Skip to content

Language

GDPR + ePrivacy

GDPR cookie consent, settled before the first tag fires

Cookiesh blocks every non-essential cookie until EU and UK visitors opt in, gives them a reject button as prominent as accept, and keeps proof of each choice that holds up in an audit.

Start free trialTalk to sales

At a glance

Applies to
Any site with visitors in the EU or EEA, wherever the business is based
Consent model
Opt-in before non-essential cookies are set or read
Maximum fine
€20 million or 4% of worldwide annual turnover
Enforced by
National data protection authorities, such as the CNIL and the Garante

Requirements

What you need to get right

  1. Prior consent

    Analytics, advertising and other non-essential cookies may not be set or read until the visitor has actively agreed. Loading tags first and asking afterwards is not consent.

    How Cookiesh handles it: Known trackers are blocked automatically, your own scripts wait behind data-cookiesh, and Google tags start with every Consent Mode signal set to denied.

  2. Rejecting is as easy as accepting

    Regulators expect a reject option on the first layer, as visible and as easy to use as accept. Pre-ticked boxes and "by continuing to browse" banners do not produce valid consent.

    How Cookiesh handles it: EU opt-in banners always show Reject all next to Accept all, with the same size and weight. This cannot be turned off.

  3. Granular and specific

    Visitors must be able to agree to some purposes and refuse others. One blanket "accept" for every purpose is not specific consent.

    How Cookiesh handles it: Four clear categories, with per-category toggles and a full cookie declaration in the preference center.

  4. Informed

    Before choosing, visitors need to know who sets the cookies, what for and for how long.

    How Cookiesh handles it: The cookie scanner fills in each cookie's provider, purpose and lifetime, and keeps the declaration up to date on every scan.

  5. Withdrawal at any time

    Withdrawing consent must be as easy as giving it, and must stop the processing it covered.

    How Cookiesh handles it: A footer link or floating button reopens the preference center. Withdrawing a category deletes the first-party cookies Cookiesh knows belong to it.

  6. Proof of consent

    Article 7(1) puts the burden of proof on you: you must be able to show that each visitor consented, and to what.

    How Cookiesh handles it: Every choice is stored with its timestamp, region and banner version in an append-only, hash-chained log you can export at any time.

Setup

Compliant in three steps

  1. Scan your site

    Enter your domain. Cookiesh finds every cookie, storage key and third-party script, and classifies them into categories.

  2. Turn on the EU rule

    The opt-in rule for the EU, EEA, UK and Switzerland is on by default. Adjust the banner copy and match it to your brand.

  3. Install and verify

    Add one script tag, then open your site in a private window and run Cookiesh.debug() to confirm nothing runs before consent.

In depth

Which laws govern cookies in the EU?

Two laws work together. Article 5(3) of the ePrivacy Directive decides when you need consent: for storing or reading any information on a visitor’s device, unless it is strictly necessary for a service the visitor asked for. The GDPR decides what valid consent looks like: freely given, specific, informed and unambiguous, given by a clear affirmative action.

Each EU country implements the ePrivacy Directive in its own law, and its data protection authority enforces it. That is why guidance differs in the details, such as whether some audience measurement is exempt, while the core rule is the same everywhere: no non-essential cookies before opt-in.

What did the courts and regulators add?

In Planet49 (2019), the EU Court of Justice ruled that a pre-ticked checkbox is not valid consent, and that the rule covers all information stored on a device, whether it is personal data or not. The European Data Protection Board’s consent guidelines add that scrolling or continuing to browse is not consent, and that withdrawing consent must be as easy as giving it.

Regulators have since focused on banner design. Several have fined companies for hiding the reject option behind a second click, which is why Cookiesh’s opt-in banners always put Reject all on the first layer.

What about the UK and Switzerland?

The UK applies the same model through the UK GDPR and the Privacy and Electronic Communications Regulations (PECR). The Data (Use and Access) Act 2025 relaxes consent for some low-risk purposes, such as certain analytics, as long as visitors are told and can object. Switzerland’s revised data protection act does not require opt-in for every cookie, but many Swiss sites follow EU practice because they also serve EU visitors. Cookiesh’s default rules treat both countries like the EU, and you can change that per region.

Sources

This page is general information, not legal advice. Laws and regulator guidance change, so review your setup with your legal team.

FAQ

Common questions

Does the GDPR apply if my company is outside the EU?

It can. The GDPR applies to organizations outside the EU that offer goods or services to people in the EU or monitor their behavior, and tracking visitors with cookies is a common form of monitoring.

Do I need consent for first-party analytics?

In most EU countries, yes: the ePrivacy rules require consent for any cookie that is not strictly necessary, wherever it comes from. Some regulators, such as the CNIL, exempt narrowly configured audience measurement, so check your national authority's guidance.

Is a cookie wall allowed?

Blocking access unless the visitor accepts tracking is generally not considered freely given consent. Some authorities accept a genuine alternative, such as a paid option without tracking, but the rules vary by country and are under review.

Does Cookiesh make my site GDPR compliant?

Cookiesh gives you the technical controls the GDPR and ePrivacy rules expect for cookies. Compliance also depends on your privacy policy, your contracts with vendors and how you use the data, so review your setup with your legal team.

Related guides

Ship compliant cookie banners in minutes, not sprints

Start free on one domain. Upgrade when you need more domains, geo-targeting or custom branding.

Start free trialTalk to sales

No credit card required · Cancel anytime