Introduction
Cookie consent is the user's affirmative choice to allow non-essential cookies and similar technologies on their device. It is not a notice that tracking will happen anyway, and it is not implied by scrolling or by pre-checked boxes in settings.
Valid consent under EU law must be freely given, specific, informed, and unambiguous. That means your banner explains what categories do, Accept and Reject are equally available, and no analytics or ad tags run until the user opts in—unless a narrow strictly-necessary exception applies.
Many sites display a banner but still load trackers on first paint. That gap between UI and behavior is why scanners flag sites and why regulators issue fines. This guide defines consent as something your engineering stack must enforce, not only your legal text.
What it means
Prior consent comes before storage or access. When a new visitor loads your homepage, strictly necessary cookies may be set, but analytics, advertising, heatmaps, and social embeds should wait. Tag Manager containers that fire on All Pages without a consent trigger violate this principle even if a banner is visible.
Granularity lets users choose categories—analytics separate from marketing, for example. A single Accept all button can be lawful if Reject all is equally easy and users can open preferences to toggle categories. Bundling unrelated purposes into one forced choice weakens validity.
Informed consent requires plain language about purposes and vendors. Linking to a cookie policy with a table of names, providers, lifetimes, and purposes supports transparency. Vague labels like Functional for advertising trackers mislead users and attract enforcement attention.
Withdrawal must be as easy as giving consent. Provide a persistent privacy or cookie settings entry point—often a footer link or floating icon—so users can change minds without hunting through nested menus.
Records matter for accountability. You should be able to show what choice was made and when, especially if a user disputes marketing contact or requests erasure. Consent logs tie your CMP to downstream ad and analytics systems.
Why it matters
Invalid consent taints every downstream process. If marketing cookies fired before opt-in, subsequent Accept clicks do not retroactively legalize earlier processing. You may need to delete data collected during that window.
Platforms like Google Ads and Meta increasingly expect Consent Mode or equivalent signals tied to real user choices. Cosmetic banners without enforcement produce both legal risk and unreliable attribution.
Users compare your site to others in your industry. Dark patterns may lift short-term acceptance rates but increase complaints, churn, and negative press when NGOs publish sweep results.
Common mistakes
- Showing a banner while GTM loads GA4 on Consent Initialization default granted.
- Using cookie walls that deny access unless users accept marketing.
- Pre-enabling analytics in the preference center before the user opens it.
- Treating Dismiss or Close as consent.
- Reloading the page with all tags after Reject because defaults were never changed.
- Syncing consent to ad tags but not to server-side endpoints.
- Never refreshing consent when adding new vendors to the container.
Practical checklist
- Audit first-visit behavior in a private browser with no prior cookies.
- Default all non-essential categories to off until opt-in.
- Wire GTM triggers to consent state, not only the banner UI.
- Offer Reject all at the same level as Accept all.
- Publish a cookie policy aligned with live behavior.
- Add a footer link to reopen preferences.
- Log consent decisions with timestamp and policy version.
- Re-scan after every container publish.
How GDPRChecker helps
GDPRChecker combines a customizable consent banner with runtime enforcement. Categories you configure in the dashboard map to blocking rules that prevent scripts from executing until the matching consent is stored.
The public scanner and in-dashboard compliance report show whether consent UI is detected and whether trackers still fire pre-consent—closing the loop between what your banner promises and what your page actually does.
Setup verification walks you through publishing the banner, installing runtime-guard.js before marketing tags, and confirming heartbeat signals so consent and blocking stay aligned after CMS or GTM changes.