Cookie Consent & GDPR Compliance
for Web Agencies

Cookie Banner Requirements

A compliant cookie banner is not just a pop-up that disappears when you click "Accept All." Here is what the law actually requires:

1. Active consent — no pre-checked boxes. Every cookie category must require an active opt-in. Dark patterns that steer users toward acceptance can invalidate consent.

2. Granular choice — not just accept/reject. Users must be able to accept some categories and reject others. Cookie walls that block access unless the user accepts all cookies are illegal.

3. Clear language for each cookie purpose. "Marketing" is not enough. Explain what each category does, what data it collects, and who the recipients are.

4. Consent recorded and stored. GDPR Article 7(1) requires you to demonstrate consent. Record: who, when, what categories, the exact banner wording, and any withdrawal.

5. Easy to change or withdraw consent. A "Cookie Preferences" link in the footer lets users review preferences at any time. Withdrawal must be as easy as giving consent.

6. Necessary cookies exemption. Cookies strictly necessary for basic functions (session, authentication, load balancing) are exempt under ePrivacy Article 5(3). Everything else requires prior consent.

Consent Fatigue Is Not an Excuse

Cookie banners are among the most complained-about web features. Users click "Accept All" without reading. Regulators know this.

Consent fatigue does not invalidate your consent mechanism. If you offer a genuine choice and document it, consent is valid even if the user did not read every line.

What DOES invalidate consent: (a) pre-checked boxes, (b) cookie walls, (c) dark patterns, (d) vague cookie descriptions, (e) no consent records.

Practical tip: set default state to reject. No cookies loaded until the user actively opts in. Give "Reject all" and "Accept all" equal visual weight.

A 7-Day Implementation Plan

A 7-day plan for implementing a compliant cookie consent system on client sites:

Day 1-2: Audit current cookies. List every cookie: domain, name, purpose, expiration, first/third party.

Day 3: Categorise. Divide into (a) strictly necessary, (b) functional, (c) analytics, (d) marketing. Be honest.

Day 4-5: Configure a CMP. Cookiebot, Complianz, or self-hosted. Set default state to off for all non-essential categories.

Day 6: Test. Incognito window. Verify only necessary cookies load before consent. Verify consent and withdrawal both work.

Day 7: Document and deploy. Consent record policy, cookie list in privacy policy, Cookie Preferences link in footer.

Do Anonymised Analytics Need Consent?

"We only use anonymised analytics, we do not need consent." This is the most common argument — and it needs careful handling.

Google Analytics, even with IP anonymization, sets a _ga cookie (Client ID). This cookie is not strictly necessary. It requires consent under both ePrivacy and GDPR.

Cookieless analytics (Plausible, Fathom, Umami — and the tracker on this site) set NO cookies. These do not require cookie consent, though they should be disclosed in your privacy policy.

For small agencies: switch to cookieless analytics for your own site and recommend it to clients. It eliminates the consent burden entirely.

Five Mistakes Regulators Spot Immediately

1. Implied consent by scrolling. "By continuing to use this site, you accept cookies" is not valid consent. You need active, affirmative consent.

2. No revisit mechanism. Without a Cookie Preferences link, users cannot withdraw consent. This is a violation.

3. Consent records not stored. If you cannot produce a timestamped record, you cannot prove consent. Most CMPs do this automatically.

4. Incomplete cookie list. An outdated or generic cookie policy undermines your consent mechanism. Audit quarterly.

5. Undisclosed third-party cookies. Google Ads, Meta Pixel, LinkedIn Insight cookies must be named individually in the banner. Hiding behind "analytics partners" invites enforcement.

Going Deeper

Our Cookie Consent & Privacy Compliance e-book includes cookie banner templates, consent record templates, privacy policy structure, and data subject request forms.

Frequently Asked Questions