Cookie banners ask the same question on almost every site, and most people click whatever makes the banner disappear. This guide explains what accepting cookies actually means, what happens technically after the click, what changes if you refuse and when it is worth saying no. If you want the basics first, read our guide to what cookies are and how they work.
What does accepting cookies mean?
Accepting cookies means giving your consent, in the legal sense, to the site storing information on your device and reading it back for the purposes listed in the banner. Those purposes usually fall into three groups: audience measurement (analytics), personalisation (preferences) and advertising (marketing).
This consent exists because the law requires it. In the EU, Article 5(3) of the ePrivacy Directive says that a website must ask before it stores or reads anything on your device, unless that storage is strictly necessary for a service you asked for. The GDPR then defines what valid consent looks like: free, specific, informed, unambiguous and as easy to withdraw as to give. The UK applies the same rule through PECR and the UK GDPR.
Accepting does not mean the site gets access to your files, your passwords or other tabs. A cookie is a small piece of text, linked to one domain, that the browser sends back to that domain. The question is not whether cookies are dangerous for your computer, but who receives the data and what they do with it.
What happens when you accept cookies?
When you click Accept on a properly built banner, a sequence of events starts:
- Your choice is saved. The site stores your decision, usually in its own cookie or in local storage, so that the banner does not come back on the next page. Many consent tools also keep a record of the choice on their server, because the site must be able to prove that you consented.
- Blocked scripts are released. Analytics tags, advertising pixels and embedded players that were waiting for your answer now load.
- Those scripts set their own cookies. Google Analytics writes
_ga, which recognises your browser for up to two years by default. The Meta Pixel writes_fbp. Ad networks may set third-party cookies on their own domains. - Data starts to flow. Each page you view, each click on a product and each purchase can be sent with that identifier to the analytics or advertising provider.
- Partners receive signals. With Google tags, your choice is passed through Consent Mode, which tells Google whether it may use cookies for measurement and ads.
Over the following days, the result is visible: the site remembers you, the analytics count you as a returning visitor and ads for the product you looked at may follow you on other sites. That last effect comes from tracking cookies, the category that most banners exist to control.
What happens if you don't accept cookies?
If you click Reject, or close the banner without choosing on a site that treats this as a refusal, a compliant site sets only the cookies it strictly needs: a session cookie for your login, a cookie for your cart, a cookie that remembers your refusal. These strictly necessary cookies are the only ones exempt from consent.
In practice, you lose very little:
- the site still works, because refusing must not block access to the content;
- you may see the same ads, but they will not be based on your browsing history;
- some embedded content, such as a YouTube video or a map, may stay hidden behind a placeholder until you accept that category;
- preferences that rely on optional cookies, such as a chat history or a remembered layout, may not be kept.
Regulators insist on this point. The European Data Protection Board's guidelines 05/2020 state that consent is not free if access to a service depends on accepting non-essential cookies, and the CNIL fined Google 150 million euros and Facebook 60 million euros in December 2021 because refusing cookies took more clicks than accepting them. A site that breaks when you refuse is the one with a problem, not you. Our article on the cookie wall covers the limited cases where access can be made conditional.
Is it safe to accept cookies?
From a security point of view, yes, in most cases. A cookie cannot run code, cannot contain a virus and cannot read anything outside its own domain. Antivirus tools that warn about "tracking cookies" are talking about privacy, not infection.
The risk is about privacy. A single site measuring its own audience learns little about you. An advertising network that sees the same identifier on thousands of sites can infer your interests, your habits and sometimes sensitive information from the pages you visit, such as a health condition or financial difficulties. That profile can be used for targeting and shared with other companies.
There is also a narrower security risk: on a site that is compromised or does not use HTTPS, an attacker who steals a session cookie can take over your logged-in session. Refusing optional cookies does not change that, because session cookies are necessary. Using HTTPS sites and logging out on shared computers does.
Should you accept or reject cookies?
There is no single right answer, but a few rules of thumb help.
Accepting is reasonable when:
- you trust the site and visit it often, and you are happy for it to measure your use;
- you want a feature that depends on optional cookies, such as an embedded video;
- the banner lets you accept only some categories, for example analytics but not advertising.
Rejecting, or customising, makes sense when:
- you do not know the site or it looks unreliable;
- the topic is sensitive (health, religion, finances, legal problems);
- you use a shared or public computer;
- the banner lists dozens of advertising partners;
- you simply do not want to be followed by ads.
A middle path is often the best choice: click Customise or Settings, keep analytics if you want to help the site improve and turn off marketing. A well-designed banner makes this easy. One that hides the Reject button or pre-ticks every box is using a dark pattern, which regulators sanction.
If you run a website yourself, the question becomes the reverse: does your site really wait for the visitor's answer? Check in 30 seconds which cookies your site sets before consent with the free cookie scanner.
Should you "accept all" or "accept necessary only"?
"Accept all" grants every category listed in the banner, including advertising. "Necessary only", "Reject all" or "Continue without accepting" grants none of the optional categories. Both are valid choices, and the law requires the second to be as easy to find as the first. The CNIL, for example, expects a refusal button at the same level as the acceptance button.
If the banner has a Settings panel, look at the categories rather than the long list of vendors. The categories tell you what the cookies are for; the vendor list tells you who receives the data.
How long does your choice last, and how do you change your mind?
Your choice is stored in your browser, so it lasts until it expires or until you delete it. Many sites ask again after six months, in line with the CNIL's recommendation, and in France consent cookies and trackers should not last more than 13 months. If you clear your cookies, every banner comes back, because the site no longer knows what you chose.
Changing your mind must be as easy as giving consent: Article 7(3) of the GDPR says so explicitly. Look for:
- a floating icon, often a small cookie or shield in a corner of the page;
- a "Cookie settings" or "Manage consent" link in the footer;
- your browser settings, where you can delete the cookies of one site or block third-party cookies everywhere.
Withdrawing consent stops future tracking. It does not erase data already collected, but you can ask the site to delete it under your GDPR rights.
Can you avoid cookie banners altogether?
Partly. Safari and Firefox block most third-party cookies by default, which limits cross-site tracking even if you click Accept. Browser extensions can hide banners or answer them automatically, but some do so by accepting everything, which defeats the purpose. Clearing cookies on exit gives you a clean slate but means seeing every banner again.
Banners themselves will not disappear soon. As long as sites use analytics and advertising cookies, they need your consent, and as long as they need it, they must ask. The better question is whether they ask honestly, which is what consent fatigue research tries to measure.
How FlowConsent handles your choice
FlowConsent is an example of what a banner should do behind the scenes. Until a visitor answers, it blocks the analytics and advertising scripts, so no optional cookie is set before consent. When the visitor accepts a category, only the matching scripts load, and Google tags receive the choice through Google Consent Mode v2. When the visitor refuses, nothing optional runs. Each decision is recorded as exportable proof of consent, hosted in Europe, and a floating re-open button lets visitors change their mind at any time, as the banner customization guide explains. FlowConsent installs in about ten minutes on Webflow, WordPress, Shopify, Wix, Framer or through GTM, and is free up to 25,000 sessions per month.