> GDPR consent is valid only if freely given, specific, informed, unambiguous, prior, provable and revocable. Rules, examples and a test for your banner.
>
> Canonical: https://www.flowconsent.com/en/blog/gdpr-consent-validity-requirements

[Regulation](https://www.flowconsent.com/en/blog?category=regulation)

# GDPR consent: the 7 requirements for valid consent explained

Published 23 June 2026 · Updated 3 November 2026 · 15 min read

In short

GDPR consent is one of six legal bases for processing personal data, and for cookies and trackers it is the one the law imposes. It only counts if it is freely given, specific, informed and unambiguous (Article 4(11)), collected _before_ any non-essential cookie is set, provable by you (Article 7(1)) and as easy to withdraw as it was to give (Article 7(3)). On a cookie banner, that means a "Reject all" button as visible as "Accept all", no pre-ticked boxes, no "by continuing to browse" wording, one choice per purpose, scripts blocked until the click, and a record of every decision. If a single requirement fails, the consent is void and every cookie set on that basis is unlawful.

This guide is the starting point of our series on consent and privacy law: each section below summarises one topic and links to the detailed article.

## What GDPR consent is and when you need it

Article 6(1) of the [GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj) lists six legal bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. Consent is not the "best" one. The EDPB reminds controllers that it is only appropriate when the person has a genuine choice. If you need the data to deliver an order, the basis is the contract; if a law obliges you to keep invoices, it is a legal obligation. Asking for consent in those cases would be misleading, because the person cannot actually refuse.

Cookies are the big exception where you do not get to choose. Article 5(3) of the [ePrivacy Directive](https://eur-lex.europa.eu/eli/dir/2002/58/oj) requires consent before storing or reading information on a user's device, unless it is strictly necessary to provide a service the user explicitly asked for or to transmit a communication. Legitimate interest cannot replace consent for an advertising cookie, a non-exempt analytics tag or a social media pixel. Where legitimate interest does fit, and why cookie banners still show a "legitimate interest" switch, is covered in [legitimate interest vs consent](https://www.flowconsent.com/en/blog/legitimate-interest-vs-consent-cookies). In its [Guidelines 2/2023 on the technical scope of Article 5(3)](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-22023-technical-scope-art-53-eprivacy-directive_en), the EDPB confirmed that the rule also covers tracking pixels, local storage and similar techniques, not only cookies.

### Explicit consent and special categories of data

The GDPR uses a stronger standard, "explicit consent", in three situations: processing special categories of data such as health, religion or sexual orientation (Article 9(2)(a)), automated decisions with legal or similarly significant effects (Article 22(2)(c)) and some transfers outside the EEA (Article 49(1)(a)). Explicit means an express statement: a written sentence, a signed form or a dedicated checkbox ticked for that specific purpose. A website that infers health interests from browsing behaviour to target ads enters this territory. For how explicit consent differs from ordinary and implied consent, see [the types of consent explained](https://www.flowconsent.com/en/blog/types-of-consent-explicit-implied).

### Children's consent

When an online service is offered directly to a child and relies on consent, Article 8 sets the age of digital consent at 16 and lets each Member State lower it, but not below 13. Under that age, a parent must give or authorise consent, and the controller must make reasonable efforts to verify it. National ages differ: France chose 15 (Article 45 of the Loi Informatique et Libertés), Spain 14 (Article 7 of the LOPDGDD), while Germany kept 16.

### Cookie banner or form: the same standard

The seven requirements below apply whether you collect consent through a cookie banner, a newsletter sign-up or a contact form. On forms, the classic failures are a single box that bundles the terms of use with marketing, a pre-ticked newsletter box and no simple way to unsubscribe. This guide uses cookie banners as examples because that is where most sanctions land, but the analysis is identical.

## Where the 7 requirements come from

Article 4(11) GDPR defines consent as a freely given, specific, informed and unambiguous indication of the person's wishes, given by a statement or by a clear affirmative action. Article 7 then adds the operational conditions: the controller must be able to demonstrate consent (7(1)), a written request must be clearly distinguishable from other matters and use clear and plain language (7(2)), consent can be withdrawn at any time and withdrawing must be as easy as giving (7(3)), and freedom is assessed by checking whether a service is made conditional on consent that is not necessary for it (7(4)).

Three recitals give the detail regulators rely on. Recital 32 states that silence, pre-ticked boxes or inactivity cannot constitute consent. Recital 42 requires that the person knows at least who the controller is and what the purposes are, and says consent is not free if the person cannot refuse or withdraw without detriment. Recital 43 adds that separate consent should be possible for separate processing operations.

For cookies, the duty to ask comes from Article 5(3) of the ePrivacy Directive, but the quality of that consent is measured against the GDPR. The Court of Justice confirmed this in **Planet49** (C-673/17, 1 October 2019): a pre-ticked checkbox is not valid consent, the rule applies whether or not the stored information is personal data, and users must be told how long cookies remain active and whether third parties can access them. The reference interpretation is the [EDPB Guidelines 05/2020 on consent](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en), adopted on 4 May 2020. In the UK, PECR and the UK GDPR apply the same consent standard, as the ICO explains in its guidance on [what valid consent is](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/consent/what-is-valid-consent/).

Strictly necessary cookies (session, security, load balancing, storing the consent choice itself) are exempt. Everything else, such as advertising, social media plugins, A/B testing and in most countries analytics, needs consent that meets all seven conditions.

Our guide to the [four GDPR cookie categories](https://www.flowconsent.com/en/blog/gdpr-cookie-categories-guide) explains how to sort each cookie into the right group.

## The 7 requirements at a glance

1. **Freely given:** a genuine choice, and refusing costs the visitor nothing.
2. **Specific:** one decision per purpose, never a bundle.
3. **Informed:** the visitor knows who, why, which data, for how long and how to withdraw.
4. **Unambiguous:** a clear affirmative action, never silence, scrolling or a pre-ticked box.
5. **Prior:** obtained before the cookie is written or read.
6. **Demonstrable:** you can prove when, how and to what the person agreed.
7. **Withdrawable:** at any time, through the same interface, as easily as it was given.

## Requirements 1 and 2: freely given and specific

### 1. Freely given

Consent is not free when the visitor has no real choice or suffers a disadvantage by refusing. The EDPB is explicit that access to a service must not be made conditional on accepting cookies: its Example 6a describes a site that hides content until the visitor clicks "Accept cookies" and concludes the consent is not freely given. Interface design matters too. The French CNIL recommends buttons of the same size, font and emphasis, and the German DSK considers that hiding refusal on a second layer creates artificial extra effort that undermines freedom of choice. Our article on [cookie dark patterns](https://www.flowconsent.com/en/blog/cookie-dark-patterns-cnil-prohibited) lists the designs regulators reject most often.

- **Valid:** "Accept all" and "Reject all" side by side on the first layer, same size, same colour weight, same font.
- **Invalid:** a large green "Accept" button next to a grey "More options" link, where refusing takes three clicks.
- **Invalid:** content blurred or blocked until the visitor accepts, with no equivalent way in. See our analysis of [cookie wall legality](https://www.flowconsent.com/en/blog/cookie-wall-legal-alternatives).

### 2. Specific

Consent must relate to one or more defined purposes, and the visitor must be able to accept some and refuse others. Article 7(2) also forbids burying the cookie request inside other content such as terms of use. A banner that bundles analytics, advertising and personalisation under one button is acceptable only if a second layer lets the visitor choose purpose by purpose.

- **Valid:** a settings panel with separate toggles for "Audience measurement", "Advertising" and "Personalised content", all switched off by default.
- **Invalid:** one checkbox reading "I accept the terms of use and cookies".
- **Invalid:** a single "Marketing" toggle that silently covers analytics, ad retargeting and session recording.

## Requirements 3 and 4: informed and unambiguous

### 3. Informed

The EDPB lists the minimum information for informed consent: the identity of the controller, the purpose of each processing operation, the type of data collected, the existence of the right to withdraw, and where relevant the use of automated decision-making and the risks of transfers outside the EEA. Planet49 adds cookie duration and third-party access. In practice, keep the first layer short and plain, then give a second layer or a cookie policy listing each cookie, its provider, its purpose and its lifetime.

Our [cookie policy guide](https://www.flowconsent.com/en/blog/cookie-policy-gdpr-guide) shows how to present this information in a complete document.

- **Valid:** "We and our partners (Google, Meta) would like to use cookies to measure audience and show you relevant ads. You can change your choice at any time via 'Cookie settings' in the footer." plus a link to the full list.
- **Invalid:** "We use cookies to improve your experience." with no purposes, no partners and no mention of withdrawal.
- **Invalid:** a vendor list that names "Partners" without saying who they are.

### 4. Unambiguous

Article 4(11) requires a statement or a clear affirmative action. The EDPB states in Example 16 that scrolling or swiping through a page will not under any circumstances satisfy this requirement, because it cannot be distinguished from normal browsing. The same logic applies to closing the banner with a cross: it expresses no agreement, so treat it as "no choice yet" and keep non-essential scripts blocked.

Our [GDPR cookie banner examples](https://www.flowconsent.com/en/blog/gdpr-cookie-banner-examples-best-practices) show what a clear affirmative action looks like on a real banner.

- **Valid:** the visitor clicks a button clearly labelled "Accept all" or switches on a specific toggle and saves.
- **Invalid:** "By continuing to browse, you accept our use of cookies."
- **Invalid:** toggles already switched on in the settings panel, which is the digital equivalent of the pre-ticked box condemned in Planet49.

## Requirements 5, 6 and 7: prior, demonstrable, withdrawable

### 5. Prior

The EDPB is clear that consent must always be obtained before the processing starts. On a website, this is where most banners fail in practice: the text looks perfect, but Google Analytics or the Meta Pixel already fired on page load because the tag sits hard-coded in the `<head>` or fires in Tag Manager before the consent tool has loaded. A compliant setup blocks every non-essential script until the visitor has clicked. FlowConsent does this by default and sets Google Consent Mode v2 signals to "denied" until the visitor chooses; see the [Google Consent Mode documentation](https://www.flowconsent.com/en/doc/google-consent-mode) for the exact behaviour. Check in a few minutes which cookies your site sets before any click with the [free cookie scanner](https://www.flowconsent.com/en/scan).

### 6. Demonstrable

Under Article 7(1), the burden of proof is on you. The EDPB suggests keeping information on the session in which consent was given, documentation of the consent workflow at that time and a copy of the information shown, and warns that merely pointing to a correct website configuration is not enough. A useful consent record contains a timestamp, a pseudonymous identifier, the choice for each purpose, the banner version and the policy version in force. FlowConsent logs each choice with a pseudonymous ID and the banner version, and its [proof report](https://www.flowconsent.com/en/doc/proof-report) documents what a refusal really blocks; our guide on [proof of cookie consent](https://www.flowconsent.com/en/blog/proof-of-cookie-consent-what-to-store) details what to store.

### 7. Withdrawable

Article 7(3) requires that withdrawing is as easy as giving consent, and the visitor must be told about this right beforehand. The EDPB adds that when consent was given in one click on a website, withdrawal must be possible through the same interface: asking people to email you or call a hotline does not comply. A permanent "Cookie settings" link in the footer or a small floating icon is the usual answer. Withdrawal must also have a real effect: the tags stop and the cookies they rely on are no longer read.

The GDPR sets no fixed lifetime for consent. The EDPB recommends refreshing it at appropriate intervals, the CNIL considers keeping a choice for 6 months good practice, and the Spanish AEPD considers that consent should not remain valid for more than 24 months. Pick a period, document it, and ask again whenever your purposes or partners change.

Our guide to [cookie retention duration and the 13-month rule](https://www.flowconsent.com/en/blog/cookie-retention-duration-gdpr-13-months) goes into these timeframes in more detail.

## Banner design, dark patterns and sanctions

Most invalid consent does not come from a misreading of the law but from design choices. Regulators look at the whole journey: the first layer, the number of clicks needed to refuse, the wording, the colours and what actually happens after the click.

- **Dark patterns:** a highlighted accept button, a refuse link in pale grey text, guilt-inducing wording or a second screen just to say no. Our analysis of [cookie dark patterns the CNIL prohibits](https://www.flowconsent.com/en/blog/cookie-dark-patterns-cnil-prohibited) goes through each of them.
- **Cookie walls and "consent or pay":** blocking access unless the visitor accepts raises the freedom question head on. See [whether a cookie wall is legal and what the alternatives are](https://www.flowconsent.com/en/blog/cookie-wall-legal-alternatives).
- **Good layouts:** our collection of [GDPR cookie banner examples](https://www.flowconsent.com/en/blog/gdpr-cookie-banner-examples-best-practices) shows banners that respect all seven requirements.
- **Consent fatigue:** a visitor who clicks anything to make the banner disappear is not really informed. [Why visitors ignore your cookie banner](https://www.flowconsent.com/en/blog/consent-fatigue-visitors-ignore-cookie-banner) explains how to keep it short and honest.

A compliant banner usually gets a lower acceptance rate than a manipulative one. That is expected, and our guide to [measuring and improving your cookie consent rate](https://www.flowconsent.com/en/blog/cookie-consent-rate-measure-improve) covers the levers that remain legal.

The stakes are concrete. Under Article 83(5)(a) GDPR, infringing the conditions for consent can lead to fines of up to 20 million euros or 4% of total worldwide annual turnover, whichever is higher. For cookies, the French CNIL acts on the basis of Article 82 of the Loi Informatique et Libertés, which transposes the ePrivacy Directive, and it publishes its decisions. Our summary of [real CNIL cookie sanctions](https://www.flowconsent.com/en/blog/cnil-cookie-sanctions-real-cases) lists the main cases and the failures behind them: cookies set before consent, refusal harder than acceptance, incomplete information.

## Consent signals for advertising: Consent Mode, TCF and the DMA

Once the visitor has chosen, the decision has to reach every tool that depends on it. Three frameworks matter for most websites.

- **Google Consent Mode v2** passes the choice to Google tags through four parameters (`ad_storage`, `analytics_storage`, `ad_user_data`, `ad_personalization`). Google requires it for advertisers who use its ad services with users in the EEA. It does not replace the banner, it only carries its result. Our [Google Consent Mode v2 implementation guide](https://www.flowconsent.com/en/blog/google-consent-mode-v2-implementation-guide) explains the setup.
- **IAB TCF 2.2** is the industry framework used by publishers that sell programmatic advertising: the banner produces a consent string that ad vendors read. Read [what TCF 2.2 is and who needs it](https://www.flowconsent.com/en/blog/tcf-2-2-transparency-consent-framework-guide).
- **The Digital Markets Act:** Article 5(2) DMA forbids gatekeepers from combining personal data across their services without consent within the meaning of the GDPR. This is one reason why Google and other large platforms ask websites to pass reliable consent signals. Our article on [the DMA and cookie consent](https://www.flowconsent.com/en/blog/digital-markets-act-dma-cookies-consent) details the consequences.

Other ad platforms have their own mechanisms, such as the [Amazon Consent Signal for Amazon Ads](https://www.flowconsent.com/en/blog/amazon-consent-signal-acs-amazon-ads-guide) and [Microsoft UET Consent Mode](https://www.flowconsent.com/en/blog/microsoft-uet-consent-mode-guide). In every case, the rule is the same: the signal must reflect the visitor's real choice, and no tag should fire before it exists.

## Consent rules outside the European Union

The GDPR also applies to organisations based outside the EU when they offer goods or services to people in the EU or monitor their behaviour (Article 3(2)). A US online store selling to French customers is therefore bound by the seven requirements. Other regions take different approaches:

- **United Kingdom:** the UK GDPR and PECR keep the same consent standard for cookies, as the [ICO explains](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/consent/what-is-valid-consent/).
- **California:** the CCPA, as amended by the CPRA, is mainly an opt-out model: most cookies can be set by default, but people must be able to refuse the sale or sharing of their personal information. [CCPA vs GDPR: the real differences for cookies](https://www.flowconsent.com/en/blog/ccpa-vs-gdpr-cookie-differences) compares the two systems point by point. How that refusal works in practice, from the footer link to the 15-day deadline, is explained in our guide to the [Do Not Sell My Personal Information link](https://www.flowconsent.com/en/blog/do-not-sell-my-personal-information-link).
- **Brazil, South Africa, Thailand, India:** the LGPD, POPIA, PDPA and DPDPA borrow heavily from the GDPR, with local differences on legal bases and formalities. See our guide to [managing cookies outside Europe](https://www.flowconsent.com/en/blog/lgpd-popia-pdpa-dpdpa-cookies-outside-europe).

For a site with an international audience, the simplest defensible choice is often to apply the GDPR standard everywhere, or to geolocate visitors and show the opt-in banner to everyone who comes from an opt-in jurisdiction. The two models, with examples for cookies and email marketing, are compared in [opt-in vs opt-out consent](https://www.flowconsent.com/en/blog/opt-in-vs-opt-out-consent).

## What is changing in 2026

The texts themselves have been stable for years: the GDPR applies since May 2018, and the consent rule for cookies dates from the 2009 revision of the ePrivacy Directive. What keeps moving is how they are applied and what may replace them. The ePrivacy Regulation proposed in 2017 has never been adopted, so the Directive and its national transpositions remain the rule; our article on [the ePrivacy Regulation and cookies](https://www.flowconsent.com/en/blog/eprivacy-regulation-cookies-europe-what-changes) follows the file. The European Commission's Digital Omnibus proposals would move part of the cookie rules into the GDPR and encourage consent signals set once in the browser, but they are still being negotiated and today's rules apply in full.

Our overview of [GDPR and cookies in 2026](https://www.flowconsent.com/en/blog/gdpr-cookies-2026-what-changed) tracks what has changed and what is coming, and Chrome's shifting approach to third-party cookies is covered in our [Google Privacy Sandbox analysis](https://www.flowconsent.com/en/blog/google-privacy-sandbox-consent-third-party-cookies). None of these developments removes the need for valid consent today.

## How to test your banner against the 7 requirements

1. Open your site in a private window and, before clicking anything, check the cookies and network requests in your browser's developer tools. Only strictly necessary cookies should be present.
2. Look at the first layer: is refusing exactly as easy and as visible as accepting?
3. Click "Reject all", browse three pages and confirm that no analytics or advertising requests leave the browser.
4. Open the settings panel: every purpose should be off by default, described in plain words, with cookies, providers and lifetimes listed.
5. Accept, then find the way back to your choices from any page, withdraw, and check that the tags stop.
6. Export one consent record and check that it shows the date, the choices and the banner version.
7. Repeat after every new tool, plugin or campaign tag, ideally with an automatic cookie scan.

The seven requirements work as a chain: free, specific, informed, unambiguous, prior, demonstrable and withdrawable. Regulators do not grade on a curve, so one weak link, such as a missing reject button or a tag firing before the click, invalidates the consent of every visitor. Whatever tool you use, test the real behaviour of your site rather than the banner text alone. To see what your pages actually load before and after consent, [run a free scan of your website](https://www.flowconsent.com/en/scan).

## Consent rules law by law

The requirements above come from the GDPR and the ePrivacy rules, but each jurisdiction adds its own details on cookies, opt-in or opt-out, and sanctions. Our law guides cover each one in depth:

- [GDPR](https://www.flowconsent.com/en/laws/gdpr)
- [ePrivacy Directive](https://www.flowconsent.com/en/laws/eprivacy-directive)
- [CCPA/CPRA](https://www.flowconsent.com/en/laws/ccpa-cpra)
- [UK GDPR and PECR](https://www.flowconsent.com/en/laws/uk-gdpr-pecr)
- [TDDDG (Germany)](https://www.flowconsent.com/en/laws/tdddg): formerly the TTDSG, see [what changed when the TTDSG became the TDDDG](https://www.flowconsent.com/en/blog/ttdsg-tdddg-german-cookie-law)
- [nFADP (Switzerland)](https://www.flowconsent.com/en/laws/nfadp-switzerland)
- [LGPD (Brazil)](https://www.flowconsent.com/en/laws/lgpd-brazil)
- [LOPDGDD (Spain)](https://www.flowconsent.com/en/laws/lopdgdd-spain)

For a side-by-side view, see [all cookie and privacy laws](https://www.flowconsent.com/en/laws).

## How FlowConsent handles GDPR consent

FlowConsent applies the seven requirements by default. The banner shows equal-size "Accept all" and "Reject all" buttons on the first layer, categories are granular and switched off until the visitor decides, and non-essential scripts are blocked before consent. Google Consent Mode v2 signals start at "denied". Each choice is logged with a pseudonymous ID and the banner version, the consent proof can be exported, and a floating button lets visitors reopen the banner and change their mind at any time. To prove that refusal is really respected, [compliance verification](https://www.flowconsent.com/en/doc/compliance-verification) loads your pages while refusing consent, lists anything that still fires and archives the result as dated evidence. FlowConsent is hosted in Europe, free up to 25,000 sessions per month, and installs in about ten minutes.

[Back to the blog](https://www.flowconsent.com/en/blog)

Share this article · [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fgdpr-consent-validity-requirements) · [X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fgdpr-consent-validity-requirements)

Questions

## Common questions on this topic.

Can't find your question? Write to us, we answer fast.

[Write to us](https://www.flowconsent.com/en/demo)

### What are the GDPR consent requirements?

Under Article 4(11) and Article 7 GDPR, consent must be freely given, specific, informed and unambiguous, given by a clear affirmative action. In practice, two more conditions follow: it must be obtained before processing starts, and you must be able to prove it. The person must also be able to withdraw it at any time, as easily as they gave it. If one condition is missing, the consent is invalid.

### Is consent always required under the GDPR?

No. Consent is one of six legal bases in Article 6, alongside contract, legal obligation, vital interests, public task and legitimate interests. You should only rely on it when the person has a real choice. Cookies are the main exception: the ePrivacy Directive requires consent for any non-essential cookie or tracker, so legitimate interest cannot replace it for analytics, advertising or social media tags.

### What is the difference between consent and explicit consent?

Standard GDPR consent can be given by a clear affirmative action, such as clicking a button. Explicit consent, required for special categories of data like health (Article 9), certain automated decisions (Article 22) and some transfers outside the EEA (Article 49), needs an express statement: a written sentence, a signed form or a dedicated checkbox for that specific purpose. Explicit consent must still meet all the ordinary requirements.

### How long is GDPR consent valid?

The GDPR sets no fixed lifetime for consent. The EDPB recommends refreshing it at appropriate intervals. For cookies, the French CNIL considers keeping a choice, acceptance or refusal, for 6 months good practice, and the Spanish AEPD considers that consent should not remain valid for more than 24 months. Choose a period, document it, and ask again whenever your purposes or partners change.

### Does scrolling or closing the cookie banner count as consent?

No. The GDPR requires a statement or a clear affirmative action, and Recital 32 excludes silence and inactivity. The EDPB states that scrolling or swiping through a page cannot under any circumstances count as consent. Closing the banner with a cross expresses no agreement either: treat it as no choice yet and keep non-essential scripts blocked until the visitor clicks accept or reject.

### How do you prove GDPR consent?

Article 7(1) puts the burden of proof on you. Keep a record for each choice: a timestamp, a pseudonymous identifier, the decision for each purpose, the banner version and the policy version shown. The EDPB adds that pointing to a correct website configuration is not enough. A dated scan showing that nothing fires after a refusal completes the record by proving that the choice is respected.

Read next

## Keep reading.

[All articles](https://www.flowconsent.com/en/blog)

[Regulation · 29 October 2026](https://www.flowconsent.com/en/blog/ccpa-cookie-banner-requirements)

### [CCPA cookie banner: requirements, GPC and how to comply](https://www.flowconsent.com/en/blog/ccpa-cookie-banner-requirements)

[The CCPA does not require a GDPR-style cookie banner, but cookies that sell or share data need a notice, a working opt-out and respect for Global Privacy Control. Requirements, 2025 fines and a step-by-step setup.](https://www.flowconsent.com/en/blog/ccpa-cookie-banner-requirements)

[Read the article ](https://www.flowconsent.com/en/blog/ccpa-cookie-banner-requirements)·

[Best practices · 18 October 2026](https://www.flowconsent.com/en/blog/types-of-consent-explicit-implied)

### [Types of consent: explicit, implied and informed consent explained](https://www.flowconsent.com/en/blog/types-of-consent-explicit-implied)

[Explicit, implied, informed, unambiguous: what each type of consent means under the GDPR, which one your cookie banner needs and why implied consent no longer works.](https://www.flowconsent.com/en/blog/types-of-consent-explicit-implied)

[Read the article ](https://www.flowconsent.com/en/blog/types-of-consent-explicit-implied)·

[Regulation · 26 March 2026](https://www.flowconsent.com/en/blog/gdpr-cookie-categories-guide)

### [Cookie categories under GDPR: the 4 cookie consent categories explained](https://www.flowconsent.com/en/blog/gdpr-cookie-categories-guide)

[Strictly necessary, functional, analytics, marketing cookies: which categories require consent? GDPR guide with practical examples.](https://www.flowconsent.com/en/blog/gdpr-cookie-categories-guide)

[Read the article](https://www.flowconsent.com/en/blog/gdpr-cookie-categories-guide)

## Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

[Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)