Cookie Consent & GDPR Compliance
for Web Agencies

Cookie Banner Requirements

A compliant cookie banner is not just a pop-up that disappears when you click "Accept All." Here is what the law actually requires:

1. Active consent — no pre-checked boxes. Every cookie category must require an active opt-in. Dark patterns that steer users toward acceptance can invalidate consent.

2. Granular choice — not just accept/reject. Users must be able to accept some categories and reject others. Cookie walls that block access unless the user accepts all cookies are illegal.

3. Clear language for each cookie purpose. "Marketing" is not enough. Explain what each category does, what data it collects, and who the recipients are.

4. Consent recorded and stored. GDPR Article 7(1) requires you to demonstrate consent. Record: who, when, what categories, the exact banner wording, and any withdrawal.

5. Easy to change or withdraw consent. A "Cookie Preferences" link in the footer lets users review preferences at any time. Withdrawal must be as easy as giving consent.

6. Necessary cookies exemption. Cookies strictly necessary for basic functions (session, authentication, load balancing) are exempt under ePrivacy Article 5(3). Everything else requires prior consent.

Consent Fatigue Is Not an Excuse

Cookie banners are among the most complained-about web features. Users click "Accept All" without reading. Regulators know this.

Consent fatigue does not invalidate your consent mechanism. If you offer a genuine choice and document it, consent is valid even if the user did not read every line.

What DOES invalidate consent: (a) pre-checked boxes, (b) cookie walls, (c) dark patterns, (d) vague cookie descriptions, (e) no consent records.

Practical tip: set default state to reject. No cookies loaded until the user actively opts in. Give "Reject all" and "Accept all" equal visual weight.

A 7-Day Implementation Plan

A 7-day plan for implementing a compliant cookie consent system on client sites:

Day 1-2: Audit current cookies. List every cookie: domain, name, purpose, expiration, first/third party.

Day 3: Categorise. Divide into (a) strictly necessary, (b) functional, (c) analytics, (d) marketing. Be honest.

Day 4-5: Configure a CMP. Cookiebot, Complianz, or self-hosted. Set default state to off for all non-essential categories.

Day 6: Test. Incognito window. Verify only necessary cookies load before consent. Verify consent and withdrawal both work.

Day 7: Document and deploy. Consent record policy, cookie list in privacy policy, Cookie Preferences link in footer.

Do Anonymised Analytics Need Consent?

"We only use anonymised analytics, we do not need consent." This is the most common argument — and it needs careful handling.

Google Analytics, even with IP anonymization, sets a _ga cookie (Client ID). This cookie is not strictly necessary. It requires consent under both ePrivacy and GDPR.

Cookieless analytics (Plausible, Fathom, Umami — and the tracker on this site) set NO cookies. These do not require cookie consent, though they should be disclosed in your privacy policy.

For small agencies: switch to cookieless analytics for your own site and recommend it to clients. It eliminates the consent burden entirely.

Five Mistakes Regulators Spot Immediately

1. Implied consent by scrolling. "By continuing to use this site, you accept cookies" is not valid consent. You need active, affirmative consent.

2. No revisit mechanism. Without a Cookie Preferences link, users cannot withdraw consent. This is a violation.

3. Consent records not stored. If you cannot produce a timestamped record, you cannot prove consent. Most CMPs do this automatically.

4. Incomplete cookie list. An outdated or generic cookie policy undermines your consent mechanism. Audit quarterly.

5. Undisclosed third-party cookies. Google Ads, Meta Pixel, LinkedIn Insight cookies must be named individually in the banner. Hiding behind "analytics partners" invites enforcement.

Going Deeper

Before choosing a CMP, see what cookies your site actually sets and whether trackers fire before consent. Our free Cookie Consent Checker scans any URL in seconds — no signup.

The checklist is free. The file you file with it is not.

Everything in this guide is free, and it stays free: the free scanner, the 7-day plan, and the five mistakes regulators spot first. Run it on as many client sites as you like — there is no account, no key and no trial. If your work is "is this banner configured correctly", the free scan is the whole answer.

What you do not get is a record. Problem 3 above says it plainly: without a timestamped record you cannot prove consent, and problem 4 says to audit quarterly. A browser tab gives you a score that is gone when you close it — it is not something you can attach to a client handover, and re-running it next quarter means starting over. Pro adds the server-side GDPR/cookie checks that actually look at what the site loads, and the whole report as a PDF you can file.

The licence covers one website. If you only need to know whether a banner passes today, the free checker is the whole answer — you never need to pay for anything.

Buy EUComply Pro — $79/year

Frequently Asked Questions