All Blog Posts

What Your GDPR Cookie Banner Needs to Hold Up Under Scrutiny

Close
Read time
8 mins
Published
Sep 22, 2026
Share

  • A banner that looks GDPR-compliant won’t hold up under regulator scrutiny unless it blocks non-essential scripts from firing before the visitor makes their consent choices.
  • Accept and Reject buttons must be identical in size, color, and prominence, and withdrawing consent must be as easy as giving it. 
  • Visitors need separate toggles for each cookie category, with nothing pre-ticked except “strictly necessary.”
  • Log every decision with a timestamp, banner version, and session ID so you can prove privacy compliance to data protection authorities.
  • Cookiebot by Usercentrics helps automate GDPR compliance work on your site, so you can go live without needing deep legal or technical expertise.

The General Data Protection Regulation (GDPR) isn't just for European companies. If your site tracks people who are physically in the EU, you're in scope. Whether you’re located in North America or Asia, the rule follows your visitors' location, not your business address.

Cookie banners are an essential element for GDPR compliance. But a GDPR cookie banner only fulfills its purpose if your site holds back non-essential cookies until the visitor gives explicit and active consent. So any Google Analytics, ad pixels, and A/B testing scripts firing the moment a page loads is against the rules, regardless of whether you have a clear, well-designed cookie banner. 

Regulators have gotten a lot more specific about what a valid banner looks like, and there are five key elements you should pay close attention to when designing a GDPR cookie banner. Here's what they are, and how to check your own setup against them.

The GDPR never explicitly mentions cookie banners. But the regulation, alongside Europe’s ePrivacy Directive, has requirements that make it essential to have one on your website if you have visitors from the EU. 

The ePrivacy Directive states that you must collect visitors’ prior consent for cookie use. The main exceptions are cookies that keep a session alive or let someone use a service they asked for (like a shopping cart). Everything else, like analytics, marketing, and personalization cookies, needs consent first.

Consent has to be informed, explicit, and freely given. Art. 7 GDPR states that the visitor needs to understand what they're agreeing to, make a genuine choice, and be able to change their mind easily. That's where the consent banner comes in; it explains what cookies do and gives visitors a real choice before anything fires.

If your site runs only strictly necessary cookies, GDPR cookie compliance doesn’t require a cookie consent banner. You still need to tell visitors what those cookies do. But most commercial sites use tracking cookies too, which means a banner is necessary.

Regulators of EU privacy laws have gotten specific about what they're looking for, and each element below addresses a cookie banner component that’s essential to privacy compliance with the privacy law. Run your own banner against this checklist as you read.

ePrivacy Directive Art. 5(3) says you can't collect personal data from a visitor before they give their consent. That means every tracking tag needs to be technically blocked until the visitor says yes. 

This is where many banners fail in practice. Your banner looks fine on the page, but in the background, scripts are firing before a visitor consents to data collection. 

There's one exception: strictly necessary cookies, like the ones that remember a visitor is logged into their account. These cover only what keeps a service working that the person asked for. But any non-essential tags must be blocked by default upon page load. 

Privacy Compliance tip: Use a consent management platform (CMP) that automatically blocks scripts and cookies before a visitor gives consent if that’s what the privacy laws in their location require. Cookiebot by Usercentrics, for example, categorizes cookies automatically to align with GDPR and ePrivacy purposes and automatically blocks non-essential ones before consent is given.

2. Equal Prominence of Accept and Reject Options

Data protection authorities are quick to call out and penalize dark patterns in cookie banner design. In 2022, France's data privacy regulator CNIL fined Google EUR 150 million and Facebook Ireland EUR 60 million for failing to allow users to reject cookies as easily as they may accept them. 

Dark patterns include adding a prominent "Accept All" button next to a plain text "Options" link; multiple ways to say yes with only one way to say no; and reject options tucked into a second layer while the option to accept sits on the main banner.

So if your Accept button is big and blue, your Reject button can't be small and gray. And if visitors can accept all cookies in one click, they need to be able to reject all cookies in one click too. 

Compliance tip: Use identical buttons for both choices. That means the same size, same color contrast, and same position on the screen. Test with visitors who've never seen your site before to make sure it’s as easy to reject as it is to accept.

Art. 4(11) GDPR defines consent as freely given, specific, informed, and unambiguous. "Specific" means the person knows what they're agreeing to and can make separate choices for different uses. 

If your site uses cookies for analytics, marketing, and personalization, visitors need separate toggles for each. For example, they should be able to accept analytics to help you improve the site while refusing marketing cookies that feed ad networks. 

The standard categories are:

  • Strictly necessary. Session management, security, basic functionality (no consent required). 
  • Preferences. Language, dark mode, saved settings. 
  • Statistics. Analytics and performance measurement. 
  • Marketing. Retargeting, ad networks, behavioral tracking. 

Pre-ticked boxes are not valid consent. When your banner loads, only strictly necessary should be on. All others should be off by default. Let the visitor choose what they want.

Compliance tip: Build your banner with individual toggles, not "accept all" and "reject all" only. Explain to visitors exactly what each category does in plain language so they can make an informed decision about whether they want their personal data to be processed for each purpose.

Art. 7 GDPR outlines that visitors must be able to withdraw consent as easily as they gave it. So if accepting cookies takes one click, visitors should have an equally easy way to reject or withdraw consent from any page on your site.

Many sites fail this by hiding the withdrawal option in the privacy policies, but the GDPR requires a persistent link or widget. Clicking it should reopen your consent banner so visitors can update their consent choice at any time.

Also note that when you add a new advertising vendor, switch analytics platforms, or update your purposes for data processing, consent is no longer valid for those new purposes and you have to re-request explicit visitor consent. 

Compliance tip: Add a "Manage Cookies" or "Cookie Settings" link in your footer or header that's visible on every page. Make it as easy to change your mind as to choose in the first place.

Art. 5(2) GDPR’s accountability principle states that companies must be able to demonstrate compliance with the privacy law. If a data protection authority investigates you, they’ll likely request to see your consent logs. If you can't produce them, you can't prove privacy compliance.

Every time someone makes a choice on your banner, capture and store:

  • A timestamp. When the choice was made.
  • Which categories were accepted or rejected. Specifically which cookies for which purposes.
  • The banner version presented. The banner text and layout the person saw. 
  • A session identifier. A unique reference tying the consent record to that visitor.

When someone withdraws consent or changes their mind, your consent log needs to be updated to demonstrate their choices over time.

These records demonstrate that you asked for permission, what you asked for, when, and that you respected the answer. Without them, you can’t reasonably defend your GDPR cookie consent practices in front of a regulatory body. 

Compliance tip: Most CMPs log this automatically. Cookiebot by Usercentrics, for example, logs an anonymized identifier, the consent state (which categories were accepted), the URL and IP-based country where consent was given, and a timestamp for each visitor.

The First Step Towards GDPR Compliance? Evaluate Your Existing Banner

To check your current status, stop and run a quick test on your live site right now.

Open your website in an incognito or private browser window (this clears all existing cookies and tracking). Press F12 to open your browser's developer tools. Click the Network tab, refresh the page, and watch what loads.

Look for any requests to:

  • google-analytics.com
  • facebook.net
  • doubleclick.net
  • Any other known tracking domain

If you see these requests fire before you click anything on the banner, your site is noncompliant and may be at risk of GDPR fines, and you’ve found a main problem to fix. After that, analyze your banner layout and language, assess how easy it is to withdraw consent, and review your consent logging processes.

This test takes just a few minutes and tells you whether you have a serious privacy compliance issue that needs attention on your backend or just a minor design issue that some cookie banner interface adjustments will fix.

The five elements above explain what regulators are looking for. Getting all of them right takes work if you're building from scratch. Cookiebot by Usercentrics handles the technical and design heavy lifting so you don't have to worry about it.

The CMP automatically prevents all non-essential scripts from running on page load, and the default banner templates come with balanced Accept and Reject buttons built in. You can customize colors and fonts to match your brand, but the underlying structure respects the equal prominence rule from the start.

When it comes to granular choices, the multilevel banner gives visitors separate toggles for each category: strictly necessary, preferences, statistics, and marketing. And the Privacy Trigger sits in your footer or header and lets visitors change their mind anytime with one click to uphold the GDPR’s consent withdrawal requirements.

Finally, every decision gets logged automatically with a timestamp, so when an auditor asks for proof of consent, you simply export the records from your dashboard. 

You don’t need deep legal or technical expertise to implement the banner, meaning you can help set your site up for GDPR compliance in minutes.

TRY FOR FREE

Frequently asked questions

A cookie banner is the notice that appears when someone visits your website, asking them to accept or reject cookies and other tracking technologies before any non-essential ones are activated. You need one because the ePrivacy Directive and the GDPR both require prior visitor consent before non-essential cookies, like those used for analytics or advertising, can process personal data. Without a compliant banner, your site risks running non-essential cookies before a visitor has made a choice, which puts you at odds with EU privacy law.

Not every website needs a cookie banner. If your site runs only strictly necessary cookies, such as those that keep a shopping cart working or maintain a login session, the ePrivacy Directive doesn't require consent for those, and a banner isn't legally necessary. But you still need to tell visitors what those cookies do, typically through a cookie policy. Most commercial sites use additional cookies for analytics, marketing, or personalization, and any of those require a banner with granular consent options.

The GDPR doesn't regulate cookies directly. That comes from the ePrivacy Directive (Art. 5(3)), which requires prior visitor consent before any non-essential cookie can run. The GDPR applies once those cookies process personal data, since it sets the standard for what counts as valid consent: freely given, specific, informed, and unambiguous under Art. 4(11) GDPR.

In practice, that means blocking non-essential scripts until a visitor consents, offering separate toggles for each cookie category, giving Accept and Reject equal visual prominence, and letting visitors withdraw consent as easily as they gave it under Art. 7 GDPR.

It depends on what your site does. If you use only strictly necessary cookies, skipping a banner isn't illegal, since those cookies don't need consent. But if your site runs analytics, advertising, or personalization cookies without a banner, or with one that doesn't block those cookies until visitors consent, you're in breach of the ePrivacy Directive and, by extension, the GDPR's consent requirements. Enforcement varies by country and by how a data protection authority prioritizes cases, but the CNIL's EUR 150 million fine against Google in 2022 shows regulators are willing to act.

It depends on what your site does. If you use only strictly necessary cookies, skipping a banner isn't illegal, since those cookies don't need consent. But if your site runs analytics, advertising, or personalization cookies without a banner, or with one that doesn't block those cookies until visitors consent, you're in breach of the ePrivacy Directive and, by extension, the GDPR's consent requirements. Enforcement varies by country and by how a data protection authority prioritizes cases, but the CNIL's EUR 150 million fine against Google in 2022 shows regulators are willing to act.

A cookie banner is the interface, usually a bar or pop-up, that asks visitors for consent before your site activates non-essential cookies. A banner that holds up under regulator scrutiny needs five things: scripts blocked until consent is given, Accept and Reject buttons with equal visual weight, separate toggles for each cookie category such as statistics and marketing, an easy way for visitors to withdraw consent at any time, and a log of every consent decision for audit purposes.

Cookiebot by Usercentrics builds banners with all five elements in place, so you don't have to design each piece from scratch.