Consentl

GDPR and ePrivacy cookie consent explained

What the GDPR and the ePrivacy Directive require from a website that uses cookies: prior consent, a real choice, easy withdrawal and proof, and how Consentl helps.

Two laws work together

The ePrivacy Directive (2002/58/EC, Article 5(3)) says a website may store or read information on a visitor's device, such as cookies, local storage or pixels, only with the visitor's consent, unless it is strictly necessary for a service the visitor asked for. The GDPR (Regulation (EU) 2016/679) defines what valid consent is and applies to the personal data that cookies collect. Each EU country has its own law implementing the ePrivacy Directive, and its authority (for example the CNIL in France or the Garante in Italy) enforces it.

Under Articles 4(11) and 7 GDPR, consent must be:

  • Freely given: refusing must be as easy as accepting, with no penalty and no cookie wall where the regulator forbids it.
  • Specific: a separate choice per purpose, such as analytics or marketing.
  • Informed: the visitor knows who sets the cookies, for what purpose and for how long.
  • Unambiguous: an active choice. Pre-ticked boxes and "by continuing to browse you accept" are not consent (Court of Justice of the EU, Planet49, C-673/17, 2019).
  • Withdrawable at any time, as easily as it was given.
  • Provable: you must be able to demonstrate that the visitor consented (Article 7(1)).

Cookies that are strictly necessary for what the visitor asked for (a shopping cart, a login session, security, remembering the consent choice itself) do not need consent. Analytics, advertising, social media embeds, A/B testing and most third-party tags do. Some authorities allow audience measurement without consent under strict conditions (for example the CNIL's exemption for configured analytics); check your authority's guidance before relying on one.

What regulators check on banners

The European Data Protection Board's cookie banner taskforce (2023) and national authorities have named practices they object to: no "Reject" button on the first layer, deceptive colours or contrast, pre-ticked categories, "legitimate interest" for tracking, trackers that start before the choice, and no easy way to withdraw. Fines for cookie violations have reached tens of millions of euros; under the GDPR the maximum is EUR 20 million or 4 % of worldwide annual turnover.

How Consentl helps

  • An opt-in banner for EU/EEA visitors with Accept all and Reject all of equal weight and a choice per category.
  • Trackers held back until consent: tags you mark on every plan, known trackers automatically on Business.
  • Google Consent Mode v2 on every plan.
  • A "Cookie settings" link for withdrawing consent at any time.
  • A pseudonymous consent log you can export to prove each choice.
  • A cookie scanner and a cookie declaration that lists what your site sets.

FAQ

Does the GDPR apply to a website outside the EU?

Yes, when it offers goods or services to people in the EU or monitors their behaviour, for example with analytics or advertising cookies (Article 3(2) GDPR).

The law sets no fixed period. Many authorities recommend asking again after about 6 to 13 months; the CNIL recommends 6 months. Consentl lets you set the consent lifetime.

It depends on the country: the EDPB considers that access conditional on accepting cookies is usually not freely given consent, and some authorities accept a paid alternative under conditions. Consentl does not offer cookie walls.

Start free Pricing

This page is general information, not legal advice. Laws and guidance change; check the current rules for your situation.

Features