PRIVACY

Home › Glossary › Privacy· 103 ·

Cookie Consent Banner

koo-kee kon-sent ban-nernoun

Filed underPrivacyWeb Development

In brief · quick answer

A cookie consent banner is a website notification that informs visitors about cookie usage and obtains their consent where required by privacy regulations like GDPR and ePrivacy Directive.

§ 1 Definition

A cookie consent banner (also called a cookie notice or cookie widget) is a user interface element that appears when a visitor first lands on a website, informing them about the use of cookies and tracking technologies. Under GDPR and the ePrivacy Directive, non-essential cookies require prior consent. Essential cookies (session cookies, authentication cookies) are exempt. The banner must provide clear information about what cookies are used, allow granular choices (accept all, reject all, customize), and record the user's consent. Under CCPA/CPRA, instead of opt-in consent, the banner typically provides a 'Do Not Sell or Share My Personal Information' link.

§ 2 Regulatory Requirements

Under GDPR and the ePrivacy Directive, cookie consent must be: informed (clear explanation of each cookie category), freely given (no dark patterns like pre-ticked boxes), specific (separate consent for different purposes), unambiguous (a clear affirmative action, not scrolling or continuing to browse), and revocable (users can withdraw consent at any time). Under CCPA/CPRA, the requirement is an opt-out mechanism for sale/sharing of personal information, typically via a 'Your Privacy Choices' link.

§ 3 Types of Cookie Consent Banners

Simple notice: Informs users about cookies but does not obtain consent. Non-compliant under GDPR. Implied consent: Assumes consent if user continues browsing. Non-compliant under GDPR since the 2019 Planet49 ruling by the CJEU. Explicit opt-in: Users must actively click Accept for non-essential cookies. Compliant. Granular consent: Users can choose which categories of cookies to accept (necessary, analytics, marketing, functional). Best practice. Consent management platform (CMP): Full-featured solution that handles consent collection, storage, and integration with third-party scripts.

§ 4 Implementation Best Practices

Load non-essential scripts only after consent: Use tag management or manual gating to prevent analytics and marketing scripts from firing before consent. Store consent proof: Record what the user consented to, when, and through which mechanism. Provide a consent dashboard: Allow users to review and change their preferences later. Respect Do Not Track / GPC: Global Privacy Control is a browser signal that must be honored under CCPA/CPRA. Design for mobile: Ensure the banner works on small screens and does not block content.

§ 5 Note

Dark patterns are explicitly prohibited by GDPR enforcement. Pre-ticked checkboxes, making 'reject all' harder to find than 'accept all,' and using confusing language all invite regulatory action. In 2022, the CNIL (French DPA) fined Microsoft 60 million euros partly due to cookie consent dark patterns.

§ 6 Common questions

Q. Do I need a cookie consent banner?: A. If your website uses any non-essential cookies (analytics, marketing, advertising, social media tracking) and serves users in the EU/EEA or UK, yes. Essential cookies (session, authentication, security) do not require consent.
Q. Is implied consent (you continue browsing, you consent) legal?: A. No. The CJEU Planet49 ruling (2019) and subsequent EU guidance make clear that scrolling or continuing to browse does not constitute valid consent. Active, affirmative action is required.
Q. Can I use a free cookie consent solution?: A. Yes, but ensure it supports granular consent, consent recording, and script gating. Free tiers from providers like Cookiebot, Osano, and Finsweet offer basic compliance but may lack advanced features.

Key takeaways

Cookie consent banners are required under GDPR/ePrivacy for non-essential cookies.
Consent must be informed, freely given, specific, unambiguous, and revocable.
CCPA/CPRA requires a 'Do Not Sell or Share' link rather than a consent banner.
Gate non-essential scripts to fire only after consent is obtained.

How Atomic Glue helps

Atomic Glue implements compliant cookie consent solutions that respect regional regulations, gate third-party scripts properly, and provide granular user choice. See our Trust & Security page.

Get in touch

# Cookie Consent Banner

A cookie consent banner is a website notification that informs visitors about cookie usage and obtains their consent where required by privacy regulations like GDPR and ePrivacy Directive.

Category: Privacy (also: Web Development)

Author: Atomic Glue Security Team

## Definition

## Regulatory Requirements

Under **GDPR** and the **ePrivacy Directive**, cookie consent must be: **informed** (clear explanation of each cookie category), **freely given** (no dark patterns like pre-ticked boxes), **specific** (separate consent for different purposes), **unambiguous** (a clear affirmative action, not scrolling or continuing to browse), and **revocable** (users can withdraw consent at any time). Under **CCPA/CPRA**, the requirement is an opt-out mechanism for sale/sharing of personal information, typically via a 'Your Privacy Choices' link.

## Types of Cookie Consent Banners

**Simple notice**: Informs users about cookies but does not obtain consent. Non-compliant under GDPR. **Implied consent**: Assumes consent if user continues browsing. Non-compliant under GDPR since the 2019 Planet49 ruling by the CJEU. **Explicit opt-in**: Users must actively click Accept for non-essential cookies. Compliant. **Granular consent**: Users can choose which categories of cookies to accept (necessary, analytics, marketing, functional). Best practice. **Consent management platform (CMP)**: Full-featured solution that handles consent collection, storage, and integration with third-party scripts.

## Implementation Best Practices

**Load non-essential scripts only after consent**: Use tag management or manual gating to prevent analytics and marketing scripts from firing before consent. **Store consent proof**: Record what the user consented to, when, and through which mechanism. **Provide a consent dashboard**: Allow users to review and change their preferences later. **Respect Do Not Track / GPC**: Global Privacy Control is a browser signal that must be honored under CCPA/CPRA. **Design for mobile**: Ensure the banner works on small screens and does not block content.

## Note

## Common questions

Q: Do I need a cookie consent banner?

A: If your website uses any non-essential cookies (analytics, marketing, advertising, social media tracking) and serves users in the EU/EEA or UK, yes. Essential cookies (session, authentication, security) do not require consent.

Q: Is implied consent (you continue browsing, you consent) legal?

A: No. The CJEU Planet49 ruling (2019) and subsequent EU guidance make clear that scrolling or continuing to browse does not constitute valid consent. Active, affirmative action is required.

Q: Can I use a free cookie consent solution?

A: Yes, but ensure it supports granular consent, consent recording, and script gating. Free tiers from providers like Cookiebot, Osano, and Finsweet offer basic compliance but may lack advanced features.

## Key takeaways

Cookie consent banners are required under GDPR/ePrivacy for non-essential cookies.
Consent must be informed, freely given, specific, unambiguous, and revocable.
CCPA/CPRA requires a 'Do Not Sell or Share' link rather than a consent banner.
Gate non-essential scripts to fire only after consent is obtained.

## Related entries

Last updated December 2024. Permalink: atomicglue.co/glossary/cookie-consent-banner