# GDPR cookie consent requirements for websites · Consentl

> What the GDPR and the ePrivacy Directive require from a website that uses cookies: prior consent, a real choice, easy withdrawal and proof, and how Consentl helps.

Source: https://consentl.com/laws/gdpr

# GDPR and ePrivacy cookie consent explained

What the GDPR and the ePrivacy Directive require from a website that uses cookies: prior consent, a real choice, easy withdrawal and proof, and how Consentl helps.

## Two laws work together

The **ePrivacy Directive** (2002/58/EC, Article 5(3)) says a website may store or read information on a visitor's device, such as cookies, local storage or pixels, only with the visitor's consent, unless it is strictly necessary for a service the visitor asked for. The **GDPR** (Regulation (EU) 2016/679) defines what valid consent is and applies to the personal data that cookies collect. Each EU country has its own law implementing the ePrivacy Directive, and its authority (for example the CNIL in France or the Garante in Italy) enforces it.

## What valid consent looks like

Under Articles 4(11) and 7 GDPR, consent must be:

-   **Freely given**: refusing must be as easy as accepting, with no penalty and no cookie wall where the regulator forbids it.
-   **Specific**: a separate choice per purpose, such as analytics or marketing.
-   **Informed**: the visitor knows who sets the cookies, for what purpose and for how long.
-   **Unambiguous**: an active choice. Pre-ticked boxes and "by continuing to browse you accept" are not consent (Court of Justice of the EU, *Planet49*, C-673/17, 2019).
-   **Withdrawable** at any time, as easily as it was given.
-   **Provable**: you must be able to demonstrate that the visitor consented (Article 7(1)).

## Which cookies need consent

Cookies that are strictly necessary for what the visitor asked for (a shopping cart, a login session, security, remembering the consent choice itself) do not need consent. Analytics, advertising, social media embeds, A/B testing and most third-party tags do. Some authorities allow audience measurement without consent under strict conditions (for example the CNIL's exemption for configured analytics); check your authority's guidance before relying on one.

## What regulators check on banners

The European Data Protection Board's cookie banner taskforce (2023) and national authorities have named practices they object to: no "Reject" button on the first layer, deceptive colours or contrast, pre-ticked categories, "legitimate interest" for tracking, trackers that start before the choice, and no easy way to withdraw. Fines for cookie violations have reached tens of millions of euros; under the GDPR the maximum is EUR 20 million or 4 % of worldwide annual turnover.

## How Consentl helps

-   An opt-in banner for EU/EEA visitors with **Accept all** and **Reject all** of equal weight and a choice per category.
-   Trackers held back until consent: tags you mark on every plan, known trackers automatically on Business.
-   **Google Consent Mode v2** on every plan.
-   A **"Cookie settings"** link for withdrawing consent at any time.
-   A pseudonymous **consent log** you can export to prove each choice.
-   A **cookie scanner** and a cookie declaration that lists what your site sets.

## FAQ

### Does the GDPR apply to a website outside the EU?

Yes, when it offers goods or services to people in the EU or monitors their behaviour, for example with analytics or advertising cookies (Article 3(2) GDPR).

### How long does cookie consent last?

The law sets no fixed period. Many authorities recommend asking again after about 6 to 13 months; the CNIL recommends 6 months. Consentl lets you set the consent lifetime.

### Can I use a cookie wall?

It depends on the country: the EDPB considers that access conditional on accepting cookies is usually not freely given consent, and some authorities accept a paid alternative under conditions. Consentl does not offer cookie walls.

[Start free](https://app.consentl.com/signup) [Pricing](https://consentl.com/pricing)

This page is general information, not legal advice. Laws and guidance change; check the current rules for your situation.

## Privacy laws

-   [UK GDPR and PECR](https://consentl.com/laws/uk-gdpr)
-   [CCPA, CPRA and US states](https://consentl.com/laws/ccpa)
-   [LGPD (Brazil)](https://consentl.com/laws/lgpd)
-   [PIPEDA and Quebec Law 25](https://consentl.com/laws/pipeda)

## Features

-   [Cookie banner](https://consentl.com/features/cookie-banner)
-   [Cookie scanner](https://consentl.com/features/cookie-scanner)
-   [Google Consent Mode v2](https://consentl.com/features/google-consent-mode)
-   [Script blocking](https://consentl.com/features/script-blocking)
-   [Consent log](https://consentl.com/features/consent-log)
-   [Privacy requests](https://consentl.com/features/privacy-requests)