Cookie Banners: What EU Regulators Actually Check
In 2023, EU data protection authorities compared notes on hundreds of complaints about cookie banners and agreed which practices do not produce valid consent. If you want to know what an authority will look at on your website, this is the list.
The rule behind every banner
Cookies are governed first by the ePrivacy Directive, through each country's national law. Its Article 5(3) allows storing information on, or reading it from, a user's device only if the user has given consent, having been given clear and comprehensive information about the purposes. There are two exceptions: storage or access for the sole purpose of transmitting a communication, and storage or access strictly necessary to provide a service the user explicitly requested.
Consent has the GDPR meaning: freely given, specific, informed and unambiguous, by a clear affirmative action (Article 4(11) GDPR), and it must be as easy to withdraw as to give (Article 7(3)). The Court of Justice confirmed in Planet49 (C-673/17) that a pre-ticked checkbox does not give valid consent, whether or not the information stored is personal data.
What the Cookie Banner Taskforce agreed
The EDPB set up a Cookie Banner Taskforce to coordinate the handling of a wave of complaints. Its report, adopted on 17 January 2023, sets out the common position of the national authorities on recurring practices. It is not binding on courts, and national guidance still applies, but it shows what regulators look for:
| Practice | Authorities' position |
|---|---|
| No reject option on the first layer, only "accept" and "settings" | A vast majority considered that a banner with a consent button but no refuse option on any layer is not valid consent and is an infringement |
| Pre-ticked boxes for optional purposes | Do not lead to valid consent under the GDPR (recital 32) or Article 5(3) ePrivacy |
| "Refuse" hidden as a link in the text or outside the banner, without visual support | Does not lead to valid consent |
| Button colours and contrast | No general standard; assessed case by case. A reject button whose text is virtually unreadable because of minimal contrast can be manifestly misleading |
| "Legitimate interest" claimed for cookie-based purposes | The legal basis for placing or reading cookies under Article 5(3) cannot be legitimate interests; and where valid consent was required but not obtained, the subsequent processing cannot comply with the GDPR either |
| Cookies labelled "essential" that are not strictly necessary | Website owners must be able to show that cookies classified as essential really are; preference cookies that remember the user's choices can be essential |
| No easy way to withdraw consent | Provide an easily accessible way to withdraw at any time, such as a small permanently visible icon or a link in a visible, standard place |
Test your banner: the free Cookie Consent Checker walks through 23 checks across banner design, transparency, technical implementation and legal basis.
A banner that holds up
- Equal choice on the first layer: "Accept all" and "Reject all" with the same prominence, plus a way to choose by purpose.
- Nothing optional before consent: analytics, advertising and social cookies load only after the user agrees. Check this with your browser's developer tools on a fresh visit.
- Clear purposes: say what each category does and who the third parties are, in plain language.
- No pre-ticked boxes for optional categories.
- Honest "strictly necessary" list: session, security, load balancing and consent-preference cookies; not analytics or advertising.
- Withdrawal as easy as consent: a persistent icon or footer link that reopens the settings.
- Records: keep proof of consent (what was shown, what was chosen, when) and review the cookie list whenever you add a tool.
Do you need a banner at all?
If your site only uses cookies that are strictly necessary for the service the user requested, Article 5(3) does not require consent, although you still need to inform people. Some analytics setups that avoid cookies and identifiers entirely may also avoid the consent requirement, but national authorities differ on the conditions, so check your country's guidance before relying on it.
Privacy documentation, not just a banner. Pair your banner with a privacy notice from the free Privacy Policy Generator, and document consent records with the GDPR RoPA Kit, which includes a consent record template.
Sources
- Directive 2002/58/EC (ePrivacy Directive), consolidated, Article 5(3), EUR-Lex
- EDPB: Report of the work undertaken by the Cookie Banner Taskforce (17 January 2023)
- Regulation (EU) 2016/679 (GDPR), Articles 4(11) and 7, recital 32, EUR-Lex
- Court of Justice, Case C-673/17 Planet49 (1 October 2019), CURIA
Related tools
Further reading: What a GDPR Privacy Policy Must Contain · Top GDPR Fines
ClevSec
Compliance & security tools for modern businesses
We build practical tools and templates that help startups and SMBs stay compliant with NIS2, GDPR, and DORA. Explore our free tools →
This article is for informational purposes only and does not constitute legal advice. Last updated: October 2026.