Cookie Consent Banners: What EU Law Actually Requires

Practical guide · GDPR + ePrivacy Directive · applies to any site with EU visitors, not just EU-based businesses

Almost every freelancer or small-business site has a cookie banner. Very few are actually compliant. The rules don't come from GDPR alone — they come from the ePrivacy Directive (which governs storing or reading anything on a visitor's device, cookies included) layered together with GDPR's consent standard. Get the banner wrong and you're non-compliant even if your privacy policy is perfect.

What a compliant cookie banner must actually do

• Appear before any non-necessary cookie is set. Analytics, embedded video, and marketing pixels may not fire until the visitor has actively consented — not "by continuing to browse."
• No pre-ticked boxes. Every category other than strictly necessary cookies must default to OFF. A banner that's pre-checked "accept" for anything is not valid consent under current EDPB guidance.
• "Reject all" as easy as "Accept all." Same size, same visual weight, same number of clicks — a prominent accept button next to a buried or multi-step reject option is one of the most commonly sanctioned patterns.
• A persistent way to change the choice later — typically a "Cookie settings" link in the footer, not a one-time banner with no revisit path.
• Consent logged (timestamp + what was chosen), so you can demonstrate compliance later if asked.

Which cookies actually need consent?

Not all of them. Strictly necessary cookies (session handling, security, load balancing, remembering the visitor's cookie choice) are exempt and can be set without asking. Everything else needs opt-in:

Note: cookieless, non-tracking analytics tools that don't set a persistent identifier can sit outside the cookie banner requirement entirely (nothing is stored on the visitor's device) — but you still owe visitors a plain-language disclosure that the analytics exist, since that's a transparency question independent of the cookie/storage rule.

Do you also need a Privacy Policy or a DPA?

A cookie banner and cookie policy are one specific disclosure layered on top of your general GDPR obligations, not a replacement for them. See our GDPR Privacy Policy Checklist for Freelancers for the seven things a compliant privacy policy must state, and — if you process client data as a developer, marketer, or VA — our DPA guide for freelancers for when Article 28 requires a separate written agreement. If a cookie or any other security incident ever exposes data you shouldn't have exposed, see our guide to the first 72 hours after a data breach.

Quick self-audit

1. Load your site in a private/incognito window — does anything other than a strictly-necessary cookie get set before you click anything?
2. Is "Reject all" (or equivalent) exactly as easy to find and click as "Accept all"?
3. Are non-necessary categories off by default, with no pre-ticked boxes?
4. Is there a persistent way to change your choice later (footer link)?
5. Do you have a record of what visitors actually consented to?

If you answered "no" or "not sure" to more than one, the banner likely needs a rebuild, not a copy tweak.

Not legal advice. This guide is general information, not a substitute for advice from a qualified lawyer or data protection professional about your specific situation. NormaKit's templates are likewise informational starting points, not legal advice, and should be reviewed and adapted before use.