GDPR Cookie Consent: Requirements, Banners, and Fines

Under GDPR, cookie consent must be a freely given, specific, informed, and unambiguous opt-in that the visitor makes through a clear affirmative action, collected before any non-essential cookie fires on their device. That standard comes from GDPR working alongside the ePrivacy Directive, and it applies to any site that offers goods or services to people in the EU or monitors their behavior, wherever the site itself is based. Get it wrong and the penalty ceiling is €20 million or 4% of global annual turnover, whichever is higher.¹

Who Has to Comply

The rules reach well beyond EU borders. A non-EU organization is in scope if it offers goods or services to people in the EU, paid or free, or if it monitors the behavior of people located in the EU.² Dropping analytics or advertising cookies on someone browsing from an EU member state is monitoring, so a U.S. site with EU visitors is subject to the same consent obligations as a French one.

The ePrivacy Directive sets out when consent is required for cookies; GDPR defines what valid consent looks like and sets the fines.³ The two operate together, and that combined framework is what supervisory authorities enforce.

What Makes Consent Valid

Article 4(11) of the GDPR breaks consent into four elements, and failing any one of them makes the consent worthless.⁴

Freely given. The visitor must have a genuine choice. Refusing cookies can’t block access, degrade the experience, or trigger a pop-up that will not go away.⁵
Specific. Each processing purpose needs its own opt-in. One “I agree” that bundles personalized ads, analytics, and social widgets together is too broad.⁵
Informed. Before choosing, the visitor must know who is collecting data, what it will be used for, and who else will receive it.
Unambiguous. A deliberate action is required: clicking a button, toggling a switch, ticking a box. Silence, scrolling, continued browsing, and closing a banner without interacting all fail this test.

Recital 32 states the point plainly: “Silence, pre-ticked boxes or inactivity should not therefore constitute consent.”⁶ The Court of Justice of the EU confirmed in 2019 that a pre-checked cookie box is not valid consent regardless of whether the underlying data is personal, and that visitors must also be told how long each cookie lasts and whether third parties can access what it collects.

Article 7(4) adds one more constraint. Consent to cookies cannot be a condition of using the service when those cookies are not needed to deliver it. You cannot make account creation depend on accepting advertising cookies, because advertising cookies aren’t necessary for the account.⁷

Opt-out models fail the same way pre-ticked boxes do. If cookies fire by default and a buried menu lets visitors turn them off, the law’s opt-in requirement has not been met.

Which Cookies Need Consent

Only one category is exempt: strictly necessary cookies, meaning cookies without which the site cannot deliver the service the visitor asked for. Keeping items in a shopping cart, maintaining a login session, and remembering the visitor’s own cookie choices all qualify. You still have to disclose these cookies exist, but you don’t need permission to set them.³

Everything else needs prior consent: advertising cookies, behavioral tracking pixels, social media widgets that call home, and most analytics tools. If a cookie profiles a visitor’s navigation or shares data with a third-party network, it must not load until the visitor opts in.

The Analytics Question

First-party analytics sit in a narrow exemption in some member states. France’s CNIL, the most active enforcer in this area, allows analytics without consent only when the cookies stay on a single site, IP addresses are anonymized, retention is capped, and the resulting statistics are fully anonymous and never cross-referenced with other data sets. As soon as analytics data feeds a profile or reaches a third party, the exemption disappears and full consent applies. Treating analytics cookies as consent-required is the safer default; meeting every condition of the exemption is technically demanding, and a single misstep breaks it.

What the Cookie Banner Must Do

Before any non-essential cookie fires, the banner (or a details page it links to) must identify the data controller, describe the purposes of each type of processing, and list the categories of third parties who will receive the data.⁸ In practice that means naming the ad networks, analytics platforms, and other partners who will get access.

The banner must also present choices clearly. An accept option and a refuse option have to sit on the same layer. The EDPB Cookie Banner Taskforce found that offering “Accept” alongside only a “Manage settings” link, with no visible refuse option, does not produce valid consent.⁹ Granular controls for individual categories (analytics, advertising, social media) belong either on that first layer or one clearly labeled click away.

Language matters too. The banner should appear in the language of the site, or detect the visitor’s language on multilingual sites. If a visitor can’t read the request, the consent isn’t informed.

Design Choices That Void Consent

Visual weight has become an enforcement target. Practices the EDPB Taskforce flagged as non-compliant include hiding the refuse option as plain text buried in a paragraph while the accept option is a prominent colored button, making the refuse button so low-contrast it’s effectively unreadable, and placing the refuse link outside the banner frame while accept sits inside it.⁹

Most European data protection authorities now expect accept and refuse to carry roughly equal visual weight: similar sizing, comparable contrast, same level of the banner. No regulation prescribes pixel specs; the principle is that design cannot push visitors toward acceptance. CNIL cited exactly this kind of steering when it fined Google €200 million against Google LLC and €125 million against Google Ireland in 2025.¹⁰

Cookie Walls

A cookie wall that blocks all content until the visitor accepts, with no other way through, fails the “freely given” test. The EDPB stated in Guidelines 05/2020 that access to services and functionality must not be made conditional on consent to cookie storage.¹¹ The “pay or consent” variation, where visitors either accept tracking or pay for an ad-free version, remains contested: some supervisory authorities have tolerated it under narrow conditions, others treat any paywall tied to refusal as coercive, and the EDPB has not issued a harmonized position.

Recording Consent and Re-Prompting

Article 7(1) puts the burden of proof on you: if you claim someone consented, you have to be able to show it.⁷ The practical standard from supervisory authority guidance is to log who consented, when, what they were told (which version of the notice was live), how they consented, and whether they later withdrew.¹²

Consent management platforms usually handle this by storing a consent token with a timestamp and a snapshot of the banner configuration. The detail organizations often miss is versioning. If you add a new ad partner or change a processing purpose, older consent records don’t cover the new activity, and visitors must be re-prompted under the updated notice.

GDPR sets no hard expiration for cookie consent, but national authorities have staked out different positions. France and Ireland recommend re-prompting no later than every six months, Germany suggests six to twelve months, Luxembourg twelve months, and Spain has accepted up to twenty-four months in some contexts. A six-month cycle is the safest default for a site reaching visitors in multiple EU countries. Beyond the calendar, event-based triggers matter more: any change to purposes, vendors, or the cookie policy requires fresh consent.

Making Withdrawal as Easy as Consent

Visitors can withdraw cookie consent at any time, and withdrawal must be as easy as granting it in the first place.⁷ The EDPB Taskforce recommends a permanently visible mechanism, such as a small floating icon or a persistent footer link that reopens the settings panel.⁹ Burying the option three clicks deep in the privacy policy doesn’t meet the standard.

Withdrawal also has to work at the technical level, not just in the interface. CNIL fined American Express €1.5 million in part because its cookies continued to read data after users had withdrawn consent.¹³ When someone revokes consent, collection has to stop immediately.

Children’s Data

When cookies process children’s personal data, Article 8 raises the bar. Anyone 16 or older can consent for themselves; below that age, consent must come from a parent or guardian.¹⁴ Member states can lower the threshold to as young as 13, and many have, so the effective age depends on where the child is. Controllers must make “reasonable efforts” to verify parental consent using available technology. A standard cookie banner shown to a 14-year-old in a country with a 16-year threshold does not produce valid consent.

What Non-Compliance Costs

Cookie consent violations sit in GDPR’s top penalty tier because they involve the basic principles for lawful processing under Articles 5, 6, and 7. Article 83(5) authorizes fines of up to €20 million or 4% of total worldwide annual turnover in the preceding financial year, whichever is higher.¹

Enforcement is now routine. CNIL’s €325 million combined fine against Google in 2025 addressed both cookie consent manipulation and unauthorized commercial prospecting.¹⁰ The American Express penalty came from dropping advertising cookies before users interacted with the banner and continuing to read cookies after consent was withdrawn.¹³ These reflect a pattern across EU supervisory authorities: cookie consent is one of the fastest ways to draw regulatory attention.

1
General Data Protection Regulation (GDPR). Art. 83 GDPR – General Conditions for Imposing Administrative Fines
2
European Data Protection Board. Guidelines 3/2018 on the Territorial Scope of the GDPR (Article 3)
3
GDPR.eu. Cookies, the GDPR, and the ePrivacy Directive
4
Information Commissioner’s Office. What Is Valid Consent
5
GDPR Info. GDPR Consent
6
DSGVO-Portal. GDPR Recital 32 – Conditions for Consent
7
General Data Protection Regulation (GDPR). Art. 7 GDPR – Conditions for Consent
8
General Data Protection Regulation (GDPR). Art. 13 GDPR – Information to Be Provided Where Personal Data Are Collected From the Data Subject
9
European Data Protection Board. Report of the Work Undertaken by the Cookie Banner Taskforce
10
CNIL. Cookies and Advertisements Inserted Between Emails – GOOGLE Fined 325 Million Euros by the CNIL
11
European Data Protection Board. Guidelines 05/2020 on Consent Under Regulation 2016/679
12
Information Commissioner’s Office. How Should We Obtain, Record and Manage Consent
13
CNIL. Cookies – AMERICAN EXPRESS Fined 1.5 Million Euros by the CNIL
14
General Data Protection Regulation (GDPR). Art. 8 GDPR – Conditions Applicable to Childs Consent in Relation to Information Society Services