Cookie Banners and Analytics Under GDPR: Getting Consent Right

Almost every European website shows a cookie banner, yet many of them would not survive a close look from a data protection authority. Common problems include analytics that fire before anyone clicks, "Reject" buttons hidden behind a second screen, and pre-ticked boxes. Getting cookie consent right under GDPR is not about adding a bigger pop-up. It is about controlling what your site loads and when.

This guide explains which rules apply, what valid consent looks like, how to set up analytics without cutting corners, and how to audit your own site in an afternoon.

This article is general information, not legal advice.

Which law actually requires cookie consent?

Two pieces of EU law work together here. The first is the ePrivacy Directive (Directive 2002/58/EC, as amended in 2009). Its Article 5(3) says you may only store or read information on a user's device with their consent, unless it is strictly necessary to provide a service the user has asked for. Each EU country writes this into its own national law, so details can vary.

The second is the GDPR, Regulation (EU) 2016/679. It defines what "consent" means, and that definition applies to cookies too. In the Planet49 judgment of 1 October 2019 (case C-673/17), the Court of Justice of the EU confirmed that a pre-ticked checkbox is not valid cookie consent. The Court also said the cookie rule covers any information stored on a device, whether or not it counts as personal data.

In practice, cookies, local storage, tracking pixels and device fingerprinting all fall under the same consent logic.

These rules may change. In November 2025 the European Commission proposed a "Digital Omnibus" package that includes changes to the cookie rules, such as new consent exemptions for low-risk purposes. At the time of writing it has not been adopted, so check the current status and keep following today's rules until any new law actually applies.

What does valid cookie consent look like?

Under the GDPR, consent must be freely given, specific, informed and unambiguous, given through a clear affirmative action. The European Data Protection Board spells this out in its Guidelines 05/2020 on consent. For a website, that translates into a few concrete rules:

• No pre-ticked boxes. Optional categories start switched off.
• No "consent by scrolling". The EDPB guidelines say scrolling or swiping is not a clear affirmative action.
• No cookie walls. Blocking access to your content unless visitors accept tracking generally means consent is not freely given.
• Specific purposes. Visitors should be able to accept analytics without accepting advertising, for example.
• Easy withdrawal. GDPR Article 7(3) requires withdrawing consent to be as easy as giving it. A "Cookie settings" link in your footer is the usual solution.
• Proof. You must be able to show that consent was given, so your consent tool should keep a record of choices.

Which cookies need consent and which do not?

The exemption for "strictly necessary" storage is narrower than many site owners assume. Typically exempt items include session cookies for a shopping cart or login, security and load-balancing cookies, and the cookie that remembers the visitor's consent choice itself.

Things that usually need consent include:

• Analytics and statistics tools, including Google Analytics
• Advertising and retargeting pixels (Meta, Google Ads, LinkedIn and similar)
• Embedded YouTube videos, maps and social media widgets that set their own cookies
• Heatmaps, session recording and A/B testing tools
• Third-party chat widgets that track visitors across pages

Some national regulators, such as France's CNIL, accept narrowly configured audience measurement without consent under strict conditions. This is not uniform across the EU, so check the guidance from the regulator in each country where you operate before relying on it.

How should a compliant cookie banner be designed?

In January 2023 the EDPB published a report from its cookie banner taskforce, which coordinated how national authorities assess banners. Most authorities agreed that a banner's first layer should offer a way to reject cookies, and that design tricks pushing people towards "Accept" can make consent invalid.

A fair banner usually looks like this:

1. A short, plain-language explanation of what you use and why.
2. "Accept all", "Reject all" and "Settings" options on the first screen, with equal visual weight.
3. A settings panel with categories that are off by default.
4. A link to a cookie policy that lists each tool, its purpose and its retention period.
5. A persistent link to reopen the settings at any time.

The most important part is invisible: scripts must not load until the visitor consents. A banner that looks perfect but lets Google Analytics run in the background is still a breach. Your consent tool needs to block tags, or your tag manager must be set up so that tags only fire after the matching consent signal.

Also check the banner for accessibility and speed. It should work with a keyboard and screen reader, and it should not push page content around or slow down loading. Our guide on Core Web Vitals for European e-commerce covers why badly built banners can hurt performance scores.

Google Analytics, Consent Mode and privacy-friendly alternatives

Google Analytics 4 sets cookies and sends data to Google, so in the EU it generally needs consent. Since March 2024, Google has required advertisers and measurement users with EEA traffic to pass consent signals using Consent Mode v2 if they want to keep certain advertising and audience features.

Consent Mode is a signalling system, not a legal shield. It tells Google's tags what the visitor chose. You still need a proper banner, and you still need to decide how your tags behave before consent. In "advanced" setups, tags send cookieless pings before consent, and regulators and lawyers do not all agree on whether that is acceptable. The cautious choice is the "basic" setup, where Google tags do not load at all until the visitor accepts.

Other points to consider:

• Data transfers. Sending data to US providers currently relies on the EU-US Data Privacy Framework adopted in 2023. Check its current status and whether your provider is certified.
• Server-side tagging can reduce what third parties see, but it does not remove the need for consent when you are still reading from or writing to the visitor's device.
• Privacy-focused analytics. Some tools work without cookies and keep data in the EU. They give you fewer marketing features but simpler compliance. Check with your regulator whether a specific tool can run without consent in your country.

If you are rebuilding your privacy setup more broadly, our GDPR-compliant website checklist covers privacy notices, forms and processor contracts.

How to audit your cookie setup in an afternoon

You do not need special software to spot the biggest problems. Try this:

1. Open your site in a private browser window and open the developer tools (Application/Storage and Network tabs).
2. Before clicking anything on the banner, check which cookies exist and which third-party domains the page has contacted. Anything beyond strictly necessary items is a red flag.
3. Click "Reject all", browse a few pages and check again. Nothing optional should appear.
4. Clear everything, click "Accept all" and confirm your analytics still works.
5. Look for embeds such as YouTube, Google Maps or Instagram feeds. Replace them with click-to-load placeholders or privacy-enhanced versions where possible.
6. Compare your cookie policy against what you actually found, and update it.
7. Check that the "Cookie settings" link works on every page, including on mobile.

Repeat this whenever you add a new plugin, tag or marketing tool. Many compliance problems appear months after launch, when someone pastes a new tracking snippet into the site header.

If you also serve US visitors, note that US rules mostly work on an opt-out model instead. Our guide to US privacy laws for websites explains the differences.

How HEXACODES can help

We build and maintain websites and online stores with consent handled at the code level: tags blocked until consent, fair banners, clean cookie policies and analytics that respect your visitors' choices. If your current site is a tangle of plugins and tracking snippets, we can audit it and simplify it, or move you to a faster, lighter setup.

If you need a new site, we offer a full business website starting at $30/month, built with privacy in mind from day one. See the offer or contact us to talk through your setup.

Frequently asked questions

Do I need a cookie banner if I only use Google Analytics?

In most EU countries, yes. Google Analytics sets cookies that are not strictly necessary, so you need consent before it loads. A few regulators allow tightly configured audience measurement without consent, but standard Google Analytics setups usually do not meet those conditions.

Is it enough to show a banner that says "By using this site you accept cookies"?

No. Under the GDPR and the EDPB guidelines, consent requires a clear affirmative action, and simply continuing to browse or scroll does not count. Visitors also need a real choice, which means a way to refuse that is as easy as accepting.

Does Google Consent Mode make my website GDPR compliant?

Not on its own. Consent Mode passes the visitor's choice to Google's tags, but you still need a proper consent banner, a cookie policy and correct tag behavior before consent. Think of it as one part of a compliant setup, not the whole solution.