Cookie consent is the legally required user permission a website must obtain before placing non-essential tracking cookies. Under GDPR (EU) and similar laws, that permission must be explicit, informed, freely given, and revocable. A pre-ticked box or an implied opt-in from browsing is not valid consent. Non-compliance can trigger fines up to 4% of annual global turnover or 20 million euros, whichever is higher.
Cookie consent used to be a footer link. Today it is a legal control surface that shapes how much of your traffic your analytics ever sees. Getting it right is compliance plus measurement — not one or the other.
What is cookie consent?
Cookie consent is the user's affirmative permission to have tracking cookies stored on their device. It applies to cookies that identify or profile a user across sessions — analytics, advertising, personalization, and third-party trackers. It does not apply to strictly necessary cookies like login sessions, shopping carts, or CSRF tokens.
Consent is required by:
- GDPR — European Union / European Economic Area / United Kingdom
- CCPA / CPRA — California
- LGPD — Brazil
- DPDP Act — India (2023)
- 15+ US state laws — including Virginia, Colorado, Connecticut, Utah
Under GDPR Article 4(11), consent must be freely given, specific, informed, and unambiguous. Pre-ticked checkboxes or "by continuing to browse you agree" banners fail every one of those tests. The European Data Protection Board confirmed this in its 2020 guidelines.
Why cookie consent matters
- Regulatory risk. GDPR fines can reach 4% of global annual turnover. Meta, Google, and Amazon have all been fined in the hundreds of millions.
- Trust and brand. A clear consent flow signals respect. A dark-pattern banner signals the opposite.
- Measurement accuracy. Only opted-in users appear in traditional analytics. A 55% opt-in rate means your dashboards see 55% of reality.
- Ad-platform eligibility. Google, Meta, and TikTok increasingly require verified consent before accepting conversion signals from EU traffic.
How cookie consent works
Every compliant flow follows the same four steps.
2. Present banner → Clear disclosure + Accept / Reject / Preferences buttons
3. Log consent → Store timestamp, IP, choice, banner version
4. Honor + refresh → Re-prompt on cookie policy updates or after 12 months
Consent categories
- Strictly necessary — no consent required
- Functional — language preferences, saved settings
- Analytics — GA4, Hotjar, Mixpanel
- Marketing / advertising — Meta Pixel, Google Ads, retargeting
Types of cookie consent
| Model | How consent works | Where it applies |
|---|---|---|
| Opt-in | Cookies blocked until user actively accepts | EU, UK, Brazil, most GDPR-style laws |
| Opt-out | Cookies fire by default; user can decline | California CCPA, some US states |
| Implied consent | Continuing to browse counts as consent | Not valid under GDPR — do not use |
| Granular consent | Separate toggles per category | Best practice under all frameworks |
Real cookie consent examples
1. Compliant banner with equal choices
Two same-sized buttons: Accept all and Reject all, plus a Preferences link. The French data protection authority (CNIL) fined Google €150m and Meta €60m in 2022 for making Reject harder to click than Accept.
2. Consent mode integration
A DTC brand implemented Google Consent Mode v2 so GA4 still receives modelled data from users who decline cookies. Analytics coverage rose from 52% to 88% without violating consent — statistical modelling fills the gap.
3. Consent logging for audit
A B2B SaaS records every consent event with timestamp, geo, banner version, and choice. When a regulator asked for evidence during a routine audit, the export took 90 seconds. Without logs, the same query becomes a €10,000+ legal fire drill.
Cookie consent vs privacy policy
Related but distinct compliance artefacts.
Cookie consent
- Active permission for tracking
- Delivered via banner or preference centre
- Captured before cookies fire
- Must be granular and revocable
- Logged and auditable
Privacy policy
- Static legal disclosure
- Accessible via footer link
- Describes all data handling practices
- Not a substitute for consent
- Updated when practices change
7 cookie consent best practices
- Block cookies until consent. No firing before the user chooses.
- Give Accept and Reject equal weight. Same colour, same size, same click distance. Dark patterns are increasingly fined.
- Use granular categories. Let users accept analytics but not marketing, or vice versa.
- Log every consent event. Store timestamp, choice, banner version, and IP hash.
- Re-prompt on material change. New vendor, new purpose, or 12 months elapsed — refresh consent.
- Deploy Google Consent Mode v2. Preserves modelled analytics + Google Ads signals for declined users.
- Test opt-in rate. Banner copy, position, and language all move consent rate by 10-30 points.
Many marketers show the consent banner only to EU IPs. Fine — until a Californian, a Brazilian, or an Indian user visits. Enforcement is expanding globally. Serve consent to anyone in a jurisdiction that requires it, and default to the strictest applicable law when in doubt.
Common cookie consent mistakes
- Pre-ticked boxes. Ruled invalid under GDPR — Planet49, CJEU 2019.
- Cookie walls. "Accept or leave" is coercive and not valid consent.
- Firing cookies before choice. The most common technical failure — audit with browser dev tools.
- No revoke option. GDPR requires withdrawal as easy as consent.
- Not surfacing third-party vendors. Every embedded pixel needs disclosure.
What a compliant consent banner actually does
A compliant banner does four things, and most non-compliant banners fail on the second one.
- Blocks first, asks second. No non-essential script fires before a choice is recorded, which means tags are gated rather than merely disclosed.
- Makes rejecting as easy as accepting. A one-click Accept next to a three-click Manage preferences path is the single most commonly enforced violation in the EU.
- Separates purposes. Analytics, personalization, and advertising get their own toggles, all off by default.
- Keeps a record and a way out. Proof of what each visitor consented to, plus a persistent link to change it later.
For a small business site the practical version is simpler than it sounds: use a consent management platform that supports tag blocking, keep analytics in the non-essential bucket unless it is genuinely anonymised, and stop pointing at the banner as if disclosure alone were consent.
Frequently asked questions
Yes, in most jurisdictions. GDPR (EU/EEA/UK) requires explicit opt-in consent before any non-essential cookie is placed. CCPA (California) requires opt-out disclosure. Brazil's LGPD, India's DPDP Act, and 15+ US state laws impose similar duties.
Consent must be freely given, specific, informed, and unambiguous. Pre-ticked boxes are not consent. Users must be able to refuse without penalty and withdraw consent as easily as they gave it. Non-compliance can trigger fines up to 4% of global annual turnover or 20 million euros — whichever is higher.
Strictly necessary cookies — those required for basic functionality like login sessions, security, shopping carts, and language preferences — do not require prior consent under GDPR. Everything else (analytics, marketing, personalization) does.
A consent management platform (CMP) is software that collects, stores, and manages user cookie preferences. Popular CMPs include OneTrust, Cookiebot, and Osano. They handle banner display, consent logging, and downstream tag blocking.
Users who decline cookies are excluded from analytics tracking. Studies show typical opt-in rates of 40-70% depending on region and banner design, meaning analytics can miss 30-60% of traffic. Server-side tracking and consent mode help recover measurement.
Related glossary terms
Sources
