# GDPR cookie consent requirements explained

> What GDPR and the ePrivacy Directive require before you set cookies: prior opt-in consent, an equal reject option, easy withdrawal and proof of consent.

Source: https://www.cookiesh.eu/blog/gdpr-cookie-consent-requirements  
Published: 2026-01-08

## Key takeaways

- In the EU, non-essential cookies such as analytics and advertising need prior, opt-in consent before they are set or read.
- The ePrivacy Directive decides when consent is needed, while the GDPR defines what valid consent looks like.
- Strictly necessary cookies, such as those that keep a login session or shopping cart working, are exempt from consent.
- Refusing cookies must be as easy as accepting them, and visitors must be able to withdraw consent at any time.
- You must be able to prove consent, so keep a record of what each visitor chose, when and on which banner version.

Under EU law, you need a visitor's prior, opt-in consent before setting or reading any cookie that is not strictly necessary to deliver the service they asked for. That consent must meet the GDPR's standard: freely given, specific, informed and unambiguous. Visitors must be able to refuse as easily as they accept, change their mind at any time, and you must be able to prove what they chose.

## Which laws govern cookies in the EU?

Two laws work together. The ePrivacy Directive decides when you need consent for a cookie, and the General Data Protection Regulation (GDPR) defines what valid consent looks like.

Article 5(3) of the ePrivacy Directive covers storing information on, or reading information from, a user's device. That includes cookies, but also local storage, tracking pixels, device identifiers and similar techniques. The rule applies whether or not the information counts as personal data.

The GDPR supplies the consent standard. Article 4(11) defines consent, and Article 7 sets the conditions for it. When cookies collect personal data, as most analytics and advertising cookies do, the GDPR also governs everything you do with that data afterward. For a closer look at how the two laws split the work, see [ePrivacy Directive vs. GDPR](/blog/eprivacy-directive-vs-gdpr).

Because the ePrivacy Directive is a directive rather than a regulation, each EU country writes it into its own national law. The core rule is the same everywhere, but regulators differ in their guidance and enforcement priorities.

## Which cookies need consent?

Any cookie or similar technology needs consent unless it is strictly necessary to provide a service the user explicitly requested, or is used only to transmit a communication. What matters is the purpose, not whether the cookie is first-party or third-party.

| Cookie purpose | Example | Consent needed? |
| --- | --- | --- |
| Authentication | Keeps a user signed in during a session | No, strictly necessary |
| Shopping cart | Remembers items added to the basket | No, strictly necessary |
| Load balancing | Routes requests to the same server | No, strictly necessary |
| Consent storage | Remembers the visitor's cookie choices | No, strictly necessary |
| Preferences | Language or display settings | Depends on whether the user explicitly chose the setting |
| Analytics | Counts visits and tracks journeys | Yes, in most cases |
| Advertising | Retargeting, conversion tracking, profiling | Yes |
| Social media embeds | Share buttons, embedded posts, pixels | Yes, when they set or read identifiers |

Two points trip people up. First, a first-party analytics cookie still needs consent in most EU countries. A few regulators accept narrow exemptions for tightly configured audience measurement, but treat that as a country-specific exception.

Second, "strictly necessary" means necessary for the service the user asked for, not necessary for your business model. Our guide to [strictly necessary cookies](/blog/strictly-necessary-cookies) covers the gray areas.

## What makes cookie consent valid?

Consent is valid only when it is freely given, specific, informed and unambiguous, and expressed through a clear affirmative action. In a cookie banner, that translates into a few concrete rules.

- **Opt-in, not opt-out.** Non-essential categories start switched off. In its Planet49 judgment (C-673/17, 2019), the Court of Justice of the EU (CJEU) held that a pre-ticked checkbox is not valid consent.
- **No implied consent.** According to the European Data Protection Board (EDPB), the body that issues joint guidance for EU regulators, scrolling or continuing to browse is not consent.
- **Granular choices.** People should be able to accept analytics while refusing marketing, rather than facing one all-or-nothing switch.
- **Real information.** Explain who sets the cookies, what they are for, how long they last and which third parties receive data.
- **Freely given.** Refusing must be as easy as accepting, and access to your site should not depend on accepting non-essential cookies.

Our [valid consent checklist](/blog/valid-consent-checklist) walks through each one.

## What does "prior" consent mean in practice?

It means nothing non-essential runs until the visitor has said yes. A banner that records a choice while analytics and ad tags have already fired on page load is not compliant, however polished it looks.

This is mostly an engineering problem. Third-party scripts, tag manager containers and embedded widgets must be held back until the relevant category is granted, and the consent state must be checked on every page view so a refusal stays a refusal.

If you use Google advertising or measurement tags for visitors in the European Economic Area (EEA), Google has also required consent mode signals since March 2024. Those signals pass the visitor's choice to Google's tags. They are a requirement of Google's own policy and do not replace the legal duty to obtain consent first.

## What else does compliance involve beyond the banner?

The banner is only the visible part. A compliant setup usually follows eight steps:

1. **Audit your site.** List every cookie, local storage key, pixel and third-party script, including those added by plugins and tag managers.
2. **Classify by purpose.** Sort each item into necessary, preferences, analytics or marketing, and remove anything you no longer use.
3. **Block before consent.** Hold every non-essential script until its category is granted.
4. **Ask clearly.** Show accept and reject options with equal prominence on the first layer, plus a way to choose per category.
5. **Document it.** Publish a cookie policy that matches what your site actually sets.
6. **Make withdrawal easy.** Under Article 7(3), withdrawing consent must be as easy as giving it, so keep a persistent link or button that reopens the settings.
7. **Keep records.** Article 7(1) requires you to be able to demonstrate consent, so log the choice, the time and the banner version shown.
8. **Repeat regularly.** Re-scan whenever you add tags, change vendors or redesign the site.

## What happens if you get it wrong?

Penalties can be significant. Under Article 83(5) of the GDPR, the most serious infringements, including breaches of the conditions for consent, can be fined up to €20 million or 4% of worldwide annual turnover, whichever is higher. Cookie violations enforced under national ePrivacy laws follow each country's own penalty rules.

Regulators have shown they will use those powers. In December 2021, France's data protection authority, the CNIL, fined Google €150 million and Facebook €60 million because refusing cookies on their sites took more effort than accepting them. Regulators can also order changes to your banner. Our analysis of [what cookie enforcement actions teach website owners](/blog/cookie-enforcement-lessons) breaks down the patterns that keep getting sanctioned.

## Bottom line

GDPR cookie consent comes down to a simple sequence: know what your site sets, block anything non-essential, ask clearly with an equal option to refuse, honor the answer on every page and keep proof. Most failures happen in the gaps between those steps, such as a tag added outside the audit or a banner that records choices without enforcing them. Tools like Cookiesh can automate cookie scanning, script blocking and consent logging, but deciding which cookies you actually need remains your call.

*This article is general information, not legal advice. For decisions about your specific situation, consult a qualified privacy professional.*

## FAQ

### Does the GDPR apply to my site if my company is outside the EU?

It can. The GDPR reaches organizations outside the EU that offer goods or services to people in the EU or monitor their behavior, and tracking visitors with cookies is a common form of monitoring. If you target EU audiences, plan for EU-style consent.

### Is a cookie banner legally required?

No law requires a banner as such. The law requires informed, prior consent for non-essential cookies, and a banner is simply the most common way to ask for it. A site that sets only strictly necessary cookies may not need a consent prompt, although it still has to explain what it uses.

### Do the consent rules cover local storage and tracking pixels?

Yes. The ePrivacy rule is about storing or accessing information on a person's device, whatever the technique. Local storage, pixels, mobile SDK identifiers and device fingerprinting are treated the same way as cookies.

### Can I use the same banner for EU and US visitors?

You can, but the rules differ. EU law requires opt-in consent before non-essential cookies, while laws such as the CCPA are built on an opt-out model. Many sites show region-specific banners so each audience gets the right choice.

## Sources

- [Regulation (EU) 2016/679 (GDPR), EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
- [Directive 2002/58/EC (ePrivacy Directive), EUR-Lex](https://eur-lex.europa.eu/eli/dir/2002/58/oj)
- [EDPB Guidelines 05/2020 on consent](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en)
- [CJEU case C-673/17 (Planet49)](https://curia.europa.eu/juris/liste.jsf?num=C-673/17)