Yes. If your website loads non-essential cookies, and almost every site does, from analytics to advertising to embedded video, and it can be seen by visitors in the EU or UK, the GDPR requires their consent before those cookies load. That part is settled. What trips people up is what "consent" has to look like to be valid, and the fact that the thing regulators actually enforce is not whether you show a banner. It is whether the tracking behind it really waits for the visitor to agree.
Key Takeaways
- 01Yes. Under the GDPR, together with the ePrivacy Directive, you need a visitor's opt-in consent before any non-essential cookie or tracker loads. Strictly necessary cookies are exempt.
- 02Consent has to be freely given, specific, informed, and unambiguous. Pre-ticked boxes, "by continuing you agree," and Accept-only banners do not count.
- 03Rejecting has to be as easy as accepting. In 2022, France's CNIL fined Google €150 million and Facebook €60 million for banners where Accept was one click and Reject was several.
- 04The enforcement risk is rarely a missing banner. It is a tracker that fires before consent. In our scan of 229 live sites, 78 to 83 percent fired a third-party request before anyone agreed.
- 05ConsentStack holds non-essential trackers until the visitor opts in, ships Google Consent Mode v2 by default, and records each consent so you can prove it.
Does the GDPR require cookie consent?
Yes, for non-essential cookies. Two laws work together here. The GDPR defines what valid consent is, and the ePrivacy Directive, often called the cookie law, applies that standard to anything stored on or read from a visitor's device. Together they require prior, opt-in consent before you set analytics, advertising, or other non-essential cookies and trackers. The exception is strictly necessary cookies, the ones your site genuinely cannot run without, like a login session or a shopping cart. Those do not need consent. Everything else does, and it has to wait until the visitor agrees.
What counts as valid consent
The GDPR does not just want a click. It defines consent as freely given, specific, informed, and unambiguous, given through a clear affirmative action. In practice that becomes a short checklist your banner has to satisfy.
| Requirement | What it means in practice |
|---|---|
| Consent before loading | Non-essential cookies and trackers must not load until the visitor opts in. Loading them on the first page view and asking afterward is the single most common failure. |
| Freely given | No pre-ticked boxes, no "by continuing to browse you accept," and no wall that blocks the site unless the visitor agrees. Saying no has to be a real option. |
| Specific and granular | Consent is per purpose. A visitor can accept analytics while refusing advertising, so a single Accept All button is not enough on its own. |
| Informed | Before they choose, visitors need to know what each category of cookie does and who receives the data. |
| As easy to reject as to accept | If Accept All is one click, Reject All has to be one click too, at the same level. Burying reject two menus deep is treated as invalid consent. |
| Revocable | People change their mind, so you need a visible, always-available way to reopen preferences and withdraw consent. |
| Documented | You need a record of who consented, to what, and when, so you can show it if a regulator asks. |
What regulators actually enforce
The largest cookie fines have not been about missing banners. They have been about banners that made saying no harder than saying yes. In January 2022, France's data protection regulator, the CNIL, fined Google €150 million and Facebook €60 million for exactly that. Both let a visitor accept every cookie with a single click, while refusing took several. The regulator treated that imbalance as invalid consent by itself, and gave the companies three months to add a one-click refuse option or face €100,000 a day.
Notice what those fines had in common. Neither was about the absence of a banner. Each was about a banner that discouraged the choice it pretended to offer, or that let tracking run before the choice was made. A banner that does not actually hold the trackers back is not a lighter form of compliance. It is the violation.
The courts got there even earlier. In the 2019 Planet49 case, the EU's Court of Justice ruled that a pre-ticked consent box is not valid consent. Silence, a box the visitor has to untick, or the mere act of continuing to browse does not count. Consent has to be an active yes.
This is worth checking on your own site rather than assuming, because tracking before consent is the norm, not the exception. For our state of cookie compliance study we scanned 229 live websites and watched what loaded before the visitor touched anything. Between 78 and 83 percent of them fired a third-party request before any consent was given, which is the exact thing the GDPR forbids. And having a consent tool did not save them: of the sites running a recognized consent platform, 84 percent still failed a basic EU consent test. The banner was there. The blocking behind it was not. This is a plain-language summary rather than legal advice, so check anything load-bearing with your own counsel.
The GDPR and California are not the same job
If you have visitors on both sides of the Atlantic, you cannot run one banner design for both. The GDPR is an opt-in regime: nothing non-essential loads until the visitor agrees. California and the other US state laws are opt-out: tracking may load by default, but you have to disclose it and give people a working way to switch it off. A banner built for one is usually wrong for the other.
| Question | GDPR (EU and UK) | CCPA and CPRA (California) |
|---|---|---|
| Can trackers load before the visitor chooses? | No | Yes |
| What does the visitor do? | Opts in | Opts out |
| Is a banner required? | In practice, yes | No, but a notice and an opt-out are |
| Must browser signals be honored? | Not required | Yes, GPC must be honored |
| Penalty ceiling | Up to €20 million or 4% of global annual turnover | $2,663 per violation, $7,988 if intentional |
We cover the US side in our CCPA cookie consent requirements guide. The short version is that a banner tuned for Europe usually breaks the rules in California, and the reverse is true too.
How ConsentStack meets the GDPR standard
ConsentStack is built so the blocking behind the banner actually holds. Non-essential cookies and trackers are held before they load and stay held until the visitor opts in, so nothing fires ahead of consent. Choices are collected per purpose, so a visitor can accept analytics and decline advertising, and the right model is applied per region from a single install: opt-in for a visitor in Berlin, opt-out for one in Los Angeles, with no second setup to maintain. For Google's tools it ships Consent Mode v2 by default, keeping ad and analytics storage denied until the visitor agrees. Every decision is recorded, so if a regulator asks you can show who consented, to what, and when. And when someone clicks Reject, the scripts actually stay off, which is the part 84 percent of consent-tool sites were getting wrong. Plans start at $29 a month, and if you would rather not touch the configuration, we set it up for you.
See what loads before your visitors consent
Before you change anything, find out where you actually stand. Run your domain through our free compliance scanner and it will show you which trackers fire on page load, before any consent, and which keep going after someone clicks Reject, checked from both an EU and a US vantage point. It takes about a minute and does not ask for an email. If tracking is firing before your visitors agree, this is the fastest way to see it.
GDPR cookie consent FAQ
Yes, for non-essential cookies. The GDPR and the ePrivacy Directive together require prior, opt-in consent before analytics, advertising, or other non-essential cookies load. Strictly necessary cookies, like a login session or a shopping cart, are exempt. Everything else has to wait until the visitor agrees.
Consent must be freely given, specific, informed, and unambiguous, and given by a clear affirmative action. In practice that means no cookies before opt-in, no pre-ticked boxes, granular choice per purpose, clear information up front, rejecting as easy as accepting, an always-available way to withdraw, and a record of each consent.
Yes. The GDPR requires prior consent, so non-essential cookies and trackers must not load until the visitor opts in. Setting them on the first page view and asking afterward is the most common violation, and the one regulators look for.
No. Pre-ticked boxes, "by continuing you accept," and continued scrolling do not count. In the Planet49 case the EU's Court of Justice confirmed that valid consent needs an active, affirmative choice, not the absence of an objection.
Only strictly necessary ones: cookies your site cannot function without, such as login sessions, shopping carts, security, and load balancing. Analytics and advertising cookies are not exempt, including first-party analytics like Google Analytics.
The GDPR itself allows fines up to €20 million or 4% of global annual turnover, whichever is higher. National regulators also enforce the ePrivacy cookie rules directly: in 2022 France's CNIL fined Google €150 million and Facebook €60 million for making cookies harder to refuse than to accept.
See what loads before your visitors consent
Run a free compliance scan and see exactly which trackers fire before anyone clicks accept, and which keep going after Reject. No signup.
Related Posts
CCPA Cookie Consent Requirements: What California Actually Requires (2026)
No, the CCPA does not require a cookie banner. It requires a notice, a working opt-out, and honoring Global Privacy Control. Here is what California actually enforces, and where sites fail it.
Is Google Analytics GDPR Compliant? (2026)
Not by default. GA4 can be used lawfully in the EU, but only if you get consent before it fires, run Consent Mode v2, accept Google's data terms, and rely on the Data Privacy Framework. Here is the full checklist, and the one step most sites get wrong.
How Cookie Consent Script Blocking Works (And What Every CMP's Blocking Attribute Does)
Every consent platform blocks scripts the same basic way: it neutralizes the tag, then labels it with a category. Here is the exact syntax for each major CMP, and why hand-marking scripts keeps leaking.