If you have spent any time on European websites in recent years, you have encountered cookie consent banners. The pop-up that appears when you first visit a site, asking you to accept, decline or manage cookies. For many users they are an annoyance. For businesses without one — or with one that does not meet the legal standard — they represent significant legal exposure.
What Are Cookies and Why Do They Matter?
Cookies are small data files stored on a visitor’s device when they access a website. Some are essential — they allow your shopping cart to remember its contents, maintain your logged-in session, or ensure the website functions correctly. Others serve different purposes: analytics cookies track visitor behaviour across your site, advertising cookies enable targeted advertising across multiple websites, and preference cookies remember your language or display settings.
The legal distinction that matters is between strictly necessary cookies and non-essential cookies. Strictly necessary cookies can be set without consent — they are required for the site to function. Every other category of cookie requires explicit, informed consent before being activated.
What Makes a Cookie Banner Legally Compliant?
This is where many businesses go wrong. Having a cookie banner is not the same as having a compliant cookie banner. The following common implementations do not meet the GDPR standard:
“By continuing to browse, you accept our cookie policy” — Continuing to browse is not active consent. This has been explicitly rejected by multiple European data protection authorities.
A banner with only an “Accept All” button — Consent must be freely given. If there is no genuine alternative to accepting, there is no genuine choice, and therefore no valid consent.
A pre-ticked acceptance box — Active consent requires the user to take an affirmative action. Pre-ticked boxes do not meet this standard under GDPR Article 7.
A banner that fires analytics before the user responds — Cookies must not be set until after consent is given. A banner that appears while analytics are already running is non-compliant regardless of how good the banner looks.
What a Compliant Banner Must Include
A GDPR-compliant cookie consent implementation requires:
- A banner that appears on first visit before any non-essential cookies are set
- Clear categorisation of cookies — at minimum: Necessary, Analytics, Marketing
- The ability to accept or decline each category independently
- An equally prominent “Reject All” or “Only Necessary” option
- A cookie policy page explaining what cookies are used and why
- A preference centre where users can update their consent at any time
- Consent records — the ability to demonstrate what each user consented to and when
What Happens When You Get It Wrong
The enforcement record is instructive. France’s CNIL has been the most active European authority in pursuing cookie consent violations, having fined organisations including Google (€150 million), Facebook (€60 million) and a publisher (€750,000) specifically for cookie consent failures. Spain’s AEPD fined Vueling Airlines €30,000 for failing to display a consent banner. A Polish retailer was fined €25,000 for not obtaining proper consent.
Beyond fines, businesses that receive enforcement notices face mandatory remediation — being required to implement compliance under regulatory supervision — and the public reputational damage of having an enforcement decision published in the authority’s public record.
The Simple Fix
For WordPress websites, implementing compliant cookie consent takes a developer approximately 2-4 hours. Recommended plugins include Complianz, CookieYes and Borlabs Cookie. For non-WordPress sites, solutions like OneTrust, Cookiebot and TrustArc integrate with any platform.
The implementation cost is a small fraction of the fine risk. More importantly, it is a one-time investment — properly implemented cookie consent continues to work without ongoing maintenance beyond periodic cookie scans when the site changes significantly.