What a cookie consent banner has to do

This is not legal advice. Whether you need a banner at all, and exactly what it must say, depends on where you and your visitors are and on what your site loads. What follows is the practical picture: what a banner has to offer the visitor, what it has to do with their answer, and the mistakes regulators have catalogued.

The most useful single source is the report of the European Data Protection Board's cookie banner taskforce, published on 18 January 2023 after national regulators coordinated their handling of complaints about banners. It records where most authorities agreed. It is a common position rather than a binding rulebook, and national guidance still applies on top of it.

Whether you need a banner is a separate question — what counts as storage on a visitor's device, and what is exempt, is covered in the guide on widgets, cookies and consent. This one assumes you need one.

The first practice the taskforce examined was a banner that offers Accept with no way to refuse on the same layer, so refusing means opening the settings and switching things off. A vast majority of the authorities considered the absence of a reject option, on a layer that has an accept button, to fall short of valid consent and so to be an infringement. A few disagreed, because the ePrivacy Directive does not mention a reject option in so many words.

How the reject option is drawn matters too. The taskforce agreed that a refuse link embedded in a paragraph of text, without enough visual support to draw an average visitor's attention, does not lead to valid consent. On colours and contrast it declined to set one universal standard, but agreed that banners must be checked for colours and contrast that obviously push the visitor toward accepting.

Category switches that arrive already on are pre-ticked boxes, and the taskforce confirmed that pre-ticked boxes do not lead to valid consent — the GDPR's recital 32 names them alongside silence and inactivity as things that should not count as consent. Optional categories start off, and the visitor turns them on.

The strictly-necessary category is the other common shortcut. Labelling analytics or advertising cookies "essential" moves them outside the consent question altogether, and the taskforce found controllers doing exactly that. Its members noted that whether a cookie is essential has to be assessed rather than looked up, and that a website owner should be able to show the authorities why each cookie it calls essential qualifies.

A browser runs every ordinary script tag the moment the page loads. A banner that displays its question while the analytics tag beside it has already fired is recording an answer about something that already happened. The whole point of asking first is that nothing which needs consent runs before it is given.

There are two common ways to hold a script back. A tag manager can fire tags only once consent arrives. Or the script tag itself is written so the browser will not run it — given a type the browser does not execute, such as text/plain, with a marker naming its consent category — and the banner swaps in a runnable copy once that category is allowed. Iframes, such as video players, can be held back the same way by leaving their source empty until consent.

Whichever you use, test it: open the page in a private window, refuse everything, and look at the Network and Storage panels of the developer tools. Anything that loaded anyway is not gated.

Consent has to be withdrawable at any time, and the taskforce recorded that withdrawing must be as easy as giving it. Its suggestion was concrete: a small, permanently visible icon on every page, or a link in a visible and standard place, that takes the visitor back to their settings.

Withdrawal has a technical catch. A script that has already run cannot be un-run, so the honest way to make a withdrawal take effect is to reload the page once the visitor saves it, so the newly refused scripts never start.

Consent Mode is how a page tells Google's own tags what the visitor decided. It defines consent types — ad_storage and analytics_storage for storage, and ad_user_data and ad_personalization, added in version 2, for sending user data to Google for advertising and for personalised ads. The page sends a default state when it loads, usually everything denied, and an update when the visitor chooses.

Google describes two ways to run it. In basic mode, Google tags do not load until the visitor interacts with the banner. In advanced mode they load straight away with the default state and adjust when the choice arrives, which gives Google more to model from.

Consent Mode is not a banner. Google says you remain responsible for obtaining consent, with a consent banner, a custom solution or a consent management platform, and for passing the result on. For visitors in the EEA, Google's Tag Manager help says you must collect consent for the use of personal data, and share consent signals with Google, to keep its measurement, personalisation and remarketing features.

Some obligations sit outside the banner. Google's EU user consent policy, which applies to sites using Google products with visitors in the EEA, the UK and Switzerland, says you must keep records of the consent end users give, give them clear instructions for revoking it, and identify each party that may collect, receive or use their personal data.

A banner that keeps the choice only in the visitor's own browser, with no log on a server, keeps no such record. That is a deliberate privacy choice in some banners — Zyff's is one — but if a policy or law you are bound by requires records of consent, you need them from somewhere else.

And none of this makes a site compliant by itself. Compliance also depends on what your privacy notice says, what else your pages load, and where you and your visitors are. A banner is the mechanism for asking and for honouring the answer; check the rest with someone who knows your jurisdiction.

Zyff builds a cookie consent banner, so here is how it maps onto the points above — including the one it deliberately does not do.