The GDPR requires opt-in consent before non-essential cookies and tracking fire for visitors in the EU and UK, and rejecting must be exactly as easy as accepting. Consent must be freely given, specific, informed, and unambiguous, which means tracking stays blocked until the visitor actively agrees, with no pre-ticked boxes and no penalty for saying no.
This page covers the consent slice of the GDPR, which is where websites most often get it wrong. For how GDPR fits alongside California’s laws, start with website privacy compliance.
| Key Point | What It Means for You |
|---|---|
| Opt-in first | Non-essential tracking must be blocked until the visitor agrees. Loading first and asking later is the violation. |
| Reject as easy as accept | A visible reject option at the same level as accept. Burying it in settings fails the standard. |
| Granular choices | Consent by purpose, such as analytics and advertising, not one bundled yes. |
| Easy withdrawal | Visitors can change their mind as easily as they consented, at any time. |
| Provable records | You can show who consented, to what, and when. |
What does the GDPR require for cookie consent?
Cookie rules in Europe come from two sources working together. The ePrivacy rules require consent before non-essential cookies and similar technologies are stored or read. The GDPR defines what valid consent means. In practice, the combined requirements for your website are:
- Block non-essential cookies, pixels, and tracking scripts until the visitor agrees
- Present accept and reject with equal prominence on the first layer of the banner
- Offer granular consent by purpose, with nothing pre-selected
- Name the tools and third parties involved in plain language
- Provide withdrawal that is as easy as the original consent
- Keep records that prove each consent: what was shown, what was chosen, and when
Strictly necessary cookies, the ones required for the site to function, are exempt from consent. Analytics and advertising are not strictly necessary, and treating them as if they were is one of the most common mistakes.
What happens if you are not compliant?
The GDPR is enforced by data protection authorities in each member state, and the UK enforces its own mirror of the regulation. Fines can reach €20 million or 4% of global annual revenue, whichever is higher. Cookie consent has been a repeated enforcement theme, including penalties against major platforms for making rejection harder than acceptance.
Enforcement is not the only exposure. Consent collected improperly is invalid, which means the tracking that ran on it was unlawful processing from the start. Every downstream use of that data inherits the problem.
What are the common cookie consent failures?
- Tracking before the banner. Scripts fire on page load, in the moments before the consent tool initializes. Consent given afterward does not cure it.
- Signals treated as blocking. Tools like Google Consent Mode send a consent signal, but a denied signal is not the same as a script prevented from loading. Some tags still load and transmit.
- Hidden or unequal reject. Accept is a bright button and reject is a link inside a settings panel. Regulators have treated this asymmetry as invalid consent.
- Hardcoded scripts. Tags placed directly in the page template never receive the consent decision at all.
- No working withdrawal. The banner disappears after the first choice and there is no way to change it.
- An inaccessible banner. Visitors who cannot operate the interface cannot consent or refuse, which undermines every consent the banner claims to collect.
Why is an inaccessible cookie banner a GDPR problem?
Valid consent under the GDPR must be freely given, specific, informed, and unambiguous. Every one of those words assumes the visitor could actually use the interface. A banner that keyboard users cannot reach, that screen readers never announce, or that offers buttons too low in contrast to perceive does not collect an informed, unambiguous choice from those visitors. It collects nothing, or worse, it defaults them into tracking they never agreed to.
This makes WCAG conformance a consent-validity issue, not just an accessibility obligation. A banner that conforms to WCAG 2.1 AA and WCAG 2.2 AA, keyboard operable, properly announced, with managed focus and adequate contrast, is a banner whose consents you can actually stand behind. The implementation details live on our cookie banner page.
What are the essentials for GDPR cookie consent?
- Inventory every cookie, pixel, and tracking script on your site, including tags loaded by other tags
- Classify what is strictly necessary and what requires consent
- Implement blocking so non-essential tracking cannot load before agreement
- Design the banner with equal accept and reject, granular purposes, and plain language
- Confirm the banner conforms to WCAG 2.1 AA as rendered on your site
- Provide a persistent way to withdraw or change consent
- Verify with testing that rejection and withdrawal genuinely stop tracking, and keep records
Note the contrast with California: the GDPR is opt-in before tracking, while the CCPA is notice plus a working opt-out. Sites with both audiences need both behaviors, served to the right visitors. The California side is covered on our CCPA page.
How do the app and services address GDPR consent?
The app
Our consent app, available for Shopify, WordPress, and as a general script for all other sites, serves EU and UK visitors an opt-in banner that blocks non-essential tracking until they choose. Accept and reject sit at the same level, purposes are granular, withdrawal is always available, and every consent is recorded. The banner and preference center conform to WCAG 2.1 AA and WCAG 2.2 AA, keyboard navigable and screen reader supported, so the consent collected is consent every visitor could actually give.
The services
We implement the setup on your site and then conduct manual verification testing of the paths the GDPR actually cares about: what loads before any choice, what loads after reject, and what stops after withdrawal, checked in the network rather than assumed from the banner. We also test the banner’s accessibility as rendered in your theme, provide privacy policy and cookie policy language that accurately reflects your tracking, preserve the recorded evidence, and give you guidance for keeping consent compliant as tags change.
Frequently asked questions
Does GDPR apply to a US company?
Yes, if your site offers goods or services to people in the EU or monitors their behavior. Physical presence in Europe is not required. Tracking EU visitors is monitoring.
Do I need consent for analytics cookies?
Generally yes. Analytics is not strictly necessary for the site to function, so it needs prior consent in most EU jurisdictions, however useful it is to you.
Is Google Consent Mode enough for GDPR compliance?
Not by itself. Consent Mode communicates the visitor’s choice to Google tags. It does not block every script, and tags outside its reach need separate blocking. Verification testing shows what actually loads.
Can I use a cookie wall that requires acceptance to enter?
Forcing consent as the price of entry conflicts with freely given consent, and European regulators have repeatedly found cookie walls invalid. Offer a genuine choice.
Where to start
- Inventory your tracking and separate strictly necessary from everything else
- Implement opt-in blocking for EU and UK visitors with equal accept and reject
- Confirm the banner conforms to WCAG 2.1 AA as rendered on your site
- Verify with recorded testing that reject and withdrawal stop tracking
- Keep consent records and retest when your tags or theme change
