> Good and bad GDPR cookie banner examples analysed, layout formats, dark patterns to avoid, ready-to-adapt text templates and a full compliance checklist.
>
> Canonical: https://www.flowconsent.com/en/blog/gdpr-cookie-banner-examples-best-practices

[Best practices](https://www.flowconsent.com/en/blog?category=practices)

# GDPR cookie banner examples: best practices and templates

Published 15 July 2026 · Updated 9 October 2026 · 11 min read

In short

A GDPR-compliant cookie banner gives clear information, offers a genuine choice (refusing must be as easy as accepting, on the first screen), pre-ticks nothing, sets no non-essential cookie before the visitor decides, and lets users withdraw consent at any time. Most banners fail because they are designed to nudge people toward yes rather than to collect a free choice. Below: good and bad examples with analysis, the main layout formats, ready-to-adapt text templates and a full checklist.

Here is an uncomfortable truth about the European web. A large share of the cookie banners you see every day are not compliant. They use colours, wording and button hierarchies built to extract a fast yes. Regulators such as the ICO in the UK and the CNIL in France call these manipulative interfaces, and the wider conversation labels them dark patterns. Enforcement is real: at the end of 2021 the CNIL fined Google 150 million euros and Facebook 60 million euros because refusing cookies on their sites took more effort than accepting them. Our overview of [real CNIL cookie sanctions](https://www.flowconsent.com/en/blog/cnil-cookie-sanctions-real-cases) covers more cases.

## What makes a cookie banner GDPR-compliant?

A cookie banner is the interface shown when a visitor arrives that tells them which trackers the site uses and lets them accept or refuse them. It is the first information layer: a short summary of purposes, completed by a link to your [cookie policy](https://www.flowconsent.com/en/blog/cookie-policy-gdpr-guide), which holds the detail (second layer).

The consent collected through it must be freely given, specific, informed and unambiguous, as required by Articles 4(11) and 7 of the GDPR. In practice the user must be able to refuse without extra effort, understand what they are agreeing to, and change their mind easily. The banner is therefore not just a graphic element. It is the legal mechanism that proves you collected valid agreement before setting any non-essential trackers.

### The four principles a banner must respect

First, clear information. Users must know which [cookie categories](https://www.flowconsent.com/en/blog/gdpr-cookie-categories-guide) are used and why, in plain language, without unnecessary jargon. Second, a genuine choice. The refuse button must be visible and accessible at the same level as accept, on the first screen. Third, no pre-ticking. Consent must come from a positive action, never from inaction or a box that is already on. Fourth, easy withdrawal. Taking consent back must be as simple as giving it, for example through a permanent footer link or a floating button available on every page.

For a deeper look at what valid consent involves, read our guide to [GDPR consent validity requirements](https://www.flowconsent.com/en/blog/gdpr-consent-validity-requirements). It explains each criterion and its legal weight.

An often forgotten detail: these principles must coexist. A banner can show perfect information and offer granular categories, but if it pre-ticks a single box or buries the refuse button, it becomes non-compliant. Compliance is not measured by your best button but by your weakest. That is why an honest audit reviews each criterion separately, rather than relying on an overall impression.

### The mandatory elements on screen

Translated into interface components, a compliant banner contains:

- an information text naming the main categories of purposes (analytics, advertising, personalisation) in plain language;
- an **Accept all** button;
- a **Reject all** button, as visible and accessible as Accept;
- a **Customise** (or Manage preferences) button opening granular choices by category;
- a link to the cookie policy for the detailed information.

The absence of a Reject button on the first layer, or its relegation to a less visible sub-menu, is the most commonly sanctioned non-compliance.

### What the consent buttons must say (no dark patterns)

Button labels matter as much as button design. Use neutral, symmetrical terms such as Accept all and Reject all. Avoid guilt-tripping wording like No thanks, I prefer a worse experience. Avoid hiding refusal behind several clicks. The guiding principle is equivalence: refusing should take the same number of clicks and the same effort as accepting. A banner that places refusal two or three levels deep breaks this principle, even if the word reject appears somewhere.

## Good cookie banner examples (with analysis)

Here are five patterns that respect both the spirit and the letter of GDPR. None of them needs an image to be understood: what matters is the structure and the text.

**Example 1: the layered banner.** A first layer shows a short summary (why cookies are used, the main categories) with a Learn more link that opens the detail. The user is not buried in information but can reach it in one click. What it does right: it combines brevity with transparency, without sacrificing one for the other.

**Example 2: equal-prominence buttons.** Accept all and Reject all share the same size, colour and position. Neither is visually emphasised. What it does right: it removes the visual bias and respects the equivalence regulators expect.

**Example 3: granular categories.** A Customise button opens a panel with separate toggles for functional, analytics and marketing cookies, all off by default except strictly necessary ones. The visitor can accept analytics while refusing advertising. What it does right: it allows specific, category-by-category consent rather than a forced global yes.

**Example 4: persistent access to preferences.** A Manage cookies link or a small floating button stays available after the banner is dismissed. What it does right: it makes withdrawal as easy as the original choice, at any point during the visit.

**Example 5: honest consent wording.** The text never equates browsing with consent. It does not say By continuing, you agree. It waits for an explicit action from the user. What it does right: it preserves the unambiguous nature of consent required by the regulation.

These five patterns are not mutually exclusive. The best banner combines them: a concise and honest first layer, two symmetrical buttons, one-click access to categories, and a permanent way to revisit the choice. You do not need a sophisticated design, only a fair structure.

## Which layout to choose: bar, panel or pop-up?

Regulators do not prescribe a position. Top banner, bottom bar or centred pop-up are all acceptable, as long as the banner is clearly visible and the visitor is informed before any optional tracker runs. Three formats cover most needs.

### The minimalist two-button banner

A short text, an Accept button and a Reject button of identical size and style, plus a Learn more link to the cookie policy. It is the simplest format and it minimises friction. It suits showcase sites and blogs that use only one or two optional categories.

### The banner with a customisation panel

The same first layer plus a third button (Customise or Manage preferences) that opens a panel listing categories with on/off toggles. It is the right choice for sites that combine analytics, advertising and other tools, and it tends to raise partial consent because visitors are not forced into all or nothing.

### The bottom bar

A horizontal bar at the bottom of the screen, with Accept and Reject aligned on the same row. It is less intrusive than a centred pop-up while remaining visible. On mobile, check that the refuse button stays fully visible without scrolling, because that is often where equivalence breaks down.

In FlowConsent, the Builder offers these layouts as templates (minimal, bottom bar, floating, full width, modern popup) and keeps the GDPR defaults (equal Accept and Reject buttons, prior blocking, granular categories) whatever styling you apply. See [how to customise your banner](https://www.flowconsent.com/en/doc/banner-customization).

## Bad cookie banner examples (dark patterns to avoid)

The following practices draw regular criticism from regulators. They create the illusion of a choice while strongly steering the decision. Our article on [cookie dark patterns](https://www.flowconsent.com/en/blog/cookie-dark-patterns-cnil-prohibited) goes into each of them in detail.

**No Reject button on the first layer.** If the visitor must click Customise, then untick each category to refuse, refusal is not as simple as acceptance.

**A refuse button that is harder to see.** Showing Accept all prominently while pushing refusal behind a small Settings link, or styling it as plain grey text, breaks equivalence.

**Colour hierarchy.** A bright green accept button next to a grey, small or low-contrast refuse button steers the choice. This is a classic dark pattern, even when both buttons are present.

**Pre-ticked boxes.** A box that is already ticked is not consent. The Court of Justice of the European Union confirmed this in the Planet49 case: silence or inaction cannot count as agreement. Every optional category must be off by default.

**Confusing language.** Phrases like I agree to continue browsing mix consent with access to the site. The user can no longer tell whether they are consenting or simply confirming access.

**Continued browsing treated as consent.** Scrolling or clicking a link is not a clear affirmative action. Only an explicit click on Accept (or on a category toggle) counts.

**A cookie wall.** Making access to the content conditional on accepting cookies undermines freely given consent. It is only tolerated in narrow cases, typically when a fair alternative is offered. See [when a cookie wall can be lawful](https://www.flowconsent.com/en/blog/cookie-wall-legal-alternatives).

**Cookies set before the choice.** Analytics and advertising scripts must stay blocked until the visitor accepts. A banner that looks perfect but lets Google Analytics fire on page load is non-compliant. Only a [cookie audit](https://www.flowconsent.com/en/blog/website-cookie-audit-complete-guide) reveals this.

**Withdrawal harder than consent.** If accepting takes one click but changing your mind takes five, the banner is non-compliant. Symmetry must hold at withdrawal just as it does at the moment of consent.

A useful test to spot a dark pattern: ask whether the design helps the user decide, or helps you obtain a specific answer. If every visual and textual cue points toward yes, the banner is steering rather than informing. A second test is the stopwatch: time how long it takes to refuse versus to accept. If refusing is noticeably slower, you have a compliance problem, regardless of how the buttons are labelled.

Why do these practices persist? Often out of habit or fear of losing data. But a misleading banner creates a double risk: a regulator penalty, and a loss of trust from visitors who increasingly spot these manipulations. A rarer but solid consent is worth more than a massive but legally fragile one.

## How to keep a good consent rate without dark patterns

Compliance and a healthy consent rate are not opposites. A few levers work without steering anyone.

- **Write short, understandable text.** One sentence on what cookies enable (We use cookies to measure audience and improve the site) beats an intimidating legal paragraph.
- **Offer granular choice.** Visitors who refuse everything often do so out of distrust. When they can accept analytics while refusing advertising, partial consent increases.
- **Invest in design.** A banner that matches the site's colours and typography looks more trustworthy than a generic one. This never means making the Reject button less visible.
- **Test formats.** Position, wording and layout influence the result. Measure each change rather than guessing.

Our guide on [how to measure and improve your consent rate](https://www.flowconsent.com/en/blog/cookie-consent-rate-measure-improve) details the method and the benchmarks.

## Cookie banner text: what to write (templates)

The templates below should be adapted to your site, your real purposes and your language. Do not copy text that does not match the trackers you actually set. Good text is short, concrete and free of empty legal phrasing.

**Short version (adapt as needed).**

We use cookies to run this site and, with your agreement, to measure audience and personalise content. You can accept, reject, or choose by category. You can change your choice at any time through the Manage cookies link in the footer.

**Full version (adapt as needed).**

This site uses cookies. Strictly necessary cookies keep the basic functions working and do not require your consent. Other cookies, for analytics and marketing, are only set with your agreement. Analytics cookies help us understand how the site is used. Marketing cookies let us offer relevant content. You can accept all, reject all, or set your choices category by category. No box is pre-ticked. Your choice is stored and you can withdraw or change it at any time through the Manage cookies link, without any reduction in your access to content.

A few useful drafting rules. Name the real purposes rather than vague categories. State the retention period where it is relevant. Avoid multiple negatives that blur the meaning. And mention any data transfers outside the European Union when your marketing tools involve them, because that information is part of what makes consent informed.

Keep the wording consistent between the banner and your full cookie policy. If the banner mentions three categories but the policy lists ten trackers under unclear names, the mismatch undermines the informed nature of the consent. Treat the banner as the short, honest summary of a longer document that anyone can open in one click.

## Check what really happens after the click

A banner can look flawless and still leak. The only proof that counts is what runs when a visitor refuses. After going live, load your pages in a private window, refuse, and check in the browser's network and storage tabs that no analytics or advertising request goes out. FlowConsent automates this with a [refusal scan](https://www.flowconsent.com/en/doc/compliance-verification): it loads your pages in a real browser, refuses consent, lists anything that still fires, and archives the result as a dated [proof report](https://www.flowconsent.com/en/doc/proof-report). Keep this evidence alongside your [consent records](https://www.flowconsent.com/en/blog/proof-of-cookie-consent-what-to-store).

## Cookie banner compliance checklist

- Information is clear, in plain language, and states the categories and purposes.
- The Reject all button is as visible and accessible as Accept all, on the first screen.
- A Customise button gives access to separate, selectable categories (functional, analytics, marketing).
- No box is pre-ticked, apart from strictly necessary cookies.
- Refusing takes the same number of clicks as accepting.
- The design does not visually favour any button, on desktop and on mobile.
- No wording equates browsing with consent.
- Access to content does not depend on accepting cookies.
- A link to the cookie policy is present.
- No non-essential cookie is set before consent is collected.
- A permanent link or button lets users change or withdraw consent at any time.
- Proof of consent is stored with a timestamp.
- Behaviour is verified with a cookie scan after going live, and again after every new tag.

## Conclusion

A good cookie banner is not about looks but about respecting the user's choice. Clear information, symmetrical buttons, a customisation panel, no pre-ticked boxes, no tracker before consent and easy withdrawal cover most of what matters. A simple, fair design is also the one that holds up best over time, both with regulators and with your visitors.

Next step: check your own site. Run a [free cookie scan](https://www.flowconsent.com/en/scan) to see within minutes which cookies fire before consent and where your banner falls short of compliance.

[Back to the blog](https://www.flowconsent.com/en/blog)

Share this article · [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fgdpr-cookie-banner-examples-best-practices) · [X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fgdpr-cookie-banner-examples-best-practices)

Questions

## Common questions on this topic.

Can't find your question? Write to us, we answer fast.

[Write to us](https://www.flowconsent.com/en/demo)

### Does the refuse button have to be at the same level as the accept button?

Yes. Regulators apply the principle of equivalence: refusing must be as easy as accepting, with the same number of clicks and comparable visibility. Hiding refusal behind a discreet link is treated as a manipulative interface.

### Does a pre-ticked box count as consent?

No. Consent must result from a positive action by the user. The Court of Justice of the European Union confirmed this in the Planet49 case. A box that is already ticked has no legal value.

### Can I set analytics cookies before consent?

In principle no, except for narrowly defined exempt audience measurement that strictly meets regulatory criteria. Marketing cookies and most analytics cookies require prior consent.

### How do I let users withdraw consent?

The simplest method is a permanent link, for example Manage cookies, in the footer. It should reopen the preferences panel and let users change or withdraw each category at any time.

Read next

## Keep reading.

[All articles](https://www.flowconsent.com/en/blog)

[Regulation · 10 October 2026](https://www.flowconsent.com/en/blog/cookie-banner-text-templates)

### [Cookie banner text: copy-ready templates for GDPR, UK and US sites](https://www.flowconsent.com/en/blog/cookie-banner-text-templates)

[What a cookie banner text must say, with copy-ready templates by site type, button labels, category descriptions and the CCPA variant.](https://www.flowconsent.com/en/blog/cookie-banner-text-templates)

[Read the article ](https://www.flowconsent.com/en/blog/cookie-banner-text-templates)·

[Best practices · 11 October 2026](https://www.flowconsent.com/en/blog/what-is-a-session-cookie)

### [What is a session cookie? Definition, examples and consent rules](https://www.flowconsent.com/en/blog/what-is-a-session-cookie)

[What a session cookie is, how it works, how it differs from a persistent cookie, real examples, and when it needs consent under EU rules.](https://www.flowconsent.com/en/blog/what-is-a-session-cookie)

[Read the article ](https://www.flowconsent.com/en/blog/what-is-a-session-cookie)·

[Regulation · 20 March 2026](https://www.flowconsent.com/en/blog/cookie-dark-patterns-cnil-prohibited)

### [Cookie dark patterns: what the CNIL prohibits in consent banners](https://www.flowconsent.com/en/blog/cookie-dark-patterns-cnil-prohibited)

[Dark patterns in cookie banners are in the CNIL crosshairs. Prohibited practices, real sanctions and how to make your banner compliant.](https://www.flowconsent.com/en/blog/cookie-dark-patterns-cnil-prohibited)

[Read the article](https://www.flowconsent.com/en/blog/cookie-dark-patterns-cnil-prohibited)

## Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

[Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)