What is a cookie consent banner?

The interface that asks a visitor whether non-essential cookies may be set, and records the answer. The banner is only the visible half — valid consent also requires that nothing non-essential loaded beforehand and that the choice was stored, versioned and revocable.

Does GDPR require a reject button on the first screen?

In practice yes. Consent must be freely given, and regulators have repeatedly held that refusing has to be as easy as accepting. A first screen offering only Accept and Manage preferences puts a cost on refusal that accepting does not carry.

Are pre-ticked consent boxes allowed?

No. Consent must be an affirmative action, so every non-essential category starts switched off. This includes legitimate-interest toggles presented as on by default.

Do I still need a banner if my analytics are cookieless?

Often not for the analytics themselves. If a tool sets no cookies, stores no cross-site identifier and reports only in aggregate, there is usually nothing to consent to — but any other third party on the page is judged separately, and a privacy notice is still required.

Cookie consent banner checklist: GDPR, dark patterns, and what to verify

A banner is not consent

The banner is the interface. Consent is the record behind it — freely given, specific, informed, and revocable. A site can run a beautifully built banner and still hold no valid consent, which is why “we added a cookie banner” is not an answer to “are we compliant”.

That record has to establish four things: who consented, what they agreed to, when, and against which version of your cookie list. If you cannot produce those for a given visitor, you have a banner and nothing behind it.

The checklist

Five points, each verifiable from outside the codebase in about five minutes.

Nothing non-essential fires first. Analytics, advertising and third-party embeds must not load until a choice exists. This is the point most sites fail, because the tag was installed before the banner was.

Refusing is exactly as easy as accepting. Same screen, same click count, comparable visual weight. A prominent “Accept all” beside a muted “Manage preferences” is the standard failure.

Categories are granular and nothing is pre-ticked. Analytics, functional and marketing are separate decisions, and every non-essential toggle starts off.

Withdrawal is as easy as granting. A persistent control that reopens the choice — not an email address, not a support form.

The choice is stored and versioned. When your cookie list changes materially, consent collected against the old list no longer covers the new purpose.

The patterns that void the consent you collected

Regulators have converged on a short list, and each item turns a collected “yes” into no consent at all.

Low-contrast or buried reject buttons. Pre-ticked boxes, including legitimate-interest toggles switched on by default. Cookie walls that make refusal mean no access where no equivalent alternative is offered. Re-prompting on every page load until the visitor gives in. And consent bundled into terms acceptance, so agreeing to use the product means agreeing to be tracked.

The test underneath all of them is one sentence: if the interface makes no more expensive than yes, the yes is not freely given.

What happens to your analytics when someone declines

Two different things get called the same thing here. Consent signalling keeps the tag on the page and tells it consent was denied, so it sends cookieless pings and the vendor models the gap. Not collecting means the request never happens.

Both are defensible, they are not equivalent, and the difference surfaces in your numbers. Modelled traffic is an estimate wearing the confidence of a measurement, and in a denied-consent session it is an estimate built from very little. If you would rather have numbers you can act on than numbers that look complete, prefer measurement that never needed consent — aggregate, cookieless, no cross-site identifier — and let the declined sessions be honestly absent.

GDPR and CCPA are not the same requirement

GDPR is opt-in: no non-essential cookie before consent, and silence counts as refusal. CCPA and CPRA work closer to opt-out: collection may begin, but the visitor must be told and must be able to stop the sale or sharing of their data, which in practice covers most advertising integrations.

A banner built only for California will fail in Europe. One built for GDPR generally satisfies both, which is why it is the sensible baseline for any site taking traffic from more than one region.

Check yours in five minutes

Open the site in a private window with devtools on the network tab. Clear storage, load the page, and do nothing at all. Every third-party request that appears before you click is one you cannot justify. Then choose reject, reload, and confirm the list stays empty and the choice survived the reload.

If you would rather start from something that already passes, the free cookie consent banner generator produces a banner with the reject path, granular categories and a versioned record already in place.