Cookie banner requirements and examples

A cookie banner is the notice a website shows on a first visit, telling people the site uses cookies or similar tracking and asking permission where the law requires it. Most banners offer accept, reject, and a preferences option, and the site stores the choice so it can honor it on every later page view.

Say what your site actually does: name the kinds of cookies you use, what each is for, and what happens when someone accepts or rejects. Link to your privacy or cookie policy for the details. Skip vague lines like “we value your privacy”. Under opt-in laws such as the GDPR, purposes must be stated before consent is collected.

It can be, and it depends on where your visitors live rather than where your business is based. Setting non-essential cookies for visitors in the EU, UK, or other opt-in jurisdictions without consent violates rules like the GDPR and national ePrivacy laws. Many US states use an opt-out model instead. Sites that set only strictly necessary cookies generally do not need a banner.

By layout, most banners are full-width bars, corner cards, or center modals. By consent model, they are opt-in (tracking waits for consent, the standard under the GDPR), notice-only (they inform without asking), or opt-out (tracking runs until the visitor declines, common under US state laws like the CCPA). The gallery above groups 28 examples by style, from minimal to brutalist and glass.

Start from a placement that keeps your content readable: a bottom bar or corner card suits most sites, while a center modal forces a decision before browsing. Match your brand's colors and typography, keep the copy short, and give accept and reject equal visual weight, since regulators treat buried reject buttons and pre-ticked boxes as non-compliant. Test the result on mobile before shipping.

Most cookie banner mistakes fall into three groups: the banner pressures the choice, it is hard to use, or the site ignores the answer it was given. The third group is the most common and the hardest to spot, because the banner itself looks fine. On 229 sites we scanned, 78% to 83% loaded tracking that needs consent before the visitor chose anything.

1. Tracking that starts before anyone chooses. The most common mistake has nothing to do with how the banner looks. Across the 229 sites that ran our scanner, 78% to 83% sent a third-party request that needs consent before the visitor answered. On a control group of the web's most-visited sites, it was 75%.
2. Recording the choice, then ignoring it. The banner saves a reject and the analytics and advertising tags load anyway. Across 949 sites with a working reject button, 43.4% of tracking cookies were still in the browser afterwards, and 97.5% of those had been set before the visitor answered. An independent study of 200 sites (arXiv 2411.15414) found 57.5% did not delete cookies after consent was withdrawn.
3. Making accept easier than reject. A large “Accept all” next to a small “Manage preferences” link, or reject buried two clicks deep. This is the dark pattern regulators cite most often, because an unequal choice is not a real choice.
4. Pre-ticked boxes. Analytics or marketing already switched on when the banner appears. Consent has to be something a visitor gives, not something they forget to take away.
5. Calling everything essential. Only the cookies your site cannot work without belong in that group, such as login sessions and cart state. Analytics, advertising and personalization do not.
6. Vague copy. “We value your privacy” tells nobody anything. Name the categories you use, say what each one is for, and say what changes when someone declines.
7. No way to change the answer later. People should be able to reopen the choice and withdraw consent without hunting through a policy page for it.
8. Treating a close, a scroll, or an X as agreement. Dismissing a banner is not consenting to anything, and the effect of every button should be obvious before it is clicked.
9. A banner that only really works on a desktop. Full-screen takeovers on phones, buttons too small to hit, and controls a keyboard or screen reader cannot reach all turn a consent choice into a trap.

The first two are the ones you cannot catch by looking at the banner. Scan your site to see which trackers fire before consent and which survive a reject.