GDPR-compliant cookie consent - a practical guide for 2026
Valid cookie consent is the foundation of lawful marketing and analytics. The GDPR defines it as a freely given, specific, informed and unambiguous indication of the user's wishes. In practice, most banners on the web still fail these conditions. Here is how to get it right.
1. Equal "Accept" and "Reject" buttons
The EDPB guidelines and the enforcement practice of supervisory authorities (the French CNIL among them) agree: rejecting cookies must be as easy as accepting them. The "Reject" button belongs on the first layer of the banner, styled identically to "Accept". Hiding the refusal in "advanced settings" is a classic dark pattern that invalidates the consent.
2. No pre-ticked boxes
The CJEU's Planet49 judgment (C-673/17) settled it: pre-ticked checkboxes are not consent. All optional categories - functional, analytics, marketing - must start off, and only the "necessary" category may work without consent.
3. Block scripts until the user decides
The most common technical mistake: the banner is showing while Google Analytics and the ad pixel are already collecting data. Consent must be prior - marketing and analytics scripts may only run after "Accept" is clicked. A good CMP blocks them automatically (auto-blocking) and releases exactly the categories the user agreed to.
4. Information - the "informed" in informed consent
The user must know what they are agreeing to: which cookie categories, for what purposes, who the controller is and how to withdraw consent. The banner should link to a privacy or cookie policy with the full cookie list - ideally generated from a scanner, so it never drifts from reality.
5. Withdrawing consent as easily as giving it
The GDPR (art. 7(3)) requires that consent can be withdrawn as easily as it was given. The proven pattern is a persistent floating widget that reopens the preference center on click. ePrivacy rules across the EU also prohibit nagging a user again about a consent they have knowingly refused.
6. A consent register - accountability
The accountability principle (art. 5(2) GDPR) means you must be able to prove that consent was given: when, for which banner version and for which categories. A consent register with an identifier, a timestamp and the banner revision is the first thing an authority asks for during an audit.
A compliant banner checklist
- "Accept" and "Reject" side by side, same style
- optional categories off by default
- scripts blocked until consent
- a link to a cookie policy with a current cookie list
- a reopen widget for the preference center
- a consent register with proof
CookieFox ticks every box on this list out of the box - the "Reject" button cannot even be hidden, because the banner's architecture forbids it. Try it for free.
Starting from scratch? First read what cookies are, then check how to choose a CMP.