In short: the GDPR decides whether the consent behind your cookies is valid: it must be freely given, specific, informed, unambiguous, provable and as easy to withdraw as to give. It applies to every website based in the EU and to any site elsewhere that tracks people in the EU. Get it wrong and you face fines of up to €20 million or 4% of worldwide turnover, plus the risk that all the data collected on top of that consent becomes unlawful.
GDPR: what is it?
The General Data Protection Regulation, officially Regulation (EU) 2016/679, was adopted on 27 April 2016 and has applied since 25 May 2018. As a regulation, it applies directly in every EU member state without needing a national law to transpose it, and it also applies in the wider European Economic Area.
The GDPR is not a cookie law as such. The rule that you need permission before storing or reading information on a visitor's device comes from Article 5(3) of the ePrivacy Directive (we cover it on a separate page). The two texts work as a pair, and Article 95 of the GDPR confirms it does not override the ePrivacy Directive. What the GDPR brings is everything around that rule:
- The definition of consent. Article 4(11) defines consent as a "freely given, specific, informed and unambiguous indication" of the person's wishes, given by a statement or a clear affirmative action. The ePrivacy Directive borrows this definition, so your cookie banner is judged against the GDPR standard.
- The rules for the data itself. Recital 30 explains that people can be identified through online identifiers such as IP addresses and cookie identifiers. Once a cookie has collected an identifier, a browsing history or an ad profile, the GDPR governs what you do with it: legal basis, transparency, retention, security, rights of access and deletion.
- Accountability. You must be able to demonstrate compliance, which for consent means being able to prove it (Article 7(1)).
Territorial scope. Under Article 3(1), the GDPR applies to the processing carried out by any business established in the EU, wherever the processing physically happens. Under Article 3(2), it also applies to businesses outside the EU when they offer goods or services to people in the EU or monitor their behaviour in the EU. Analytics and advertising cookies that build profiles of EU visitors are a textbook case of monitoring.
Who does GDPR apply to?
In practice, if people in the EU visit your website and you run anything beyond strictly necessary cookies, the GDPR concerns you. That includes:
- EU businesses of any size, from a local shop with a contact form to a large e-commerce site. There is no small business exemption for consent.
- Non-EU businesses targeting or tracking EU visitors, such as a US SaaS company running Google Analytics, a Meta Pixel or LinkedIn Insight Tag on pages read by Europeans. Article 27 generally requires these businesses to appoint a representative in the EU, unless their processing is occasional and low risk.
- Agencies and freelancers who build and run sites for clients. The client is usually the controller, but the person who installs the tags shapes compliance.
- Third-party vendors whose scripts run on your site. The Court of Justice of the EU ruled in Fashion ID (C-40/17, 29 July 2019) that a website embedding a Facebook "Like" button can be a joint controller with Facebook for the collection and transmission of visitor data. You cannot simply blame the vendor: if you embed the tag, you share responsibility for that first step.
UK websites now follow the UK GDPR and PECR, enforced by the ICO, which mirror these principles but are separate laws.
What GDPR requires for cookies and consent
Legal basis: consent for anything non-essential
Article 6 lists six legal bases for processing personal data. For cookies that are not strictly necessary (analytics, advertising, social media plugins, most A/B testing tools), the basis is consent under Article 6(1)(a). The EDPB cookie banner taskforce confirmed in January 2023 that legitimate interest cannot justify placing or reading such cookies, and that if no valid consent is collected where it is required, the subsequent processing cannot comply with the GDPR either.
The four qualities of valid consent
The EDPB Guidelines 05/2020 on consent (adopted on 4 May 2020) translate Article 4(11) into concrete rules:
- Freely given. Access to your content must not depend on accepting cookies. The EDPB gives the example of a script that hides the page until the user clicks "Accept cookies": since there is no genuine choice, the consent is not freely given. This is the so-called cookie wall.
- Specific and granular. People must be able to choose purpose by purpose (analytics, advertising, personalisation) rather than accept a bundle.
- Informed. At a minimum, the EDPB lists the identity of the controller, the purpose of each processing operation, the type of data collected and the existence of the right to withdraw consent.
- Unambiguous. Consent needs a clear affirmative action. Recital 32 states that "silence, pre-ticked boxes or inactivity" do not constitute consent, and the EDPB adds that scrolling or swiping through a page does not count either.
Prior consent
Non-essential cookies must not be set, and tracking scripts must not fire, until the visitor has said yes. The taskforce report recalls that by default no cookie requiring consent can be set without consent, expressed by a positive action. A banner that displays a choice while Google Analytics already loads in the background does not meet this rule.
Exemptions
Cookies that are strictly necessary for a service the user explicitly requested (a shopping cart, a login session, load balancing, remembering the consent choice itself) need no consent. That exemption comes from the ePrivacy Directive. The EDPB has warned against classifying marketing or analytics cookies as "essential" to avoid asking: website owners must be able to show why each cookie listed as essential really is.
Duration and retention
The GDPR sets no fixed lifetime for a cookie or a consent. It requires that personal data is kept no longer than necessary for its purpose (Article 5(1)(e)). In practice, set reasonable cookie lifetimes, renew consent periodically, and ask again whenever you add a new vendor or purpose. National regulators publish their own recommended durations.
Withdrawal
Article 7(3) gives people the right to withdraw consent at any time, and withdrawing must be as easy as giving consent. If accepting took one click on a banner, refusing later should not require an email to your support team. The taskforce suggests a small, permanently visible icon or a link in a standard place such as the footer.
Proof
Article 7(1) puts the burden of proof on you: where processing is based on consent, you must be able to demonstrate that the person consented. That means keeping a consent log with a timestamp, the choices made, the version of the banner and its text, and an identifier linking the record to the browser. Without that log, your consent effectively does not exist in an audit.
A GDPR-compliant cookie banner
A compliant banner turns all of the above into a few design decisions. On the first layer it should show:
- a short, plain explanation of what you use cookies for and who receives the data (your company and the main third parties);
- an Accept all button and a Reject all button, at the same level and with comparable visual weight;
- a Customise or Settings button opening a second layer with purpose-by-purpose toggles, all unticked by default;
- a link to your cookie policy with the full list of cookies, their purpose and lifetime.
The EDPB cookie banner taskforce identified several practices that do not produce valid consent:
- no reject option on a layer that contains an accept button;
- pre-ticked boxes in the settings layer;
- a reject option hidden as a plain text link in a paragraph, or placed outside the banner, without enough visual support to be noticed;
- a reject button whose text contrast is so low that it is unreadable;
- "legitimate interest" toggles buried in deeper layers, forcing people to refuse twice;
- marketing or analytics cookies mislabelled as essential.
Once a choice is made, the banner should disappear and the visitor should be able to reopen their settings at any time to change their mind. For layouts, wording and screenshots, read our GDPR-compliant cookie banner guide, and see what the CNIL prohibits in consent banners for a regulator's view of dark patterns.
Penalties and enforcement
Each EEA country has an independent data protection authority (the CNIL in France, the Belgian Data Protection Authority, the Irish Data Protection Commission and so on), and the European Data Protection Board coordinates them. For cross-border cases, the GDPR's one-stop-shop gives a lead authority to the country of the company's main establishment. Note that the one-stop-shop does not apply to the ePrivacy rules on placing cookies, so national authorities can act directly on banners.
Under Article 83(5), infringements of the basic principles, including the conditions for consent, can be fined up to €20 million or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher. Other infringements are capped at €10 million or 2% (Article 83(4)). Two real cases show where regulators focus:
- Criteo, €40 million (CNIL, 15 June 2023). The French authority fined the adtech company for failing to verify that the people whose data it processed had given their consent. Criteo's trackers sat on partner websites, and the company argued that its partners were responsible for collecting consent. The CNIL's Restricted Committee found breaches of Articles 7, 12, 13, 15, 17 and 26 of the GDPR (deliberation SAN-2023-009). The lesson: if you rely on consent collected by someone else, you still need to be able to prove it.
- IAB Europe, €250,000 (Belgian Data Protection Authority, 2 February 2022). The Belgian authority found that the Transparency and Consent Framework (TCF), used by many cookie banners for programmatic advertising, did not comply with several GDPR provisions. In a ruling announced on 14 May 2025, the Market Court annulled the decision on procedural grounds but endorsed its reasoning: the TC String that stores a user's choices is personal data, IAB Europe is a joint controller, and the €250,000 fine stands.
Fines are only part of the risk. Authorities can also order you to delete data collected without valid consent, and people can complain or claim compensation.
Compliance checklist
- Scan your site to list every cookie, pixel and third-party script, page by page.
- Classify each tracker as strictly necessary or not, and document why the "necessary" ones really are.
- Block non-essential scripts until consent, including tags fired through Google Tag Manager.
- Put Accept and Reject side by side on the first layer, with equal prominence.
- Offer granular choices by purpose, with all toggles off by default.
- Name the controller and the main recipients and explain each purpose in plain language.
- Log every consent and refusal with timestamp, choices and banner version, and keep the log exportable.
- Provide a permanent way to withdraw, such as a floating icon or footer link.
- Check your vendors' contracts, especially joint controller arrangements for embedded pixels and plugins.
- Re-ask for consent when you add new purposes or vendors, and rescan after every site update.
How FlowConsent helps you comply with GDPR
FlowConsent puts the GDPR consent rules into practice without a legal team. It blocks scripts before consent, so analytics and ad tags only fire once a visitor says yes. The banner offers Accept and Reject side by side and granular categories, and the automatic scan detects new cookies as your site changes. Every choice is recorded, and you can export the proof of consent that Article 7(1) asks for: see how in our proof of consent documentation. Google Consent Mode v2 is built in, data is hosted in Europe, and setup takes about ten minutes. Start with our free scanner to see what your site sets today, then create your account: it is free up to 25,000 sessions per month, and Pro costs €14.99 per month for up to 100,000 sessions.
Further reading
The articles below go deeper on each GDPR requirement covered here. Start with the 7 requirements for valid GDPR consent if you want the legal detail, or with the proof of consent guide if you are preparing for an audit. The others cover cookie categories, Google Analytics and the latest changes for 2026.