GDPR Cookie Compliance: Complete Requirements Guide

If your website sets an analytics tag, an advertising pixel, or a chat widget before a visitor agrees to it, you have a GDPR cookie compliance problem. Regulators across the EU have spent the past five years turning cookie banners into one of the most heavily enforced areas of privacy law, and the rules are far more specific than "show a notice." This guide covers what the law actually requires, how enforcement bodies interpret it, and how to audit your own site, though you should consult a qualified attorney for advice tailored to your business.

What GDPR Cookie Compliance Actually Requires

GDPR cookie compliance is the practice of obtaining freely given, specific, informed, and unambiguous consent before storing or reading any non-essential cookie or similar tracker on a user's device, and documenting that consent.

Two laws work together here. The ePrivacy Directive (2002/58/EC), amended in 2009, is the rule that governs the act of storing information on a device. Article 5(3) states that storage or access is only allowed if the subscriber "has given his or her consent, having been provided with clear and comprehensive information."

The General Data Protection Regulation (GDPR) then supplies the definition of consent. Article 4(11) defines it as "any freely given, specific, informed and unambiguous indication of the data subject's wishes." Article 7 adds the conditions: you must be able to demonstrate consent, requests must be clearly distinguishable, and withdrawal must be as easy as giving consent.

The practical consequence is that ePrivacy tells you when you need consent, and GDPR tells you what counts as consent. Failing either one exposes you to enforcement.

Cookies Are Not the Only Thing Covered

Article 5(3) is technology neutral. It applies to any storage of or access to information on terminal equipment, which includes:

• Traditional HTTP cookies, both first-party and third-party
• Local storage, session storage, and IndexedDB entries
• Pixels, tracking beacons, and script-injected tags
• Device fingerprinting techniques
• SDK identifiers in mobile apps

If your consent tool only blocks cookies but lets a fingerprinting script run, you are not compliant.

Which Cookies Need Consent Under GDPR

The only exemption in Article 5(3) covers storage that is "strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service."

The Article 29 Working Party opinion 04/2012 and later EDPB guidance interpret this narrowly. Exempt categories include:

1. Session and authentication cookies that keep a logged-in user signed in for the duration of the visit
2. Shopping cart cookies that hold items during a purchase flow
3. Load balancing and multimedia player session cookies
4. Security cookies such as CSRF tokens and fraud-detection identifiers tied to a requested feature
5. User interface customization cookies that store a language or currency choice the user actively selected

Everything else requires prior consent. That includes:

• Google Analytics, Matomo in its default configuration, and every other measurement tool
• Google Ads, Meta Pixel, LinkedIn Insight Tag, TikTok Pixel, and all remarketing tags
• Heatmaps and session recorders such as Hotjar, Clarity, and FullStory
• A/B testing and personalization tools
• Embedded YouTube, Vimeo, or social widgets that set cookies on load
• Chat widgets and support tools that track visitors beyond the active conversation

A common misconception is that first-party analytics are exempt because you are not sharing the data. They are not. Several regulators, including CNIL in France, permit a narrow exemption for strictly anonymous audience measurement configured to their published criteria, but standard Google Analytics does not meet those criteria.

The Five Conditions of Valid Cookie Consent

Under GDPR, consent for cookies must satisfy all of the following. Missing one invalidates the whole thing.

Freely given. The user must have a genuine choice. Article 7(4) says consent is not freely given if access to a service is conditional on consent to processing that is not necessary for that service. Cookie walls that block all content unless a visitor accepts tracking have been challenged repeatedly, and the EDPB's Guidelines 05/2020 on consent state that such walls generally fail the freely given test.

Specific. Consent must be granular by purpose. Bundling analytics, advertising, and personalization into one accept button is not specific consent. The user needs separate controls for each purpose category.

Informed. Before the choice is made, the user must know who is processing the data, what purposes are involved, which third parties receive it, and how to withdraw. Article 13 of the GDPR sets out the wider transparency obligation.

Unambiguous. It requires a clear affirmative action. The Court of Justice of the European Union settled this in Planet49 (Case C-673/17, October 2019): a pre-ticked checkbox is not valid consent. Neither is continued scrolling, continued browsing, or closing a banner.

Withdrawable. Article 7(3) requires that withdrawing consent be as easy as giving it. In practice this means a persistent link or floating icon that reopens the preference center from any page.

Cookie Banner Requirements Regulators Actually Enforce

The EDPB Cookie Banner Taskforce published its report in January 2023 after coordinating on more than 700 complaints filed by the privacy group noyb. The findings function as a de facto rulebook for banner design.

Practice	Regulator position
Accept button with no reject option on the first layer	Non-compliant
Reject only available after clicking "settings"	Non-compliant in most member states
Accept button styled prominently, reject rendered as faint text	Deceptive design, non-compliant
Pre-ticked purpose toggles	Invalid consent per Planet49
Cookies set before any interaction	Breach of Article 5(3) ePrivacy
"Legitimate interest" used for advertising cookies	Not available, ePrivacy requires consent
Banner that reappears on every page after refusal	Pressure tactic, undermines freely given consent

Three design rules follow directly from this:

1. Put accept all and reject all on the first layer, with equal visual weight and equal click cost.
2. Set no non-essential cookie until the user makes a choice. Blocking must happen before the tag fires, not after.
3. Store the refusal so the banner does not nag. A six-month gap before re-asking a user who declined is a defensible baseline.

GDPR Compliance for Cookies Beyond the Banner

The banner is the visible part. Enforcement actions increasingly target what sits behind it.

Prior blocking. Your consent management platform must prevent scripts from executing until consent is recorded. Many sites deploy a banner while leaving Google Tag Manager firing tags on page load. Auditors find this in seconds by loading the page with a clean profile and inspecting network requests.

Consent records. Article 7(1) requires you to demonstrate that consent was given. A defensible record includes a timestamp, the consent string or purpose set, the banner version shown, and the policy version in force. Store it for as long as the processing continues plus your limitation period.

Signal propagation. If you use Google Consent Mode or the IAB Transparency and Consent Framework, the signal must reach every downstream tag. The Belgian Data Protection Authority ruled in February 2022 that the TCF as implemented at that time did not produce valid consent, and IAB Europe has been reworking it since.

Retention limits. CNIL's guidance recommends a maximum cookie lifetime of 13 months and a 25-month cap on data derived from those cookies. It also recommends refreshing consent roughly every six months.

Change control. Every new marketing tool adds trackers. Without periodic scanning, your banner and your cookie policy drift out of sync with reality within a quarter.

What Your Cookie Policy Must Disclose

The informed condition cannot be satisfied by a banner alone, because a banner has no room for detail. A cookie policy carries the specifics, and it must be reachable from the banner before consent is given.

Include the following for each tracker:

• Name of the cookie or storage key
• Provider, including whether it is first-party or third-party and the legal entity behind it
• Purpose in plain language, not a category label
• Duration, expressed in days or months, or marked as session
• Type, such as HTTP cookie, local storage, or pixel
• Data recipients and any transfer outside the EEA

Beyond the inventory, your policy needs to explain how to withdraw consent, how to manage cookies through browser settings, the legal basis for essential cookies, and the date of the last update. A tool such as a cookie policy generator can build this table from a scan of your live site so the disclosure matches what actually runs.

Your privacy policy should reference the cookie policy rather than duplicate it. If you also serve California residents, note that the CCPA operates on an opt-out model instead, which the GDPR vs CCPA comparison covers in detail.

Third-Party Tags and International Transfers

Most cookies on a typical site belong to someone else, which creates two compounding obligations.

First, you are the controller for the decision to load that tag. In the Fashion ID case (C-40/17, July 2019), the CJEU held that a website embedding a Facebook Like button is a joint controller for the collection and transmission of visitor data. Embedding a third-party script does not outsource your responsibility.

Second, many of these providers transfer data to the United States or elsewhere. Chapter V of the GDPR governs those transfers. The EU-US Data Privacy Framework, adopted in July 2023, provides a lawful route for certified US recipients, but you still need to confirm that each vendor is certified and document the transfer mechanism for those that are not.

Practical steps:

1. Inventory every third-party domain your pages contact.
2. Check each vendor's certification status or standard contractual clauses.
3. Record the transfer basis in your Article 30 processing records.
4. Disclose the transfer in your cookie policy and privacy policy.

Penalties and Recent Enforcement

Cookie enforcement runs on two tracks. National ePrivacy implementations set their own penalty ranges, and the GDPR applies its Article 83(5) ceiling of 20 million EUR or 4 percent of global annual turnover, whichever is higher, when consent failures involve personal data processing.

France's CNIL has been the most active regulator because its national ePrivacy powers let it act without the one-stop-shop mechanism:

• Google, 150 million EUR and Facebook, 60 million EUR (December 2021), for making refusal harder than acceptance
• Google, 100 million EUR and Amazon, 35 million EUR (December 2020), for placing advertising cookies without consent
• Microsoft, 60 million EUR (December 2022), over Bing cookie practices
• Google, 325 million EUR and Shein, 150 million EUR (September 2025), the largest cookie sanctions issued to date

The pattern is consistent. None of these decisions turned on missing banners. They turned on banners that existed but made refusal harder, or on cookies dropped before the user chose. Smaller businesses rarely face nine-figure fines, but complaint-driven investigations from noyb and national authorities routinely reach ordinary websites.

A GDPR Cookie Compliance Audit You Can Run This Week

Work through this sequence on your production site, not a staging copy.

1. Scan with a clean browser profile. Open an incognito window, load your homepage, and record every cookie, storage entry, and outbound request before touching the banner. Anything non-essential appearing here is a live violation.
2. Test the reject path. Click reject all, then reload and check whether tags fire anyway. Count the clicks needed to refuse versus accept.
3. Check granularity. Confirm separate toggles exist for analytics, advertising, and personalization, and that none are pre-enabled.
4. Verify withdrawal. Find the mechanism to change your choice from an interior page. If it takes more than two clicks, fix it.
5. Reconcile the inventory. Compare the cookies your scan found against the table in your published cookie policy. Undocumented trackers are the most common finding.
6. Confirm record keeping. Pull a consent record from your CMP and check that it contains a timestamp, purposes, and banner version.
7. Schedule the recheck. Marketing adds tags continuously, so run this monthly or use automated scanning. TermsBox scans a site on a schedule and updates the hosted cookie policy when new trackers appear, which closes the drift gap that manual audits leave open.

Fix findings in order of exposure: pre-consent tracking first, then refusal friction, then documentation gaps.

Frequently Asked Questions

Which cookies are exempt from GDPR consent?

Only cookies that are strictly necessary to deliver a service the user explicitly requested are exempt under Article 5(3) of the ePrivacy Directive. That covers session identifiers, shopping cart cookies, load balancing, and security tokens. Analytics, advertising, personalization, and A/B testing cookies are never exempt.

Does GDPR require a reject all button on cookie banners?

GDPR does not name a button, but it requires that refusing consent is as easy as giving it under Article 7(3). The EDPB Cookie Banner Taskforce concluded in January 2023 that a first layer with only an accept button, or with refusal buried in a second layer, does not meet that standard. In practice you need a reject option on the first screen.

How long is cookie consent valid under GDPR?

The GDPR sets no fixed expiry, but regulators expect consent to be refreshed periodically. France's CNIL recommends renewing consent roughly every six months and limiting cookie lifetimes to 13 months, with data derived from cookies kept no longer than 25 months.

Do I need cookie consent if my business is outside the EU?

Yes, if you offer goods or services to people in the EU or monitor their behavior, GDPR applies under Article 3(2) regardless of where your company is based. Tracking EU visitors with analytics or advertising cookies counts as monitoring, so a US or UK company with EU traffic needs compliant consent.

What are the fines for GDPR cookie violations?

Cookie consent breaches are enforced through both the ePrivacy Directive, where penalties are set by each member state, and the GDPR, where fines reach 20 million EUR or 4 percent of global annual turnover under Article 83(5). France's CNIL has issued some of the largest cookie penalties, including 150 million EUR against Google and 60 million EUR against Facebook in December 2021.

Is a cookie policy the same as a privacy policy?

No. A cookie policy details the specific cookies and trackers on your site, their purpose, duration, and provider, while a privacy policy covers all personal data processing across your organization. Many sites publish both and link the cookie policy from the consent banner.