GDPR Consent Management

Manually managing cookie banners and tracking consent can be sufficient for some time. But with more traffic coming from the EU/EEA, businesses need to invest in GDPR compliance to remain lawful and maintain visitor trust.

Since the EU regulators enforce privacy seriously, getting a GDPR consent management solution is often efficient for privacy compliance and risk reduction. It helps support lawful consent collection, data processing relies on users’ approval, and consent logs are documented and ready for audit anytime. This article covers the specifics of GDPR consent management and how Cookiebot by Usercentrics automates it.

What Is Consent Management?

Consent management is the process of honoring consent, or the lawful, explicit visitor permission, for obtaining and using their personal information. Websites often use cookie banners, visual pop-ups, or similar notices to explain cookies and tracking practices and let visitors accept, reject, or customize consent choices. Withdrawing consent usually happens through the same banner, a privacy settings page, or a preference center.

Consent management and preference management can overlap, but they are not the same thing. Preference management lets users choose how they want to hear from a company (like choosing favorite topics, preferred channels, or email frequency). Consent management is about collecting and managing the legal permission to process personal data – it enables visitors to opt in and out of the specific cookie categories for preferences, statistics, and marketing. 

A proper consent management setup encompasses the following:

• Asking for consent: Introducing a cookie banner or a similar notice that clearly discloses tracking technologies, provides unambiguous consent options, and explains how the data will be used.
• Managing preferences: All owing consumers to modify and update their data-sharing choices at any time, including easy-to-find ways to withdraw consent.
• Respecting rejection: In GDPR consent management, it’s required to prevent non-essential tracking until the visitors gives valid consent.
• Securely storing: The consent management system documents consent evidence for accountability.
• Renewing regularly: GDPR does not set a fixed renewal deadline for consent. In practice, businesses should review renewal timing, especially where other privacy regimes apply or where local supervisory guidance recommends shorter intervals.

Consent management is key for legal compliance and gives visitors the ability to exercise their right to privacy. It introduces a structured process for obtaining consent and keeps daily digital operations consistent with global privacy regulations.

GDPR and Consent

Under the General Data Protection Regulation (GDPR), an EU law that came into force on 25 May 2018, all organizations must have a lawful basis before collecting or otherwise processing personal data. 

Art. 6 GDPR defines consent as one possible lawful basis for processing any information relating to an identified or identifiable natural person. Alternatively, organizations can rely on (1) a contract with a user, (2) legal obligation, (3) vital interests, (4) public task, or (5) legitimate interests. While a contract, vital interest, legal obligation, and public task options have pre-approved purposes in GDPR, consent and legitimate interests include a broader set of scenarios. Thus, they are more commonly used as lawful bases:

• Legitimate interests: The option for organizations who are ready to take responsibility for users’ reasonable expectations without first asking their approval to process their personal data.
• Consent: For the organizations that want or need a clear, freely given permission from the individual.
  

Under Art. 3 GDPR, the territorial scope of the regulation covers all the controllers and processors handling personal data of EU/EEA citizens, notwithstanding their location.

ePrivacy Directive Requirements for Consent

While GDPR sets general standards for personal data processing, ePrivacy Directive (often referred to as the "Cookie Law") provides more detailed information on how to handle consent in practice. It is a legislative act that requires EU Member States to incorporate its provisions on consent, transparency, and individual rights into their national legislation.

The consent rules under the Cookie Law include:

• Confidentiality of communications: Under Art. 5(1), online services are prohibited from listening, tapping, storing, or other kinds of interception or surveillance of communications and the related traffic data without obtaining consent.
• Direct marketing: Art. 13 requires obtaining user consent for marketing electronic communications and value-added services and providing options to withdraw it anytime.
• Location data: Art. 9(1) states that location data may be processed only with user consent, and users must be informed and able to withdraw consent.

EDPB Guidelines on Valid Consent in the EU

The European Data Protection Board (EDPB) is the leading supervisor of the GDPR in Europe, responsible for directing the national data protection authorities in each EU country on how the GDPR is to be enforced. On May 4, 2020, the EDPB released guidelines on valid consent in the EU, clarifying what constitutes a proper, lawful visitor consent on websites for the processing of personal data.

The EDPB guidelines specify that:

1. Cookie banners are not allowed to have pre-ticked checkboxes as a default: Instead, cookies (except strictly necessary cookies) must be deselected and deactivated by default, so that visitors can give their consent as a clear and affirmative action.
2. Cookie walls remain unlawful: Cookie walls mean forcing visitors to consent to cookies to gain access to a website. Instead, visitors must be able to filter their consent and also give it freely.
3. Continued browsing and scrolling on a website does not constitute valid consent.

As of 2026, cookie walls remain non-compliant as these visual pop-ups block the access to a website with a single “Accept” option to proceed and no real alternatives to choose from. They violate GDPR requirements for freely given visitor consent.

What is Valid GDPR Consent?

Under Art. 4(11) GDPR, consent should be specific, informed, unambiguous, and freely given, meaning that visitors should be provided with real choice and clear options to choose from before making a clear affirmative action. EDPB recommendations specify these four criteria and determine their cumulative effect:

• Freely given: Visitors should have real choice and be in real control over their personal data, with an ability to withdraw their consent anytime.
• Specific: Consent should be tied to a concrete purpose, with no generalizations like “improve user experience” allowed.
• Informed: The decision to share personal data should be based on the clear understanding of the data collector’s identity, purpose of processing, type of data collected, and the ability to withdraw the consent. 
• Unambiguous: The consent banner should clearly communicate an affirmative action, with no pre-ticked boxes or considering inactivity as consent.

Getting a valid consent is necessary to avoid GDPR penalties that can reach EUR 20 million or 4 percent of the annual global turnover of a company.

Consent Management Lifecycle

Consent management involves different stages that create a lifecycle that starts from requesting consent from visitors and ends with deleting or updating it. 

The five stages of the consent management lifecycle include:

1. Obtaining consent: Getting visitors permission to collect and process personal information under their valid GDPR consent (freely given, specific, informed, and unambiguous).
2. Recording consent logs: Documenting the evidence of what the visitor agreed to, when, and under which notice (required by Art. 5(2) GDPR accountability principle).
3. Enforcing: Making sure systems honor the current consent choice and block non-essential cookie tracking when consent is refused. 
4. Withdrawal: Making withdrawal easy and honoring it, along with deleting or suppressing data where required by law or retention rules.
5. Refreshing: Revisiting consent if the purposes, notices, tools, or legal conditions change.

Implementing consent management as a lifecycle makes it a process, not a one-time event, with all the necessary tools and mechanisms in place.

Do I Need Consent Management for My Website?

If your website uses tracking cookies, runs on third-party services, has third-party tools for marketing or analytics purposes, or features embedded content, it may set non-essential cookies or similar tracking technologies on visitors’ browsers and needs to obtain prior consent. Most websites today need consent management, because almost no website operates without the most basic tools for statistics, marketing, or implementation of social media functions.

While consent can be collected and recorded manually, implementing a GDPR consent management solution for your website supports the following:

• non-essential cookies are blocked until valid consent is given,
• visitors get clear information on the cookies,
• consent can be withdrawn at any time as easily as it was given.

In practice, GDPR consent management is best done with an all-in-one solution that helps support your website’s privacy compliance and protects your visitors’ privacy.

Cookiebot by Usercentrics, Automatic Consent Management

While choosing a GDPR-compliant consent management platform (CMP), check whether it supports GDPR and ePrivacy Directive regulatory coverage, implements consent blocking mechanisms, logs and stores proof of consent, and has easy setup and integrations necessary for your tech stack. Cookiebot by Usercentrics can be a good option for you based on these criteria.

Cookiebot by Usercentrics is a consent manager and privacy-compliant software-as-a-service that helps you scan, know, and control your website's cookies and other tracking for granular consent and clear visibility.

Once a month, Cookiebot by Usercentrics scans all of the pages of your website, detects all cookies and other known tracking technologies in use on all of the pages of your website, and sends a report ready for audit. The output can also be integrated on your website (for example, as part of your privacy policy or cookie policy), which helps keep your tracking information up to date and accurate, as required by the GDPR.

Usercentrics does not provide legal advice, and information is provided for educational purposes only. We always recommend engaging qualified legal counsel or privacy specialists regarding data privacy and protection issues and operations.