The EU's enforcement of GDPR cookie consent rules has escalated sharply since 2022. The French CNIL alone issued over €300 million in GDPR fines between 2022 and 2024, with cookie consent violations accounting for a significant share. Getting your cookie banner legally correct is no longer optional — and the standard is higher than most website owners realise.

Not all cookies require consent. The key distinction is strictly necessary versus everything else.

Strictly necessary cookies (no consent required):

  • Session cookies that keep users logged in
  • Shopping cart and checkout cookies
  • Security and anti-fraud tokens (CSRF tokens, load balancer cookies)
  • Cookies that remember accessibility preferences (font size, contrast) when explicitly requested
  • Cookies set to remember a user's consent choice itself

Cookies that DO require consent:

  • Analytics cookies (Google Analytics, Matomo with cookies, Hotjar, Clarity)
  • Advertising and retargeting cookies (Google Ads, Meta Pixel, LinkedIn Insight Tag)
  • Social media embed cookies (YouTube, Facebook, Twitter/X widgets)
  • A/B testing and personalisation cookies that are not strictly necessary
  • Performance monitoring cookies that track individual users
  • Affiliate tracking cookies

The determining test is: would the website fail to deliver the service the user explicitly requested without this cookie? If yes, it is strictly necessary. If no, consent is required.

GDPR Article 7 and Recital 32 define valid consent through four cumulative requirements. All four must be satisfied — failure on any single criterion makes the consent invalid.

1. Freely given: The user must have a genuine choice. Consent cannot be bundled with acceptance of terms of service. There must be an equally prominent option to refuse non-necessary cookies. Cookie walls that block content unless users accept are prohibited (see FAQ).

2. Specific: Consent must be obtained separately for each distinct purpose. "Analytics" and "marketing" are separate purposes requiring separate consent. A single "accept all" for undifferentiated purposes does not constitute specific consent.

3. Informed: Users must know who is collecting the data, what cookies are set, for what purposes, for how long, and whether data is transferred outside the EU. This information must be accessible before consent, not buried three clicks deep.

4. Unambiguous and active: Consent must be given by a clear affirmative action. Silence, pre-ticked boxes, scrolling, or continued browsing do not constitute valid consent. The user must actively click "Accept" or toggle on specific categories.

Why Pre-Ticked Boxes Are Illegal

The Planet49 ruling (CJEU, C-673/17, October 2019) definitively established that pre-ticked boxes do not constitute valid consent under GDPR and the ePrivacy Directive. A pre-ticked box requires the user to act (untick) to refuse — this is not an unambiguous affirmative action. It is an opt-out mechanism, which GDPR explicitly prohibits for consent.

If your cookie banner presents marketing or analytics cookies as pre-selected and requires users to untick to refuse, every user who clicks "Accept" or closes the banner without unticking has not given valid consent. Any data processing based on that "consent" is unlawful.

The EDPB Guidelines 05/2020 on consent are explicit: a cookie wall — blocking access to a website's content unless the user consents to non-necessary cookies — makes consent non-freely-given and therefore invalid.

The reasoning: if the only way to access the content is to accept cookies, the user has no genuine choice. There is no alternative. The "consent" is coerced.

The "consent or pay" model: Some publishers and large platforms (notably in the Netherlands and Belgium after Meta's DPA ruling) have experimented with offering a paid subscription as an alternative to cookie consent. The EDPB's Opinion 08/2024 on "consent or pay" models concluded that these models only satisfy GDPR's freely given requirement when: (1) the paid alternative is offered at a reasonable price, (2) the paid option is the genuine default, not an obstacle, and (3) the consent to advertising is for the primary purpose, not attached to broad data broker sharing. For most small websites and freelancers, this model is operationally complex and the legal risk remains high.

The following is the minimum compliant cookie banner specification under GDPR and the ePrivacy Directive as interpreted by the EDPB and major supervisory authorities in 2026:

RequirementCompliantNon-Compliant
Reject button is as prominent as Accept buttonBoth buttons same size and colour weight"Accept" button large and green; "Reject" is a small grey link
Consent categories are granularSeparate toggles for Analytics, Marketing, FunctionalSingle "Accept All" with no granular options
Pre-ticked boxes absentAll non-necessary categories off by defaultAnalytics pre-ticked, user must untick
Identity of data controllers disclosedLists first and third parties by nameGeneric "and our partners" with no list
Link to full cookie policyProminent link before consentNo link, or link only in footer after consent
No consent by scrolling or closingActive click required"By continuing to browse you accept cookies"
Withdraw consent as easy as granting it"Manage Preferences" link visible at all timesConsent can be given in one click but withdrawal requires finding settings
Cookie wall absentContent accessible to users who rejectUsers redirected if they reject marketing cookies
Consent records storedCMP logs timestamp, version, choicesNo audit log
Re-consent after 12 monthsBanner re-presented to returning visitorsBanner set to never re-appear

These are documented enforcement actions that demonstrate the financial stakes:

Google (France, CNIL, 2022): €150 million fine. Google's cookie banner made it easier to accept cookies than to refuse them — the "Refuse All" option required additional clicks compared to "Accept All." CNIL found this violated the freely given requirement.

Facebook/Meta (France, CNIL, 2022): €60 million fine. Same issue — accepting all cookies required one click; refusing required multiple steps. Additionally, cookies were placed before consent for some user flows.

Microsoft (France, CNIL, 2023): €60 million. Bing placed advertising cookies without consent, and the consent refusal mechanism was not straightforward.

TikTok (Italy, Garante, 2023): €10 million. Analytics cookies placed before consent was obtained; banner design steered users toward acceptance.

Telepass (Italy, Garante, 2024): €500,000. Inadequate cookie banner information and no straightforward refusal mechanism.

The pattern is consistent: dark patterns that make refusal harder than acceptance, pre-loading cookies before consent, and insufficient granularity are the three most penalised issues.

Google Analytics and GDPR Compliance in 2026

Google Analytics (both Universal Analytics, now retired, and GA4) requires explicit consent in the EU. The data protection authorities of Austria, France, Denmark, and Italy have all ruled that Google Analytics used without proper consent or adequate transfer safeguards is non-compliant with GDPR.

For compliant GA4 use:

  1. Obtain consent before loading GA4: Use a GDPR-compliant CMP that blocks GA4 scripts until the user accepts analytics cookies.
  2. Enable Consent Mode v2: Google's Consent Mode v2 allows GA4 to operate in a limited mode (no personal data processing) for users who decline, and full mode for those who consent. This is mandatory for Google advertising to function optimally but does not remove the consent requirement.
  3. Configure data retention: Set GA4 data retention to the minimum needed (2 months default is fine for most use cases).
  4. Privacy-preserving alternatives: Consider self-hosted Matomo configured without cookies (using anonymised IP fingerprinting instead), which can operate without a cookie consent banner under the strictly necessary/analytics exemption in several jurisdictions.

GDPR does not specify a maximum consent duration. However, the EDPB recommends re-asking at 12-month intervals, and this has become the de facto standard. Your CMP should:

  • Store the consent date alongside the consent record
  • Re-present the banner to returning users after 12 months
  • Immediately re-present the banner if your cookie categories or data sharing partners change materially
  • Allow users to change their consent at any time via a persistent "Manage Preferences" link (not just in the footer — it must be easily discoverable)

Record-Keeping Obligations

Under Article 7(1) GDPR, you must be able to demonstrate that consent was obtained. This means your CMP must log:

  • Timestamp of consent
  • Version of the banner and privacy policy shown
  • User identifier (cookie ID, session ID — not personal data itself)
  • Specific purposes accepted and rejected
  • Consent method (which button was clicked)

Retain these records for at least 3 years. In enforcement proceedings, supervisory authorities routinely request consent audit logs. If you cannot produce them, the burden of proof shifts against you and the consent is presumed invalid.

StepAction Required
Audit your cookiesRun a cookie scanner to identify all cookies set — first and third party
Classify each cookieStrictly necessary / Functional / Analytics / Marketing
Choose a compliant CMPOneTrust, Cookiebot, Usercentrics, Axeptio, or similar IAB TCF-certified tools
Configure bannerReject as prominent as Accept; all non-necessary off by default; no pre-ticks
Block scripts until consentAnalytics and marketing scripts must not fire before consent signal
Implement GA4 Consent Mode v2Required for Google Ads + GA4 integration
Add "Manage Preferences" linkPersistent, visible at all times — not only on cookie banner appearance
Configure consent loggingEnsure CMP logs timestamp, version, choices for 3+ years
Set 12-month re-consentConfigure banner to re-appear to returning users after 12 months
Update cookie policyList all cookies by name, purpose, duration, and data controller

Generate a compliant cookie consent banner configuration for your website using our Cookie Consent Generator — it outputs ready-to-use banner text, cookie policy language, and the required data controller disclosures tailored to your website's cookie stack.