A cookie consent banner is the notice that asks visitors for permission before a site sets non-essential cookies. In the EU and UK it must block those cookies until the visitor opts in, offer reject as easily as accept, name each purpose and let people change their mind later.
This guide is part of the analytics, tracking and privacy hub. It covers cookie consent banner requirements, example wording, design rules, Google Consent Mode v2 and a browser test. Rules differ by country and change over time, so treat this as practical guidance, not legal advice: a lawyer or your national data protection authority has the final word.
What must a cookie consent banner include under EU and UK rules?
A cookie consent banner must collect prior, opt-in consent for every cookie or similar technology that is not strictly necessary, after explaining the purposes in plain language. It must offer a real way to refuse, record the choice and let visitors withdraw consent as easily as they gave it. Exempt cookies, such as a login session, need no consent.
The legal base in the EU is Article 5(3) of the ePrivacy Directive. It allows storing or reading information on a device only with consent based on clear and comprehensive information, except for transmitting a communication or providing a service the user explicitly asked for. The GDPR defines what valid consent is.
The EDPB cookie banner taskforce report, adopted in January 2023, adds three conditions on withdrawal: it must be possible, possible at any time and "as easy as to give consent." A compliant banner has five parts:
- A clear statement of the purposes that need consent.
- Accept and reject options on the same layer, plus a route to granular settings.
- Purpose categories that are off by default.
- A list of third parties that receive data, or a clearly signposted link to one.
- A persistent way back to the settings, such as a footer link.
What should the cookie consent text say on each layer?
Good cookie consent text names the site, the purposes and the choice in two or three short sentences on the first layer, then gives each purpose its own toggle and description on the second layer. The wording should tell visitors that rejecting is possible and that they can change their choice later.
A layered banner is a banner with a short first layer and a second layer with details and per-purpose controls. This cookie consent message example is a hypothetical template, not wording a regulator has approved.
First layer (hypothetical example):
We use cookies to measure how this site is used and to show and measure ads on other sites. Some are needed for the site to work. The others are only set if you accept them. You can change your choice at any time via "Cookie settings" in the footer.
Buttons: Accept all | Reject all | Customize
Second layer (hypothetical example):
- Strictly necessary (always on): keeps the site secure, remembers your cookie choice and keeps items in your cart.
- Analytics (off): counts visits and shows which pages are used, so we can improve the site. Providers: name each one.
- Advertising (off): measures ad results and lets advertising partners show you relevant ads on other sites. Providers: name each one.
- Buttons: Save choices | Reject all | Accept all
The ICO's consent mechanism checklist expects visitors to see who the third parties are, on the first layer or on a second layer it clearly points to. Replace "name each one" with real vendor names.
Which cookie consent banner design choices count as dark patterns?
A dark pattern in a cookie consent banner is a design that steers visitors toward accepting rather than letting them choose freely. European regulators have named the common ones: no reject option next to accept, pre-ticked boxes, a reject link buried in body text, unreadable reject buttons and legitimate interest toggles that are switched on.
Cookie consent banner design is judged case by case: the EDPB taskforce agreed that "a general banner standard concerning colour and/or contrast cannot be imposed," but it still named practices that fail.
| Design choice | Regulator position | Safer alternative |
|---|---|---|
| Accept button on the first layer, reject only in settings | Most EU authorities in the EDPB taskforce see no reject option on a layer with a consent button as an infringement | Put "Reject all" next to "Accept all" |
| Pre-ticked purpose boxes | Not valid consent under GDPR recital 32 and ePrivacy, per the EDPB taskforce | All non-essential toggles off by default |
| Reject as a small text link inside a paragraph | Not valid without enough visual support to draw attention, per the EDPB taskforce | A button with the same size and style as accept |
| Reject button with near-invisible contrast | Could be manifestly misleading, per the EDPB taskforce | Equal contrast and font size for both choices |
| Legitimate interest toggles switched on | The legal basis for setting cookies cannot be legitimate interest (EDPB taskforce, ICO) | Ask consent for each purpose |
| "By continuing to browse you accept" | Scrolling is not valid consent (CNIL, 2019); the ICO lists it as bad practice | Require a click on a button |
The CNIL has enforced this since its guidelines of October 1, 2020. By December 2021 it had sent orders to comply to nearly 90 organizations that did not make refusing cookies as easy as accepting them.
How do EU, UK and US rules differ for a GDPR cookies popup?
EU rules require opt-in consent for all non-essential cookies, with narrow national exemptions such as France's for audience measurement. Under a 2025 law, the UK exempts analytics used only for statistics, if visitors can object. California's CCPA uses an opt-out model, so many sites show a full GDPR cookies popup only to European visitors.
The UK change comes from the Data (Use and Access) Act 2025. The ICO finalized its guidance on storage and access technologies on April 29, 2026. Its statistical purposes exception "doesn't apply to things like online advertising."
| Question | EU (ePrivacy plus GDPR) | UK (PECR after the 2025 Act) | California (CCPA) |
|---|---|---|---|
| Analytics cookies | Consent, unless a national exemption applies (CNIL: audience measurement under strict conditions) | No consent for statistics only, with clear information and a free way to object | Opt-out if the data is sold or shared |
| Advertising cookies | Opt-in consent | Opt-in consent | Opt-out of sale or sharing |
| Default state of toggles | Off | Statistics may be on, advertising off | Not applicable |
| Required control | Accept, reject, settings, withdrawal | Accept, reject, settings, objection | "Do Not Sell or Share My Personal Information" link |
The CNIL's analytics exemption applies only when the tool is limited to audience measurement and A/B testing for one publisher, visitors are informed and can object, data is not combined with other processing and trackers expire after 13 months. For California, the Attorney General's CCPA page sets out the opt-out link and Global Privacy Control duties.
How does a cookie consent banner connect to Google Consent Mode v2?
Google Consent Mode v2 is the API that passes the choice from your cookie consent banner to Google tags, which then adjust what they store and send. The banner asks the question, and consent mode carries the answer. Without consent signals for EEA users, Google cannot verify consent, which can cost measurement and remarketing data.
Google's consent mode overview lists the consent types. The four that matter for marketers are ad_storage, analytics_storage, ad_user_data and ad_personalization; Google added the last two in November 2023 (consent mode v2). Google's About consent mode page states that consent mode "doesn't provide a consent banner or widget."
Your site sets a default state before any tag fires and updates it on click. Google's setup guide recommends scoping the defaults to the regions where you show a banner:
gtag('consent', 'default', {
'ad_storage': 'denied',
'ad_user_data': 'denied',
'ad_personalization': 'denied',
'analytics_storage': 'denied'
});
Basic consent mode blocks Google tags until the visitor interacts with the banner. Advanced consent mode loads tags with denied defaults and sends cookieless pings that Google uses for conversion modeling in Google Ads and GA4.
Google's EU user consent policy applies to users in the EEA, the UK and Switzerland. It requires valid consent, consent records, withdrawal instructions and a list of each party that receives data. Missing consent signals also affect measurement work such as Google Ads Conversion Lift, where Google recommends consent mode before a study starts.
How do you choose a consent management platform?
A consent management platform (CMP) is software that shows the cookie banner, blocks tags until consent, stores each choice and passes it to tags such as Google's. Pick one by your business model first: publishers who serve personalized Google ads need a Google certified CMP, while advertisers mainly need a reliable consent mode integration.
Google runs two separate lists that are easy to confuse:
- Google certified CMPs are required for publishers using AdSense, Ad Manager or AdMob who serve personalized ads in the EEA and UK (since January 16, 2024) and Switzerland (since July 31, 2024), according to Google's consent management requirements. These CMPs integrate with the IAB Transparency and Consent Framework (TCF).
- The CMP Partner Program lists CMPs integrated with Consent Mode and Google Tag Manager, sorted into Gold, Silver and Bronze tiers. Advertisers can also use a CMP that is not a partner.
| Your situation | What you need | Route to consider |
|---|---|---|
| You show Google ads on your own site to EEA, UK or Swiss visitors | TCF strings that Google accepts | A CMP from Google's certified CMP list |
| You buy Google Ads and use GA4, no ads on your site | Consent mode v2 signals and tag blocking | A CMP Partner Program member or a tested Tag Manager template |
| You run Meta, TikTok or other pixels too | Blocking for non-Google tags as well | A CMP that blocks every tag by category, not only Google's |
Non-Google pixels need the same blocking: some measure by default until told otherwise, as the guide to ChatGPT Ads conversion tracking shows for OpenAI's pixel.
How do you test that your cookie consent banner actually works?
Test a cookie consent banner in three states: before any choice, after "Reject all" and after withdrawing an earlier consent. In each state, check which cookies are stored and which tracking requests leave the browser. Regulators fine banners that look right but still set cookies.
According to the CNIL's announcement, American Express France was fined 1.5 million euros in November 2025 because cookies were placed before visitors made a choice, were placed despite a refusal and were still read after consent was withdrawn. The three-state consent test below checks exactly those failures.
- Open a clean session. Use a private window with developer tools open on the cookies and Network tabs.
- Check the state before any choice. Load the page without clicking and confirm that no advertising or analytics cookies or requests appear, apart from cookieless pings in advanced consent mode.
- Click "Reject all" and browse. Visit a few pages and confirm that no non-essential cookies appear.
- Accept, then withdraw. Accept all, confirm tags fire, then withdraw in the settings and confirm that tags stop.
- Repeat on mobile and for each region. Region-specific banners often behave differently.
Common mistakes with a cookie consent banner
The most common mistakes with a cookie consent banner happen in implementation, not in the wording. A banner can show the right buttons and still load tags early, ignore a refusal or forget a choice, and those failures are what regulators have fined. Most can be caught with the three-state consent test.
- Tags fire before the banner loads. Hardcoded pixels ignore the CMP. Move every tag into Tag Manager or the CMP and set denied defaults first.
- Reject only lives in the settings layer. Refusing takes extra clicks. Add "Reject all" next to "Accept all".
- Everything is labeled strictly necessary. The EDPB taskforce flagged cookies wrongly classified as essential. Keep that category for security, cart and consent storage.
- Consent mode v2 is missing ad_user_data and ad_personalization. Older setups only send ad_storage and analytics_storage. Update the CMP or template.
- No way back to the settings. Withdrawal must be as easy as consent. Add a "Cookie settings" link in the footer or a small persistent icon.
- Ignoring measurement gaps after launch. Consent rates change what GA4 and ad platforms see, which shifts the data behind your attribution models. Annotate the launch date.
