What is a cookie banner?
A cookie banner (also called a cookie consent banner, cookie notice or consent pop-up) is the message a website displays on the first visit to inform people about cookies and similar trackers and to collect their choice. It usually sits at the bottom of the screen or in a centered window, with buttons to accept, refuse or customize.
The banner is only the visible part. Behind it, a consent mechanism has to do three jobs: hold back the scripts that set non-essential cookies, release them only for the categories the visitor accepted, and record the decision. That mechanism is usually a consent management platform (CMP); our explainer what is a CMP and how it works covers the basics. Our guide on how to choose a consent management platform explains what separates a serious tool from a decorative pop-up.
A cookie banner is also different from a cookie policy. The banner collects consent; the policy is the page that lists every cookie, its purpose, its provider and its lifetime in detail. You need both, and the banner should link to the policy. Our guide to writing a GDPR cookie policy covers what that page must contain.
If you want a ready-made cookie banner that already follows the rules below, that is exactly what FlowConsent builds, but the principles apply whichever tool you use.
Cookie banner, cookie consent banner, cookie notice: same thing?
In practice these terms are used interchangeably. "Cookie notice" sometimes describes an information-only bar ("This site uses cookies, OK"), which is not enough in the EU when non-essential cookies are involved, because it informs without asking. A GDPR cookie banner must ask, and it must accept "no" as an answer. For how the banner, the cookie policy and the privacy policy fit together, see our article on cookie notice vs cookie policy.
Do you need a cookie banner?
You need a cookie banner as soon as your website, or a third-party service embedded in it, reads or stores information on a visitor's device for a purpose that is not strictly necessary for the service the visitor requested. In practice that covers most sites: Google Analytics, Google Ads, the Meta Pixel, LinkedIn Insight Tag, Hotjar, embedded YouTube videos, Google Maps and many chat widgets all set or read cookies.
You do not need consent for cookies that are strictly necessary: session and authentication cookies, a shopping cart, load balancing, security tokens or the cookie that stores the consent choice itself. Some audience measurement tools can also be exempt when they are configured in a very restricted way (first-party, anonymous statistics only, no cross-site tracking, no data sharing). The CNIL publishes the conditions for this exemption, and our article on Matomo and the cookie consent exemption shows how it works in a real case.
If you are unsure, our dedicated article answers the question do I need a cookie banner on my website with concrete scenarios. And if you want to measure traffic without asking for consent at all, read our guide to cookieless analytics before removing your banner: most sites still load at least one third-party tool that needs it.
The laws behind the GDPR cookie banner
The European framework
Two texts work together. The ePrivacy Directive (Article 5(3)) requires prior consent before storing or accessing information on a user's device, unless it is strictly necessary. The GDPR defines what valid consent means: freely given, specific, informed and unambiguous, expressed through a clear affirmative action (Article 4(11)), demonstrable by the controller (Article 7(1)) and as easy to withdraw as to give (Article 7(3)). Our article on the conditions for valid GDPR consent breaks down each requirement.
The Court of Justice of the EU confirmed in the Planet49 ruling (2019) that a pre-ticked box is not valid consent. The European Data Protection Board (EDPB) states in its guidelines on consent that scrolling or continuing to browse is not consent either, and its cookie banner taskforce report (2023) lists the practices national authorities consider non-compliant, such as missing reject buttons and deceptive colors.
National authorities
Each country applies the directive through its own law and regulator:
- France: Article 82 of the Loi Informatique et Libertés, enforced by the CNIL, whose 2020 guidelines and recommendation are among the most detailed in Europe.
- Germany: § 25 of the TDDDG (formerly TTDSG), with guidance from the Datenschutzkonferenz (DSK).
- Spain: Article 22.2 of the LSSI, with the AEPD cookie guide updated in 2023 to align with the EDPB.
- United Kingdom: the PECR, enforced by the ICO, with rules very close to the EU model.
Enforcement is real. The CNIL fined Google and Facebook in 2021 for making refusal harder than acceptance, and our overview of CNIL cookie sanctions lists other cases. For what has moved recently, see GDPR and cookies in 2026.
Outside Europe
The United States mostly follows an opt-out model. Under the CCPA as amended by the CPRA, California residents must be able to opt out of the "sale or sharing" of their data, and businesses must honor the Global Privacy Control signal. Our comparison CCPA vs GDPR for cookies explains the practical differences, and our guide to cookie rules outside Europe covers Brazil, South Africa, Singapore and India. If you serve both audiences, the safest default is the European opt-in banner for EU visitors.
What a GDPR cookie banner must contain
At the first level, before any click, the banner must show:
- A short description of the purposes, for example "audience measurement", "advertising" or "personalized content", in plain language.
- The identity of the parties that will set cookies, or a direct link to that list.
- An "Accept all" button and a "Reject all" button of equal prominence.
- A way to customize choices by purpose ("Customize" or "Settings").
- A link to the cookie policy for full details.
At the second level, the settings panel lets visitors toggle each category. Non-essential categories must be off by default. A clear structure is essential here, and our guide to the 4 GDPR cookie categories shows how to group trackers into strictly necessary, preferences, statistics and marketing.
After the choice, the visitor must be able to reopen the banner at any time to change or withdraw consent, usually through a link in the footer or a small floating icon. The choice itself should be stored for a limited time: the CNIL recommends keeping both acceptance and refusal for around six months before asking again, and limits tracker lifetime to 13 months. Our article on cookie retention and the 13-month rule details both durations.
Design rules: equal choices, no dark patterns
Regulators now look closely at the design of the banner, not just its text. The principle is simple: refusing must be as easy as accepting.
- Same level: "Reject all" appears on the first layer, next to "Accept all", not hidden behind "Settings".
- Same weight: same size, same contrast, same visual style. A bright button next to a grey text link is not balanced.
- No pressure: no guilt-tripping copy, no closing cross that silently means "accept", no repeated pop-ups after a refusal.
- No pre-checked boxes in the settings panel.
These techniques are known as dark patterns, and our article on cookie dark patterns the CNIL prohibits lists them with real examples. To see what balanced layouts look like in practice, browse our GDPR cookie banner examples and best practices.
A related question is the cookie wall, which blocks access to the content until the visitor accepts. The EDPB considers that consent obtained this way is generally not freely given, while some national authorities assess it case by case when a fair alternative exists. Our guide to cookie walls and their legal alternatives explains where the line sits.
Writing the cookie banner text
The text of the banner is part of its compliance. Visitors must understand what they agree to in a few seconds, so the first layer should stay short and concrete. A good structure has three sentences: who you are and why you ask ("We and our partners use cookies"), what for ("to measure audience and show relevant ads"), and what the visitor can do ("You can accept, refuse or choose by purpose, and change your mind at any time").
Avoid vague formulas such as "to improve your experience", which say nothing about the actual purposes. Name the categories that really exist on your site, and do not mention advertising if you run no ads. Button labels should be explicit verbs: "Accept all", "Reject all", "Customize". Avoid labels like "Continue without accepting" in tiny print as the only refusal option, or "Learn more" in place of a refusal. For ready-to-adapt wording by site type, button labels and category descriptions, see our cookie banner text templates.
The banner must also be available in the language of the page. If your site exists in French, German and Spanish, the banner and the settings panel need the same languages. On mobile, check that both main buttons are visible without scrolling and that the banner does not cover the content so heavily that the visitor feels forced to accept.
How to add a cookie banner to your website, step by step
Step 1: audit the cookies on your site
You cannot configure a banner correctly if you do not know which scripts set cookies. List every tracker, its provider, whether it is first-party or third-party, its lifetime and its purpose. Our website cookie audit guide gives the full method.
Not sure what your site drops today? Check in 30 seconds which cookies your site sets with the free cookie scanner, before and after you click "Reject".
Step 2: classify each tracker
Assign each cookie to a category: strictly necessary, preferences, statistics or marketing. Each category becomes a toggle in the settings panel. Be strict: a cookie belongs to "strictly necessary" only if the service the visitor asked for cannot work without it.
Step 3: choose a tool and install it
You can code a banner yourself, but a consent management platform handles blocking, consent storage and updates for you. Our CMP selection guide lists the criteria that matter. Installation depends on your stack: see our guides for cookie consent on Webflow, cookie consent on WordPress, Shopify cookies and GDPR and Next.js cookie consent.
Step 4: block scripts until consent
This is the step most often done badly. Every non-essential script must stay inactive until the visitor accepts its category. Displaying a banner while Google Analytics already runs in the background is the most common violation found in audits. Blocking can be done by the CMP (rewriting script tags, wrapping them) or through a tag manager that waits for the consent signal. Embedded content needs the same treatment: our guide to YouTube nocookie embeds shows how to limit the cookies of video players.
FlowConsent, for example, holds every non-essential script until the visitor chooses, then releases only the accepted categories and records the choice in an exportable consent log.
Step 5: store proof of consent
The GDPR puts the burden of proof on you. For each choice, keep a pseudonymous identifier, the date and time, the categories accepted or refused and the version of the banner shown. Our article on proof of cookie consent explains what to store and for how long.
Step 6: test the three scenarios
Open a private window and test full refusal, partial acceptance (statistics only, for example) and full acceptance. For each, check in the browser developer tools which cookies are set and which network requests leave the page. Reload the page to confirm the choice is remembered, then reopen the banner and withdraw consent to confirm scripts stop.
Cookie banner and Google Consent Mode v2
If you use Google Ads, GA4 or Floodlight, your banner must also send consent signals to Google. Since March 2024, Google requires Consent Mode v2 (with the ad_user_data and ad_personalization parameters) to keep using measurement and personalization features for users in the European Economic Area. A CMP sets the default state to "denied" before the choice, then updates it. Our Google Consent Mode v2 implementation guide covers the setup, and our comparison of Consent Mode basic vs advanced helps you decide whether Google tags may load before consent at all.
Consent rate, consent fatigue and performance
A compliant banner will collect fewer acceptances than a manipulative one, and that is expected. You can still improve the rate legally with clear wording, a well-chosen position and a short first layer. Our guide to measuring and improving your cookie consent rate shows which levers are allowed.
Visitors also see dozens of banners a week and click without reading. Our article on consent fatigue explains how a shorter, more honest banner earns more meaningful choices.
Finally, the banner is code that loads on every page. A heavy script can delay rendering or cause layout shift. See our analysis of the impact of a CMP on Core Web Vitals to keep your banner fast.
Common cookie banner mistakes
Cookies set before any interaction. The most common and most serious mistake. If analytics or advertising tags fire on page load, the banner is decorative. Blocking must be technical, not just visual.
"Reject" less visible than "Accept". A pale link next to a colored button, or a reject option only on the second layer, does not meet the "as easy to refuse" standard.
Treating closing or scrolling as consent. Closing the banner without a choice must be treated as a refusal, never as acceptance.
No way to withdraw consent. Without a permanent "Cookie settings" link or icon, the banner does not meet Article 7(3) of the GDPR.
No proof stored. If you cannot show when and how a visitor consented, you cannot demonstrate compliance during an audit.
Forgetting embedded content and new tags. Videos, maps, social widgets and tags added later by marketing teams often escape the banner. Rescan your site regularly.
Asking again on every visit. Re-displaying the banner after each refusal is a form of pressure. Store the refusal and respect it.
GDPR cookie banner checklist
- Full cookie audit done, every tracker identified with its provider and purpose.
- Trackers classified into clear categories, non-essential ones off by default.
- Purposes described in plain language at the first level.
- "Accept all" and "Reject all" on the first layer, same size and style.
- Customization panel available, no pre-ticked boxes.
- Zero non-essential cookies before consent, verified in the browser tools.
- Embedded content (YouTube, Maps, social widgets) blocked until consent.
- Consent withdrawal available at all times from every page.
- Timestamped proof stored for every choice.
- Google Consent Mode v2 signals sent if you use Google Ads or GA4.
- Link to a complete cookie policy.
- Choice renewed at a reasonable interval (around six months per the CNIL).
- Regular rescans to catch new trackers.
How FlowConsent handles cookie banners
FlowConsent displays a banner with "Accept all" and "Reject all" on the first layer, and blocks every non-essential script before consent, including Google tags, pixels and embeds. Google Consent Mode v2 is built in, so Google receives the right signals without extra setup. An automatic cookie scan detects the trackers on your site and helps you classify them, and every choice is stored as exportable proof of consent, hosted in Europe.
Installation takes about ten minutes on Webflow, WordPress, Shopify, Wix, Framer or through Google Tag Manager. The free plan covers up to 25,000 sessions per month, and Pro costs €14.99 per month for up to 100,000 sessions. To adapt the layout, colors and texts to your brand while keeping balanced buttons, follow the banner customization documentation.