Cookie banners and consent: what to check: getReport

Check your own site

Runs these 2 checks and the other 191, free, in about 45 seconds.

What it is

A cookie banner is the notice a website shows on the first visit to ask for consent to non-essential cookies and tracking, with buttons to accept, reject or choose categories. In the EU and UK it is required whenever the site uses cookies that are not strictly necessary.

A banner only counts if it works: tracking must wait for the answer, and rejecting must be as easy as accepting. Regulators enforce this; in 2022 France's CNIL fined Google 150 million euros and Facebook 60 million euros because refusing took more clicks than accepting. Banners also cover part of the screen and add scripts, so their design affects every visitor.

OK looks like this: a banner with accept and reject buttons of equal weight on the first layer, no tracking before the choice, and content still readable behind it. getReport detects the consent platform and checks for a first-layer reject option.

What a passing site looks like

Cookie banner reject option: passeswarning · −1.5 ptseffort S
No cookie banner detectedinfo onlyeffort S

Why it matters. EU regulators (CNIL, the Datatilsynet, the EDPB guidance) expect refusing to be as easy as accepting: a "Reject all" or "Only necessary" control on the first layer, not hidden behind "Settings". A banner without it is a dark pattern and, in several countries, a finable one.

How to fix it.

Enable the first-layer reject button in your consent platform (your consent platform: usually a "Show reject all" or "Decline" setting) with the same size and colour weight as accept.

Why it matters. A consent banner is required in the EU when the site sets non-essential cookies. It also covers part of the screen and adds scripts, so it is worth knowing which one runs.

How to fix it.

Make sure the banner blocks tracking scripts until the visitor agrees, and that "Reject" is as easy as "Accept".

Questions people ask

What is a cookie banner?

A cookie banner is a pop-up or bar that tells visitors which cookies a website uses and asks for their consent before setting non-essential ones. It usually offers accept all, reject all and settings. A consent management platform such as Cookiebot, OneTrust, Complianz or CookieYes typically runs it.

Do you need a cookie banner for CCPA?

The CCPA does not require an opt-in cookie banner like the GDPR does. It requires a clear way to opt out of the sale or sharing of personal information, usually a "Do Not Sell or Share My Personal Information" link, and honouring Global Privacy Control signals. Many sites use one banner for both.

What are the cookie banner requirements?

Under EU rules: ask before setting non-essential cookies, explain their purposes in plain language, offer reject as prominently as accept on the first layer, no pre-ticked boxes, no tracking before the choice, and an easy way to change the choice later. Record each consent so you can prove it.

Does a cookie banner need a reject button?

In the EU, effectively yes. Regulators including the CNIL and the EDPB expect refusing to be as easy as accepting, which means a reject or only necessary button on the first layer, not hidden in settings. Several fines have been issued for banners without one.