> What the GDPR requires for cookies: valid consent, proof, withdrawal, banner design and real fines. A practical guide for website owners and marketers. > > Canonical: https://www.flowconsent.com/en/laws/gdpr Cookie law # GDPR and cookies: what the law requires from your website What the GDPR requires for cookies: valid consent, proof, withdrawal, banner design and real fines. A practical guide for website owners and marketers. Updated October 9, 2026 · 10 min read [Scan my site for free](https://www.flowconsent.com/en/scan) · [Try FlowConsent for free](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=laws) ## Fact sheet - Full name Regulation (EU) 2016/679, the General Data Protection Regulation - Jurisdiction European Union (EEA) - In force since 25 May 2018 - Authority The data protection authority of each EEA country (CNIL in France, for example), coordinated by the EDPB - Maximum fine €20 million or 4% of worldwide annual turnover, whichever is higher - Consent model Opt-in ## Key points - The GDPR governs what happens to the personal data that cookies and trackers collect, and it defines what valid consent means. - It applies to EU-based businesses and to any business outside the EU that monitors the behaviour of people in the EU. - Consent must be freely given, specific, informed and unambiguous: no pre-ticked boxes, no scrolling as consent, no cookie walls. - You must be able to prove every consent you rely on, and withdrawing must be as easy as giving it. - Fines can reach €20 million or 4% of worldwide annual turnover, and regulators have already fined adtech players for weak consent checks. Contents > **In short:** the GDPR decides whether the consent behind your cookies is valid: it must be freely given, specific, informed, unambiguous, provable and as easy to withdraw as to give. It applies to every website based in the EU and to any site elsewhere that tracks people in the EU. Get it wrong and you face fines of up to €20 million or 4% of worldwide turnover, plus the risk that all the data collected on top of that consent becomes unlawful. ## GDPR: what is it? The General Data Protection Regulation, officially Regulation (EU) 2016/679, was adopted on 27 April 2016 and has applied since **25 May 2018**. As a regulation, it applies directly in every EU member state without needing a national law to transpose it, and it also applies in the wider European Economic Area. The GDPR is not a cookie law as such. The rule that you need permission before storing or reading information on a visitor's device comes from Article 5(3) of the ePrivacy Directive (we cover it on a separate page). The two texts work as a pair, and Article 95 of the GDPR confirms it does not override the ePrivacy Directive. What the GDPR brings is everything around that rule: - **The definition of consent.** Article 4(11) defines consent as a "freely given, specific, informed and unambiguous indication" of the person's wishes, given by a statement or a clear affirmative action. The ePrivacy Directive borrows this definition, so your cookie banner is judged against the GDPR standard. - **The rules for the data itself.** Recital 30 explains that people can be identified through online identifiers such as IP addresses and cookie identifiers. Once a cookie has collected an identifier, a browsing history or an ad profile, the GDPR governs what you do with it: legal basis, transparency, retention, security, rights of access and deletion. - **Accountability.** You must be able to demonstrate compliance, which for consent means being able to prove it (Article 7(1)). **Territorial scope.** Under Article 3(1), the GDPR applies to the processing carried out by any business established in the EU, wherever the processing physically happens. Under Article 3(2), it also applies to businesses outside the EU when they offer goods or services to people in the EU or monitor their behaviour in the EU. Analytics and advertising cookies that build profiles of EU visitors are a textbook case of monitoring. ## Who does GDPR apply to? In practice, if people in the EU visit your website and you run anything beyond strictly necessary cookies, the GDPR concerns you. That includes: - **EU businesses of any size**, from a local shop with a contact form to a large e-commerce site. There is no small business exemption for consent. - **Non-EU businesses targeting or tracking EU visitors**, such as a US SaaS company running Google Analytics, a Meta Pixel or LinkedIn Insight Tag on pages read by Europeans. Article 27 generally requires these businesses to appoint a representative in the EU, unless their processing is occasional and low risk. - **Agencies and freelancers** who build and run sites for clients. The client is usually the controller, but the person who installs the tags shapes compliance. - **Third-party vendors** whose scripts run on your site. The Court of Justice of the EU ruled in Fashion ID (C-40/17, 29 July 2019) that a website embedding a Facebook "Like" button can be a **joint controller** with Facebook for the collection and transmission of visitor data. You cannot simply blame the vendor: if you embed the tag, you share responsibility for that first step. UK websites now follow the UK GDPR and PECR, enforced by the ICO, which mirror these principles but are separate laws. ## What GDPR requires for cookies and consent ### Legal basis: consent for anything non-essential Article 6 lists six legal bases for processing personal data. For cookies that are not strictly necessary (analytics, advertising, social media plugins, most A/B testing tools), the basis is **consent** under Article 6(1)(a). The EDPB cookie banner taskforce confirmed in January 2023 that legitimate interest cannot justify placing or reading such cookies, and that if no valid consent is collected where it is required, the subsequent processing cannot comply with the GDPR either. ### The four qualities of valid consent The EDPB Guidelines 05/2020 on consent (adopted on 4 May 2020) translate Article 4(11) into concrete rules: - **Freely given.** Access to your content must not depend on accepting cookies. The EDPB gives the example of a script that hides the page until the user clicks "Accept cookies": since there is no genuine choice, the consent is not freely given. This is the so-called **cookie wall**. - **Specific and granular.** People must be able to choose purpose by purpose (analytics, advertising, personalisation) rather than accept a bundle. - **Informed.** At a minimum, the EDPB lists the identity of the controller, the purpose of each processing operation, the type of data collected and the existence of the right to withdraw consent. - **Unambiguous.** Consent needs a clear affirmative action. Recital 32 states that "silence, pre-ticked boxes or inactivity" do not constitute consent, and the EDPB adds that scrolling or swiping through a page does not count either. ### Prior consent Non-essential cookies must not be set, and tracking scripts must not fire, until the visitor has said yes. The taskforce report recalls that by default no cookie requiring consent can be set without consent, expressed by a positive action. A banner that displays a choice while Google Analytics already loads in the background does not meet this rule. ### Exemptions Cookies that are strictly necessary for a service the user explicitly requested (a shopping cart, a login session, load balancing, remembering the consent choice itself) need no consent. That exemption comes from the ePrivacy Directive. The EDPB has warned against classifying marketing or analytics cookies as "essential" to avoid asking: website owners must be able to show why each cookie listed as essential really is. ### Duration and retention The GDPR sets no fixed lifetime for a cookie or a consent. It requires that personal data is kept no longer than necessary for its purpose (Article 5(1)(e)). In practice, set reasonable cookie lifetimes, renew consent periodically, and ask again whenever you add a new vendor or purpose. National regulators publish their own recommended durations. ### Withdrawal Article 7(3) gives people the right to withdraw consent at any time, and withdrawing must be **as easy as giving consent**. If accepting took one click on a banner, refusing later should not require an email to your support team. The taskforce suggests a small, permanently visible icon or a link in a standard place such as the footer. ### Proof Article 7(1) puts the burden of proof on you: where processing is based on consent, you must be able to demonstrate that the person consented. That means keeping a consent log with a timestamp, the choices made, the version of the banner and its text, and an identifier linking the record to the browser. Without that log, your consent effectively does not exist in an audit. ## A GDPR-compliant cookie banner A compliant banner turns all of the above into a few design decisions. On the first layer it should show: - a short, plain explanation of what you use cookies for and who receives the data (your company and the main third parties); - an **Accept all** button and a **Reject all** button, at the same level and with comparable visual weight; - a **Customise** or **Settings** button opening a second layer with purpose-by-purpose toggles, all **unticked** by default; - a link to your cookie policy with the full list of cookies, their purpose and lifetime. The EDPB cookie banner taskforce identified several practices that do not produce valid consent: - no reject option on a layer that contains an accept button; - pre-ticked boxes in the settings layer; - a reject option hidden as a plain text link in a paragraph, or placed outside the banner, without enough visual support to be noticed; - a reject button whose text contrast is so low that it is unreadable; - "legitimate interest" toggles buried in deeper layers, forcing people to refuse twice; - marketing or analytics cookies mislabelled as essential. Once a choice is made, the banner should disappear and the visitor should be able to reopen their settings at any time to change their mind. For layouts, wording and screenshots, read our [GDPR-compliant cookie banner guide](https://www.flowconsent.com/en/blog/cookie-banner-gdpr-compliance-guide), and see [what the CNIL prohibits in consent banners](https://www.flowconsent.com/en/blog/cookie-dark-patterns-cnil-prohibited) for a regulator's view of dark patterns. ## Penalties and enforcement Each EEA country has an independent data protection authority (the CNIL in France, the Belgian Data Protection Authority, the Irish Data Protection Commission and so on), and the European Data Protection Board coordinates them. For cross-border cases, the GDPR's one-stop-shop gives a lead authority to the country of the company's main establishment. Note that the one-stop-shop does not apply to the ePrivacy rules on placing cookies, so national authorities can act directly on banners. Under Article 83(5), infringements of the basic principles, including the conditions for consent, can be fined up to **€20 million or 4% of total worldwide annual turnover** of the preceding financial year, whichever is higher. Other infringements are capped at €10 million or 2% (Article 83(4)). Two real cases show where regulators focus: - **Criteo, €40 million (CNIL, 15 June 2023).** The French authority fined the adtech company for failing to verify that the people whose data it processed had given their consent. Criteo's trackers sat on partner websites, and the company argued that its partners were responsible for collecting consent. The CNIL's Restricted Committee found breaches of Articles 7, 12, 13, 15, 17 and 26 of the GDPR (deliberation SAN-2023-009). The lesson: if you rely on consent collected by someone else, you still need to be able to prove it. - **IAB Europe, €250,000 (Belgian Data Protection Authority, 2 February 2022).** The Belgian authority found that the Transparency and Consent Framework (TCF), used by many cookie banners for programmatic advertising, did not comply with several GDPR provisions. In a ruling announced on 14 May 2025, the Market Court annulled the decision on procedural grounds but endorsed its reasoning: the TC String that stores a user's choices is personal data, IAB Europe is a joint controller, and the €250,000 fine stands. Fines are only part of the risk. Authorities can also order you to delete data collected without valid consent, and people can complain or claim compensation. ## Compliance checklist 1. **Scan your site** to list every cookie, pixel and third-party script, page by page. 2. **Classify each tracker** as strictly necessary or not, and document why the "necessary" ones really are. 3. **Block non-essential scripts until consent**, including tags fired through Google Tag Manager. 4. **Put Accept and Reject side by side** on the first layer, with equal prominence. 5. **Offer granular choices** by purpose, with all toggles off by default. 6. **Name the controller and the main recipients** and explain each purpose in plain language. 7. **Log every consent and refusal** with timestamp, choices and banner version, and keep the log exportable. 8. **Provide a permanent way to withdraw**, such as a floating icon or footer link. 9. **Check your vendors' contracts**, especially joint controller arrangements for embedded pixels and plugins. 10. **Re-ask for consent** when you add new purposes or vendors, and rescan after every site update. ## How FlowConsent helps you comply with GDPR FlowConsent puts the GDPR consent rules into practice without a legal team. It blocks scripts before consent, so analytics and ad tags only fire once a visitor says yes. The banner offers Accept and Reject side by side and granular categories, and the automatic scan detects new cookies as your site changes. Every choice is recorded, and you can export the proof of consent that Article 7(1) asks for: see how in our [proof of consent documentation](https://www.flowconsent.com/en/doc/proof-report). Google Consent Mode v2 is built in, data is hosted in Europe, and setup takes about ten minutes. Start with our [free scanner](https://www.flowconsent.com/en/scan) to see what your site sets today, then [create your account](https://app.flowconsent.com/auth/register): it is free up to 25,000 sessions per month, and Pro costs €14.99 per month for up to 100,000 sessions. ## Further reading The articles below go deeper on each GDPR requirement covered here. Start with [the 7 requirements for valid GDPR consent](https://www.flowconsent.com/en/blog/gdpr-consent-validity-requirements) if you want the legal detail, or with the proof of consent guide if you are preparing for an audit. The others cover cookie categories, Google Analytics and the latest changes for 2026. Further reading ## Go further on GDPR. Practical guides from our blog to put these rules into practice on your site. [Blog](https://www.flowconsent.com/en/blog/gdpr-consent-validity-requirements) ### [GDPR consent validity: the 7 requirements explained](https://www.flowconsent.com/en/blog/gdpr-consent-validity-requirements) [Read the article ](https://www.flowconsent.com/en/blog/gdpr-consent-validity-requirements)· [Blog](https://www.flowconsent.com/en/blog/cookie-banner-gdpr-compliance-guide) ### [GDPR-compliant cookie banner: the complete guide](https://www.flowconsent.com/en/blog/cookie-banner-gdpr-compliance-guide) [Read the article ](https://www.flowconsent.com/en/blog/cookie-banner-gdpr-compliance-guide)· [Blog](https://www.flowconsent.com/en/blog/proof-of-cookie-consent-what-to-store) ### [Proof of cookie consent: what to store and for how long](https://www.flowconsent.com/en/blog/proof-of-cookie-consent-what-to-store) [Read the article ](https://www.flowconsent.com/en/blog/proof-of-cookie-consent-what-to-store)· [Blog](https://www.flowconsent.com/en/blog/gdpr-cookie-categories-guide) ### [The 4 GDPR cookie categories: a complete guide](https://www.flowconsent.com/en/blog/gdpr-cookie-categories-guide) [Read the article ](https://www.flowconsent.com/en/blog/gdpr-cookie-categories-guide)· [Blog](https://www.flowconsent.com/en/blog/google-analytics-gdpr-compliant) ### [Is Google Analytics GDPR compliant? The complete GA4 guide](https://www.flowconsent.com/en/blog/google-analytics-gdpr-compliant) [Read the article ](https://www.flowconsent.com/en/blog/google-analytics-gdpr-compliant)· [Blog](https://www.flowconsent.com/en/blog/gdpr-cookies-2026-what-changed) ### [GDPR and cookies in 2026: what changed and what is coming](https://www.flowconsent.com/en/blog/gdpr-cookies-2026-what-changed) [Read the article](https://www.flowconsent.com/en/blog/gdpr-cookies-2026-what-changed) Questions ## GDPR and cookies: your questions Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Does the GDPR actually mention cookies? Only briefly. Recital 30 explains that people can be identified through online identifiers such as cookie identifiers and IP addresses, which makes most tracking data personal data. The rule that you need consent before setting a cookie comes from Article 5(3) of the ePrivacy Directive. The GDPR then defines what that consent must look like and governs everything you do with the data afterwards. ### Is my website subject to the GDPR if my company is outside the EU? Very likely, if you target or track people in the EU. Article 3(2) applies the GDPR to businesses outside the EU that offer goods or services to people in the EU or monitor their behaviour there. Analytics and advertising cookies that profile EU visitors count as monitoring. Article 27 may also require you to appoint a representative in the EU. ### Can I rely on legitimate interest instead of consent for cookies? Not for non-essential cookies. The EDPB cookie banner taskforce confirmed in 2023 that legitimate interest cannot be the legal basis for placing or reading cookies covered by Article 5(3) of the ePrivacy Directive. Once valid consent is required for the cookie, the processing that follows (analytics, ad targeting) should rest on that consent too, not on a legitimate interest hidden in a second layer. ### Is a banner with only an Accept button and a Settings link compliant? In most of Europe, no. In the 2023 cookie banner taskforce report, a vast majority of EU authorities considered that a banner without a refuse or reject option on a layer that has an accept button does not produce valid consent. The safe design puts Accept and Reject side by side on the first layer, with equal visual weight. ### How long is cookie consent valid under the GDPR? The GDPR sets no fixed period. It requires that data is kept no longer than necessary (Article 5(1)(e)) and that consent stays specific and informed, so you should ask again when your purposes or vendors change. National authorities publish their own recommended durations, so check the guidance of the regulator in each country where your audience lives. ### What counts as proof of consent? Article 7(1) says the controller must be able to demonstrate that the person consented. In practice, keep a record of when consent was given, what the banner said at that moment, which purposes or vendors were accepted or refused, and a pseudonymous identifier linking the record to the browser. Store it securely and make it exportable for an audit or complaint. ## Official sources The texts and guidance this page is based on. - [Regulation (EU) 2016/679 (GDPR), official text on EUR-Lex ](https://eur-lex.europa.eu/eli/reg/2016/679/oj)eur-lex.europa.eu - [EDPB Guidelines 05/2020 on consent under Regulation 2016/679 ](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en)www\.edpb.europa.eu - [EDPB, Report of the work undertaken by the Cookie Banner Taskforce (17 January 2023) ](https://www.edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf)www\.edpb.europa.eu - [CNIL Restricted Committee deliberation SAN-2023-009 of 15 June 2023 (published by the EDPB) ](https://www.edpb.europa.eu/system/files/2023-08/fr_2023-06decisionpublic_redacted.pdf)www\.edpb.europa.eu - [EDPB Annual Report 2023 (CNIL sanction against Criteo) ](https://www.edpb.europa.eu/system/files/documents/2024-04/edpb_annual_report_2023_en.pdf)www\.edpb.europa.eu - [Belgian Data Protection Authority, Market Court ruling in the IAB Europe case ](https://www.dataprotectionauthority.be/citizen/the-market-court-rules-in-the-iab-europe-case)www\.dataprotectionauthority.be - [Court of Justice of the EU, press release 99/19, Fashion ID (C-40/17) ](https://curia.europa.eu/jcms/upload/docs/application/pdf/2019-07/cp190099en.pdf)curia.europa.eu Other laws ## Other cookie and privacy laws. [ePrivacy Directive · Opt-in](https://www.flowconsent.com/en/laws/eprivacy-directive) ### [ePrivacy Directive and cookies: the rule behind every consent banner](https://www.flowconsent.com/en/laws/eprivacy-directive) [Read the guide ](https://www.flowconsent.com/en/laws/eprivacy-directive)· [CCPA / CPRA · Opt-out](https://www.flowconsent.com/en/laws/ccpa-cpra) ### [CCPA and CPRA cookies: what California law requires from your website](https://www.flowconsent.com/en/laws/ccpa-cpra) [Read the guide ](https://www.flowconsent.com/en/laws/ccpa-cpra)· [UK GDPR / PECR · Opt-in](https://www.flowconsent.com/en/laws/uk-gdpr-pecr) ### [UK GDPR, PECR and cookies: what UK law requires from your website](https://www.flowconsent.com/en/laws/uk-gdpr-pecr) [Read the guide ](https://www.flowconsent.com/en/laws/uk-gdpr-pecr)· [TDDDG · Opt-in](https://www.flowconsent.com/en/laws/tdddg) ### [TDDDG and cookies: what Germany's section 25 requires from your website](https://www.flowconsent.com/en/laws/tdddg) [Read the guide ](https://www.flowconsent.com/en/laws/tdddg)· [nFADP · Opt-out](https://www.flowconsent.com/en/laws/nfadp-switzerland) ### [Swiss nFADP and cookies: what the revised Data Protection Act requires from your website](https://www.flowconsent.com/en/laws/nfadp-switzerland) [Read the guide ](https://www.flowconsent.com/en/laws/nfadp-switzerland)· [LGPD · Mixed](https://www.flowconsent.com/en/laws/lgpd-brazil) ### [LGPD and cookies: what Brazil's data protection law requires from your website](https://www.flowconsent.com/en/laws/lgpd-brazil) [Read the guide ](https://www.flowconsent.com/en/laws/lgpd-brazil)· [LOPDGDD · Opt-in](https://www.flowconsent.com/en/laws/lopdgdd-spain) ### [LOPDGDD and cookies: what Spanish law requires from your website](https://www.flowconsent.com/en/laws/lopdgdd-spain) [Read the guide](https://www.flowconsent.com/en/laws/lopdgdd-spain) [See all laws](https://www.flowconsent.com/en/laws) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)