GDPR5 min read
The conditions for valid cookie consent under GDPR
A practical checklist of the GDPR conditions for valid cookie consent: freely given, specific, informed, unambiguous, provable and easy to withdraw.
Cookie consent is valid under the GDPR only if it is freely given, specific, informed and unambiguous, and expressed through a clear affirmative action such as clicking “Accept”. You also need to collect it before any non-essential cookie runs, make refusing as easy as accepting, let people withdraw at any time and be able to prove what each person chose. Pre-ticked boxes and “by browsing you agree” fail.
Where do the conditions for valid consent come from?
They come from two articles of the GDPR, applied to cookies through the ePrivacy Directive. Article 4(11) defines consent, and Article 7 sets the conditions you must meet.
The ePrivacy Directive requires consent for non-essential cookies but borrows its definition of consent from EU data protection law, which today means the GDPR. Our explainer on ePrivacy Directive vs. GDPR covers how that handoff works.
Two other sources shape how the conditions are read in practice. The European Data Protection Board (EDPB), which brings together the EU’s data protection regulators, has published Guidelines 05/2020 on consent. And the Court of Justice of the EU (CJEU) applied the standard directly to cookies in Planet49 (C-673/17, 2019).
What is the checklist for valid cookie consent?
Run your live banner and settings panel against these ten checks. A failure on any one of them can undermine the consent you collect.
- Prior. No non-essential cookie, pixel or script runs before the visitor makes a choice.
- Affirmative. Consent comes from a deliberate action. Pre-ticked boxes, scrolling, continued browsing and closing the banner do not count.
- Equal refusal. “Reject” sits on the same layer as “Accept”, with comparable prominence and effort.
- Granular. Each purpose, such as preferences, analytics or marketing, can be accepted or refused separately.
- Unbundled. Cookie consent is not hidden inside your terms of service or a newsletter sign-up.
- Informed. Visitors see who is asking, for which purposes, which third parties are involved and how long cookies last.
- Clear. The request uses clear and plain language and is clearly distinguishable from other matters, as Article 7(2) requires.
- Not conditional. Access to your content does not depend on accepting non-essential cookies.
- Withdrawable. Visitors can change their mind at any time, as easily as they consented, under Article 7(3).
- Provable. You can show who consented to what, when and through which banner version, as Article 7(1) requires.
The next sections unpack the four conditions in Article 4(11), which cause the most disputes, and then the record-keeping side.
What does “freely given” rule out?
Consent is not freely given if the visitor has no real choice or would be pressured or penalized for saying no. In cookie banners, that rules out three common patterns.
The first is the cookie wall. The EDPB’s consent guidelines take the view that making access to a website conditional on accepting non-essential cookies does not produce freely given consent.
The second is bundling: one switch that covers analytics, advertising and personalization at once, or cookie consent tied to accepting your terms.
The third is design pressure. A bright “Accept all” button next to a faint “Manage settings” link, or a refusal path that takes several extra clicks, nudges people toward yes. These designs are known as dark patterns, and our guide to cookie banner dark patterns lists the ones regulators target most often.
How specific and informed does consent need to be?
Specific enough that visitors know exactly which purposes they are agreeing to, and informed enough that they understand who is involved and for how long. Vague phrases such as “to improve your experience” do not meet the bar.
At minimum, tell people who you are, each purpose you are asking about, the categories of cookies involved, which third parties receive data and that they can withdraw. In Planet49, the CJEU added that users must be told how long cookies will be active and whether third parties can access them.
A layered approach works well. The first layer summarizes purposes in plain language next to the accept and reject buttons, while a second layer lists each cookie, its provider and its lifetime. Keep that second layer accurate, since an outdated vendor list leaves visitors less informed than they think.
What counts as an unambiguous affirmative action?
A deliberate act that can only mean yes, such as clicking an accept button or switching a purpose on and saving. Anything that relies on silence, inactivity or a default setting fails.
| Visitor action | Valid consent? | Why |
|---|---|---|
| Clicks “Accept all” on a clear banner | Yes | Deliberate, informed action |
| Turns on “Analytics” and saves | Yes, for analytics only | Specific to the chosen purpose |
| Leaves a pre-ticked box checked | No | Planet49: pre-ticked boxes are not consent |
| Scrolls or keeps browsing | No | Not an affirmative action under EDPB guidance |
| Closes the banner with the “X” icon | No | Dismissing a notice is not agreement |
| Accepts terms of service that mention cookies | No | Not specific or clearly distinguishable |
Treat anything other than an explicit yes as “no choice yet” and keep non-essential categories switched off until one is made.
How do you prove consent and handle withdrawal?
Article 7(1) puts the burden of proof on you, and Article 7(3) requires withdrawal to be as easy as giving consent. Both need to be designed in from the start rather than added after a complaint.
A useful consent record captures a pseudonymous consent ID, the timestamp, the choice for each purpose, the banner and policy version shown and the regional rule set applied. Avoid storing more personal data than that proof requires. Our guide to proof of consent records shows what an audit-ready log looks like.
For withdrawal, keep a persistent footer link or floating button that reopens the settings. When someone withdraws, stop the affected scripts straight away, delete the non-essential cookies you set where technically possible and pass the updated choice to any vendor that receives consent signals.
Bottom line
Valid consent is a set of conditions that all have to hold at once: prior, freely given, specific, informed, unambiguous, provable and reversible. Test the checklist against your live site rather than your design mockups, because the gaps usually show up in how tags actually behave. Tools like Cookiesh can block tagged scripts until consent and keep immutable, hash-chained consent logs, which covers the mechanical parts of this checklist.
This article is general information, not legal advice. For decisions about your specific situation, consult a qualified privacy professional.
Frequently asked questions
Can I use a cookie wall that blocks content until visitors accept?
Generally not, if accepting is the only way in. The EDPB considers that consent is not freely given when access to a service depends on accepting non-essential cookies. Some national regulators have discussed narrow alternatives, so check local guidance first.
How often should I ask visitors for consent again?
The GDPR does not set a single interval. Ask again when your purposes or vendors change materially, and follow your regulator's guidance on how long to remember both acceptance and refusal. Re-prompting people who refused on every visit can look like pressure.
Does consent collected on one domain cover my other websites?
Only if visitors were clearly told which sites and purposes the consent covers. Because consent must be specific and informed, silently reusing it across unrelated domains or brands is risky. Many organizations ask separately on each site.
Is consent still valid if my cookie list changes later?
Not automatically. If you add vendors or purposes the visitor was never told about, the original consent does not cover them. Update your banner and ask again for the new purposes.
Sources
Cookiesh Editorial Team
Privacy engineers and compliance specialists writing practical guidance on consent, cookies and data protection for product teams.
