially before adoption. And even as drafted it wouldn't eliminate banners, because information obligations and withdrawal mechanisms still have to surface somewhere.
Plan against current law. Keep an eye on the proposal.
A checklist
- Inventory what your site sets: cookies, localStorage, pixels, SDKs, third-party embeds. You can't classify what you haven't found.
- Classify honestly against the strictly-necessary exemption. Analytics isn't essential.
- Confirm nothing non-essential fires before consent, tag managers and embeds included.
- Put a refusal option on the first layer, equal in prominence to accept.
- Separate purposes so analytics and advertising can be accepted independently.
- Provide a persistent withdrawal control that's as easy to use as the original banner.
- Check the banner works by keyboard and screen reader. A consent mechanism nobody can operate isn't valid consent.
- Store consent records detailed enough to reconstruct what was agreed.
In practice
Most cookie compliance failures aren't subtle. A missing reject button. An analytics script that fires on page load. A preferences dialog nobody can escape. The law here has been stable for years and the enforcement pattern is consistent.
The reform on the horizon may eventually simplify this. It hasn't yet, and designing today's banner around tomorrow's draft legislation is a bad trade.
This article is general information, not legal advice. Requirements vary by member state, and several national regulators impose stricter specifics than the EU baseline.
Sources: EDPB: Report of the cookie banner taskforce · CNIL: Google and Facebook cookie sanctions · EDPB: CNIL fines Google 325 million euro (2025) · Osborne Clarke: Digital Omnibus and EU cookie rules