# [EDPB Guidelines and Cookie Walls](https://www.cookiebot.com/en/edpb-guidelines/) **The General Data Protection Regulation (GDPR) and ePrivacy Directive (ePR) affect how you as a website owner must obtain and store cookie consents from your visitors from the EU.** · [Try Cookiebot CMP free for 14 days](https://admin.cookiebot.com/signup) · [Test if your website is compliant with EDPB guidelines and GDPR for free.](https://www.cookiebot.com/) --- ## Quick summary ### EDPB guidelines in brief On May 4, 2020, the [European Data Protection Board (EDPB)](https://edpb.europa.eu/edpb_en/) adopted guidelines for GDPR compliance that clarify what constitutes valid consent for personal data processing in the EU, and confirm that the use of “cookie walls” as a way of obtaining consent is non-compliant. For a consent to be valid according to the GDPR, it has to be: - Freely given - Specific - Informed - Unambiguous User actions such as scrolling or swiping through a website or similar user activity (also known as implied consent) do not meet the requirement for valid consent under the GDPR. The EDPB guidelines also clarify that the use of pre-ticked opt-in boxes is not GDPR compliant, as this does not live up to the “clear and affirmative action” requirement either. ### What do the EDPB guidelines mean for my website? The EDPB guidelines cement what has been the intention of the GDPR all along: to empower the users with real, enforceable rights over their own data and privacy. In their guidelines on consent, the EDPB makes it very clear that any kind of attempt to avoid giving users real power over their own personal data (such as forcing consent or relying on poorly informed implied consents) will not be tolerated. For your website, this means – - No pre-ticked checkboxes on your cookie banners - Scrolling and continued browsing is not valid consent - Cookie walls are non-compliant for obtaining consent ### EDPB guidelines and GDPR compliance test [Test whether your website is in compliance with the EDPB guidelines and GDPR requirements by using the free Cookiebot CMP compliance test](https://www.cookiebot.com/). [Cookiebot CMP](https://www.cookiebot.com/) is the world’s leading consent management platform that makes your website compliant with the all major data protection laws. --- ## EDPB guidelines in detail The EDPB guidelines 05/2020 on valid consent is a detailed 33-page document that was adopted on May 4, 2020. ### Who is the EDPB? The [European Data Protection Board (EDPB)](https://edpb.europa.eu/edpb_en/) is the leading supervisory authority responsible for the consistent application of the [General Data Protection Regulation (GDPR)](https://www.cookiebot.com/en/gdpr/) in the EU. When obtaining consent from users to the activation of cookies that process personal data, your website must make sure that it is **freely given** – a cornerstone for valid consent in the GDPR. ### Freely given consent If the user has no real choice, feels compelled to consent or will suffer negative consequences if they do not consent (such as lowered services or access denied), then the consent will not be valid. ### Conditionality of consent To make consent conditional to e.g. acceptance of terms or conditions, or the performance of a service to which the personal data processed by cookies and trackers is not necessary, is considered an invalid form of consent. The EDPB guidelines make it very clear that these two legal bases cannot be merged or blurred, i.e. if your website relies on user consent for the use of cookies and trackers that process personal data, this consent cannot be conditioned on the performance of a service that does not need the personal data to be performed. ### Granular consent The EDPB guidelines clarify that if your website processes personal data for more than one purpose, users must be able to freely choose which purpose they accept – rather than having to consent to a bundle of processing purposes. ### Specific consent Valid consent, the EDPB guidelines clarify, must be specific, i.e. clear determination of a specific, explicit and legitimate purpose for the intended processing activity. ### Informed consent EDPB guidelines clarify that valid consent must be informed, i.e. users must know and understand what they are consenting to. ### Withdrawal of consent If your website relies on consent for personal data processing done by the use of cookies and trackers, you must be prepared to respect users’ choices to withdraw that consent. Users must be able to withdraw their consent just as easily as they gave it. ### Additional conditions for obtaining valid consent The burden of proof to demonstrate user consent for personal data processing is on the website owner and/or operator. EDPB recommends as best practice that consents should be refreshed at appropriate intervals. --- ## Data subject's rights They are – - The right to erasure of collected and stored personal data, when consent has been withdrawn - The right to restriction - The right to rectification - The right to access - The right to data portability [Cookiebot CMP](https://www.cookiebot.com/) takes care of all the GDPR compliance requirements that your website must meet, when using cookies that process personal data of users inside the EU. --- ## Frequently asked questions What is the European Data Protection Board? The European Data Protection Board (EDPB) is the highest supervisory body in charge of application and enforcement of the General Data Protection Regulation (GDPR) in the EU. What do the EDPB guidelines say? The EDPB guidelines on valid consent from May 2020 clarify what constitutes valid consent, when relying on user consent for the processing of personal data, e.g. through the use of cookies and trackers on websites. How do I make my website GDPR compliant? First, you must know of all cookies and trackers in operation on your website, so that you can inform users of their type, purpose, duration and provider. --- ## Resources [European Data Protection Board (EDPB)](https://edpb.europa.eu/edpb_en/) [EDPB guidelines 05/2020 on valid consent](https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf) [What is the GDPR?](https://www.cookiebot.com/en/gdpr/) [GDPR and cookie consent](https://www.cookiebot.com/en/gdpr-cookies/) [Beyond the Front Page, a 2020 research paper of website cookies and tracking](https://arxiv.org/pdf/2001.10248.pdf) --- ## Product [Cookiebot™ Consent Solution](https://www.cookiebot.com/en/cookie-consent-solution/) · [Usercentrics for Wix](https://www.cookiebot.com/en/cookiebot-for-wix-by-usercentrics-app/) · [WordPress Plugin](https://www.cookiebot.com/en/new-wp-cookie-plugin/) · [Pricing](https://www.cookiebot.com/en/pricing/) ## Regulations [DMA (EU)](https://www.cookiebot.com/en/digital-markets-act-dma/) · [GDPR (EU)](https://www.cookiebot.com/en/gdpr/) · [CCPA (California)](https://www.cookiebot.com/en/what-is-ccpa/) · [VCDPA (Virginia)](https://www.cookiebot.com/en/virginia-vcdpa/) · [LGPD (Brazil)](https://www.cookiebot.com/en/lgpd/) · [TCF v2.3 (IAB)](https://www.cookiebot.com/en/tcf/) · [Google Consent Mode](https://www.cookiebot.com/en/cookiebot-cmp-google-consent-mode/) · [Microsoft UET Consent Mode](https://www.cookiebot.com/en/microsoft-consent-mode-cmp/) ## Partners [Become an affiliate](https://www.cookiebot.com/en/affiliates/) · [Become a partner](https://www.cookiebot.com/en/resellers/) · [Find a partner](https://www.cookiebot.com/en/cookiebot-reseller/) ## Resources [Blog](https://www.cookiebot.com/en/blog/) · [Digital Markets Act Hub](https://www.cookiebot.com/en/digital-markets-act-dma-resources/) · [Google Consent Mode Hub](https://www.cookiebot.com/en/google-consent-mode-resources/) · [Google Consent Mode V2 Certification](https://courses.usercentrics.com/course/google-consent-mode-v2) · [Google Consent Audit Fixes](https://www.cookiebot.com/en/google-consent-audit-fixes/) · [Developer documentation](https://www.cookiebot.com/en/developer/) · [Cookiebot vs CookieYes](https://www.cookiebot.com/en/cookiebot-best-cookieyes-alternative/) · [Cookiebot vs OneTrust](https://www.cookiebot.com/en/onetrust-alternative/) · [Cookie Banner Cost Calculator](https://www.cookiebot.com/en/cookie-banner-pricing-calculator/) ## Company [About us](https://www.cookiebot.com/en/about/) · [Careers](https://usercentrics.com/career/) · [Support](https://support.cookiebot.com/hc/en-us/) --- [Privacy Policy](https://www.cookiebot.com/en/privacy-policy/) · [Terms of Service](https://www.cookiebot.com/en/terms-of-service/) · [Cookie Declaration](https://www.cookiebot.com/en/cookie-declaration/) · [Data Processing Agreement](https://www.cookiebot.com/en/data-processing-agreement/) ©2026 Cookiebot™ by [Usercentrics](https://usercentrics.com/)