Cookie consent: what the law requires and how to check your site

Cookie consent is the permission a website must get from a visitor before it stores or reads cookies, pixels or similar identifiers that are not strictly necessary for the site to work. In the EU and UK that permission has to come first, as a clear opt-in; in California and a growing list of US states the model is different: tracking may start, but visitors must be able to opt out. This guide is the map of the topic for site owners, marketers and developers: what each law requires, what a banner has to do, where Google Consent Mode v2 fits, and how to check what your site really does before anyone clicks.

Quick answer

• EU and EEA: the ePrivacy Directive (Article 5(3)) requires prior consent before storing or reading anything on a visitor's device, unless it is strictly necessary for a service the visitor asked for. The GDPR sets what "consent" means: freely given, specific, informed, unambiguous, and as easy to withdraw as to give.
• UK: the same model under PECR, with new exceptions since 5 February 2026 for some first-party analytics and appearance cookies, as long as visitors are told and can object.
• US (California and similar states): no general opt-in for cookies, but businesses covered by the CCPA/CPRA must offer "Do Not Sell or Share My Personal Information" and honour the Global Privacy Control browser signal.
• What a compliant EU banner does: blocks analytics and advertising tags until the visitor says yes, offers "Reject all" as prominently as "Accept all", has no pre-ticked boxes, explains purposes, and lets visitors change their mind later.
• Google Consent Mode v2 passes the visitor's choice to Google tags. It is not a banner and does not collect consent by itself.
• Check the first visit: the free cookie scanner loads your page as a new visitor and lists every cookie and tracker set before and after "Accept".

What is cookie consent?

A cookie is a small piece of text a website stores in the browser and reads back on later requests. Some cookies are essential: the one that keeps you logged in, the one that holds your shopping cart, the one that remembers your cookie choice. Others exist to recognise you across visits or sites, for analytics, advertising, A/B testing or session recording.

Cookie consent is the rule that the second kind needs the visitor's permission. In the EU it applies to more than cookies: the ePrivacy Directive covers any information stored on or read from the device, so local storage, tracking pixels, fingerprinting scripts and SDKs in apps fall under the same rule. The European Data Protection Board's Guidelines 2/2023 on the technical scope of Article 5(3) spell this out, including tracking pixels and tracking links.

In practice, it takes three things working together:

1. A banner or consent dialog that asks for the choice, per purpose.
2. Tag blocking that keeps non-essential scripts from running until the answer is yes.
3. A record of what each visitor chose, and a way to change it.

Most problems regulators find are in step 2: the banner looks fine, the tags fire anyway.

What does the EU cookie law require?

"EU cookie law" is the everyday name for Article 5(3) of the ePrivacy Directive (2002/58/EC), as amended in 2009. It is a directive, so each country has written it into its own law: in Germany it is section 25 of the TDDDG, in France Article 82 of the Loi Informatique et Libertés, in the UK the Privacy and Electronic Communications Regulations (PECR). The core rule is the same everywhere:

• Storing or reading information on a user's device needs prior consent, after clear and comprehensive information about the purposes.
• Two exemptions: it is allowed without consent when it is only for transmitting a communication, or when it is strictly necessary to provide a service the user explicitly asked for.

The GDPR adds the standard for what counts as consent. Article 4(11) and Article 7 require consent to be freely given, specific, informed and unambiguous, given by a clear affirmative action, provable by the site, and as easy to withdraw as to give. Recital 32 adds that silence, pre-ticked boxes and inactivity are not consent.

The EU's top court confirmed how these fit together in Planet49 (Case C-673/17, 1 October 2019): a pre-ticked checkbox is not valid consent, the consent requirement applies whether or not the cookie data counts as personal data, and visitors must be told how long cookies last and whether third parties can access them.

What regulators and the EDPB's 2023 cookie banner taskforce report have made concrete since then:

• A reject option on the first layer is expected; hiding it behind "Settings" or "More options" has been fined.
• Scrolling, continuing to browse or closing the banner is not consent.
• Deceptive design such as a bright Accept button next to a grey link-style Reject, or a pre-selected "legitimate interest" toggle, undermines consent.
• Cookie walls that block the site unless the visitor accepts are, in most cases, considered incompatible with freely given consent; some regulators accept a paid alternative under conditions.

What changed in the UK

The UK kept the EU model after Brexit through PECR and the UK GDPR, but the Data (Use and Access) Act 2025 changed it. Since 5 February 2026, consent is no longer needed for cookies used only to collect statistics about how your service is used, or only to adapt its appearance to the user's preferences, provided you give clear information and a simple, free way to object. Advertising cookies still need consent, and analytics shared with a third party for its own purposes are outside the exception. The same commencement raised the maximum PECR fine from £500,000 to £17.5 million or 4% of global turnover. The ICO's guidance on storage and access technologies is the reference.

Are cookie IDs personal data under the GDPR?

Often, yes. Recital 30 of the GDPR names "cookie identifiers" among the online identifiers that can be used to single out a person, and data that singles someone out is personal data even without a name. A _ga client ID that follows one browser across visits is the classic example.

For the consent question it matters less than people think. The ePrivacy rule applies to storing and reading information on the device whether or not that information is personal data, as Planet49 confirmed. The GDPR then applies on top to whatever personal data the cookie leads to: you need a legal basis, a privacy notice, retention limits and, for transfers outside the EU, a transfer mechanism.

Which cookies need no consent?

Strictly necessary cookies need no consent under the ePrivacy rules: the ones without which the service the visitor asked for cannot work. Typical examples:

• session and login cookies, and the CSRF token that protects forms;
• the shopping cart and checkout;
• load-balancer and security cookies, including bot and fraud protection;
• the cookie that stores the visitor's consent choice itself;
• a language or accessibility choice the visitor made.

Analytics, advertising, social embeds, A/B testing and session recording are not strictly necessary in the EU. The test is necessity for the visitor's request, not for your business.

The guide to cookies before consent and whether your banner really blocks trackers shows how to reproduce the problem by hand in a fresh browser, find what loads each tracker, and make Tag Manager and your consent platform wait for the click. It is the most common failure in audits: the banner looks right, and _ga or _fbp is set before anyone touches it.

What a compliant cookie banner needs

A banner that passes a regulator's first look has these properties:

The guide to a cookie banner that passes: reject button, lifetime and Consent Mode goes through taking an inventory of your cookies, choosing a consent platform, designing the first layer, blocking by category and testing before the click and after a reject. The cookie banner fix page summarises what OK looks like.

What are website cookies, exactly?

Cookies are sorted two ways. First-party cookies belong to the site in the address bar; third-party cookies belong to another domain loaded in the page, usually an ad or embed provider, and can follow a visitor across sites. Session cookies end with the browser session; persistent cookies stay until an expiry date. The guide to what cookies on a website are, first-party vs third-party explains both, how sites set cookies, where browsers such as Chrome, Safari and Firefox stand on third-party cookies, and whether cookies are safe for visitors.

For consent, neither distinction decides the question; the purpose does. A first-party analytics cookie such as _ga still needs consent in the EU, and many trackers now set first-party cookies precisely because browsers restrict third-party ones, so blocking by domain is not enough. Security attributes such as Secure, HttpOnly and SameSite are a separate topic, covered in cookie flags explained.

Do you need a cookie policy?

If you use cookies that need consent, you need to explain them, and a cookie policy (or a cookie section in your privacy policy) is where that explanation lives. Consent is only valid if it is informed, and Planet49 added that duration and third-party access must be disclosed.

A useful cookie policy lists each cookie or category, its purpose, who sets it (you or a named third party), how long it lasts, and how to change your choice. Most consent platforms generate the table; check it against what your site really sets. Link it from the banner and the footer, next to the privacy policy and contact links.

Our guide to what a cookie policy is and what it must list covers when you need one under EU, UK and US rules (including California's CalOPPA), a model cookie table, where to link it, and how to build and maintain the list from a real scan instead of a template.

What is Google Consent Mode v2?

Google Consent Mode is an API that tells Google tags (Google Analytics 4, Google Ads, Floodlight, Tag Manager) what the visitor agreed to, so they adjust what they store and send. Version 2, required since March 2024 for advertisers who want to keep remarketing and personalised ads for EEA visitors, added ad_user_data and ad_personalization to the original ad_storage and analytics_storage.

It comes in two implementations. In basic mode, Google tags do not load until the visitor chooses. In advanced mode they load at once with every signal set to denied, set no cookies, and send cookieless pings that Google uses to model conversions and behaviour. Some EU regulators view those pre-consent pings critically, so decide between the two with your legal advice. Either way, Consent Mode is not a banner: you still need one to ask the question, and non-Google trackers ignore it.

Our guide to Google Consent Mode v2, basic vs advanced explains each signal, what the two modes change in GA4 reports and Google Ads conversions, how to set it up through a consent platform, Tag Manager or gtag.js, and how to verify it in the network panel and Tag Assistant. The guide to GA4 and Tag Manager: the cost and the consent shows the defaults in the context of loading order and page speed.

Is Google Analytics allowed under the GDPR?

It can be used lawfully, with consent. Google Analytics sets cookies that are not strictly necessary, so in the EU it needs prior consent under the ePrivacy rules, whatever settings you choose. The separate question of sending data to the US was the subject of 2022 decisions by the Austrian, French and Italian regulators, which found some Universal Analytics setups unlawful. Since July 2023 the EU–US Data Privacy Framework covers transfers to certified US companies, Google among them; the EU General Court upheld it in September 2025, and an appeal to the Court of Justice is pending.

Our guide to Google Analytics and the GDPR sets out what each regulator decided, what the Data Privacy Framework changed, and a six-step setup: blocking or Consent Mode until "Accept", Google's data processing terms, the GA4 settings to switch off, retention and cookie lifetime, keeping personal data out of URLs, and what to write in your privacy notice.

What does the CCPA require for cookies?

The California Consumer Privacy Act, as amended by the CPRA, works on opt-out rather than opt-in. It applies to for-profit businesses that do business in California and meet one of three thresholds: annual gross revenue above $25 million (inflation-adjusted to $26,625,000 from January 2025), buying, selling or sharing the personal information of 100,000 or more California consumers or households a year, or earning half or more of annual revenue from selling or sharing personal information.

For cookies, the key word is "share": the CPRA defines sharing as disclosing personal information for cross-context behavioural advertising, which is what most ad pixels and retargeting cookies do. A covered business must:

• tell visitors at or before collection what it collects and why (a notice at collection);
• offer a "Do Not Sell or Share My Personal Information" link, or an alternative opt-out link, and stop selling or sharing when a visitor uses it;
• treat the Global Privacy Control (GPC) browser signal as a valid opt-out request under the CCPA regulations;
• get opt-in consent before selling or sharing data of consumers it knows are under 16.

California's attorney general settled with Sephora for $1.2 million in 2022, in part for ignoring GPC signals while third-party trackers sold data. A growing list of states, including Colorado, Connecticut, Texas and Oregon, have their own opt-out privacy laws, and several of them also require honouring universal opt-out signals such as GPC. Since 1 January 2026, the CCPA regulations also require sites to show whether they processed a GPC signal, and from 2027 browsers must offer the signal as a setting. Our guide to what the CCPA requires from a cookie banner covers the opt-out link, GPC, the symmetry rule the CPPA used against Honda's cookie tool, the 2025 enforcement cases and how to test an opt-out.

What happens if you get it wrong?

EU and UK regulators do fine for cookie consent, and the amounts have grown. Examples from the French regulator, the CNIL, which has made cookies a priority since 2019:

• Google (€150 million) and Facebook (€60 million), announced January 2022, because refusing cookies took more clicks than accepting them.
• Google (€325 million) and Shein (€150 million), September 2025. For Shein, the CNIL found advertising cookies placed as soon as a visitor arrived and still set after "Reject all"; Google's fine concerned ads in Gmail and cookies during account creation.

Most small sites meet a visitor complaint, a customer's vendor audit or a demand letter rather than a regulator. All of them start with the same evidence: what a fresh browser receives before anyone clicks.

How to check your site's cookie consent

The cookie scanner does what a regulator's first check does: it opens your page in a fresh Chromium with no cookies and nothing accepted, records every cookie and request, then looks for the accept button (by the selectors of 18 consent platforms or a visible accept button in 20 languages), clicks it and records what appears afterwards. Every cookie is classified by name, lifetime and first or third party, and trackers are matched against 25 well-known analytics, advertising and session-recording services. The scan runs from Frankfurt, so a site that shows its banner only to EU visitors is seen as an EU visitor sees it.

The report turns that into these findings:

The fix pages for trackers before consent, cookie lifetime and Consent Mode explain each result in more detail.

What an automated scan can and cannot tell you

A scan is strong evidence for one thing: what your homepage, or the page you enter, does on a first visit from one location. Be clear about what it does not prove:

• It does not prove compliance. A clean scan means no tracker loaded before consent on that page, in that visit. It cannot judge whether your purposes are explained well, whether your legal basis is right, or whether consent records exist.
• It sees one page. A tracker added only on checkout or blog posts will not appear; scan your key templates too.
• It sees one moment and one place. Tags that fire after a delay, on scroll or only for visitors from certain countries can be missed.
• Banners in iframes or with unusual button labels may not be clicked. You then get the pre-consent half only, which is still the half that matters most.
• It cannot see server-side tracking. Data sent from your server to an analytics or ad platform, such as server-side tagging or conversion APIs, never shows in the browser.
• It does not test "Reject". It clicks Accept; testing a refusal is a manual step described in the banner guide.

Use the scan to find problems and prove fixes; use a manual check and legal advice for the rest.

Cookie consent on WordPress and other platforms

On WordPress, consent is usually handled by a plugin, and the most important setting is whether it actually blocks scripts before consent or only displays a notice. Plugins that load Google tags through their own integration, or that scan and categorise scripts automatically, need their categories checked: a script placed in "necessary" by mistake runs for everyone. Themes and plugins that insert tracking code directly, bypassing the consent plugin, are a common cause of trackers-before-consent findings.

On Shopify, the built-in Customer Privacy API and Shopify's cookie banner control Shopify's own tracking and apps that respect it; third-party apps and code pasted into theme files may not. On custom sites, a consent management platform plus Tag Manager consent triggers is the usual setup.

Our guide to choosing a WordPress cookie consent plugin that really blocks scripts compares the three ways plugins block trackers, gives a checklist for choosing one (first-layer reject, Consent Mode v2, the WP Consent API, embed blocking, weight), and shows how to make caching and JavaScript-delay settings in optimisation plugins cooperate with the banner.

Common mistakes

• A banner with no blocking. The banner collects a click nobody's tags listen to. Test in a private window: no tracker request should leave the page before you choose.
• Hardcoded tags outside the consent tool. A GA snippet in the theme header, a pixel in the footer or an app injecting its own script runs regardless of the banner.
• "By continuing to browse you accept". Not consent in the EU, and not a GPC-compliant opt-out in California.
• Reject hidden on a second layer. The most frequently fined design pattern.
• Everything marked "necessary". Analytics and ad cookies cannot be declared necessary to avoid the question.
• Two-year cookie lifetimes. Shorten consent-based cookies to 13 months or less; GA4 has a cookie expiry setting.
• Showing EU visitors a US-style banner. An opt-out link is not prior consent.
• Never re-scanning. New tags arrive with every campaign. Scan after each Tag Manager or plugin change, and monthly otherwise.

Questions people ask

What is cookie consent?

Cookie consent is a visitor's permission for a website to store or read cookies and similar identifiers that are not strictly necessary for the site to work, such as analytics and advertising cookies. In the EU and UK it must be given before those cookies are set, by a clear action like clicking "Accept", and it must be as easy to refuse or withdraw.

What is the ePrivacy Directive?

The ePrivacy Directive (2002/58/EC) is the EU law on privacy in electronic communications, and Article 5(3) is the "cookie law". It requires consent before information is stored on or read from a user's device, except where strictly necessary for a service the user requested. Each EU country implements it in national law, such as section 25 of Germany's TDDDG.

Is the GDPR the law that requires cookie banners?

Not on its own. The requirement to ask before setting non-essential cookies comes from the ePrivacy Directive and the national laws based on it. The GDPR defines what valid consent is, freely given, specific, informed and unambiguous, and governs the personal data those cookies collect. In practice both apply, which is why people speak of "GDPR cookies".

Are cookie IDs personal data under the GDPR?

Usually, yes. Recital 30 of the GDPR names cookie identifiers as online identifiers that can single out a person, so a cookie ID tied to one browser is generally personal data. For consent, though, it does not matter: the ePrivacy rule requires consent for non-essential cookies whether or not they hold personal data, as the EU Court of Justice confirmed in Planet49.

Do US websites need cookie consent?

Mostly not in the EU sense. US state laws such as California's CCPA/CPRA use an opt-out model: covered businesses may set advertising cookies but must offer a "Do Not Sell or Share" link and honour the Global Privacy Control signal. A US site with EU or UK visitors can still fall under EU or UK rules for those visitors.

Can an automated scan prove my cookie consent is compliant?

No. A scan shows what a page sets on a first visit from one location, before and after consent, which is strong evidence of blocking problems. It cannot judge your purpose descriptions, consent records, legal basis, server-side tracking or other pages. Use a scan to find and verify technical issues, and legal advice to judge compliance as a whole.

Is Google Consent Mode a cookie banner?

No. Google Consent Mode only passes the visitor's choice to Google tags so they adjust what they store and send. You still need a banner or consent management platform to ask the question and record the answer. Since March 2024, sites using Google advertising features with EEA visitors need Consent Mode v2 signals to keep audiences and personalisation.

How long should a cookie consent choice be remembered?

Around six months is the common benchmark: the French regulator CNIL recommends keeping a visitor's choice, including a refusal, for about that long before asking again. Consent-based cookies themselves should expire within 13 months under French and Spanish guidance. Asking again much sooner annoys visitors and can look like pressure to accept.