Cookie Consent Done Right

Most cookie banners on the web are quietly non-compliant. They load trackers before anyone clicks, hide the reject button, or treat “continuing to browse” as agreement. Getting consent right is not complicated once you understand the handful of rules behind it — and doing it properly also builds trust with visitors.

Consent must come first

Under EU rules (the ePrivacy framework, read together with the GDPR), non-essential cookies may only be set after the user agrees. That means your analytics, advertising and social-embed scripts should not run on page load — they wait until the visitor opts in. A banner that already dropped a tracking cookie by the time it appears has failed the most basic test.

What counts as “essential”

Strictly necessary cookies keep the site working: a login session, a shopping cart, a security token, or remembering the consent choice itself. These do not require consent. Everything aimed at measurement, profiling or marketing is non-essential and does require it. When in doubt, ask.

Cookie type	Example	Consent needed?
Strictly necessary	Login session, cart, CSRF token	No
Preferences	Language or theme choice	Often yes
Analytics	Visitor measurement	Yes
Marketing	Ad targeting, retargeting pixels	Yes

The rules of valid consent

For consent to count, it has to be freely given, specific, informed and unambiguous. In practice:

1. No pre-ticked boxes. Silence or inactivity is not consent. Every non-essential category starts off.
2. Reject as easy as accept. If “Accept all” is one click, “Reject all” must be one click too — and equally prominent.
3. Granular choice. Let people accept some categories and refuse others, with a plain description of each.
4. Easy to withdraw. Changing your mind later should be as simple as giving consent in the first place.
5. Keep records. Store what each visitor consented to and when, so you can demonstrate compliance.

Common mistakes to avoid

• Loading trackers before the banner is answered.
• A big “Accept” button with reject buried in a submenu — a classic dark pattern.
• Treating scrolling or continued browsing as agreement.
• Cookie walls that block all access unless you accept marketing cookies.
• Vague labels like “we use cookies to improve your experience” with no categories.
• No way to withdraw consent once given.

Records and transparency

Keeping a consent log — who chose what, and when — is what lets you show a regulator you did things properly. Pair the banner with a clear cookie section in your privacy policy that lists the cookies you set, their purpose and their lifespan. Together, the banner and the policy tell a consistent story.

This guide is general information, not legal advice. Requirements vary by country and situation; consult a qualified professional for your specific case. Our compliance overview puts cookie rules in wider context.

Frequently asked questions

Related guides