Cookie consent rules, and why most banners do not comply

Two rules do almost all the work, and both are about sequence rather than wording. Consent has to arrive before the tracker does, and refusing has to cost the visitor no more effort than agreeing. Nearly every banner that has been found unlawful failed one of those two, with entirely reasonable text sitting on top of it.

Consent has to arrive before the cookie does

The rule in the EU and UK comes from the ePrivacy Directive, implemented in the UK as regulation 6 of PECR: you may not store information on, or read information from, a user's device unless they have been given clear and comprehensive information and have consented. The consent standard is the GDPR one — a freely given, specific, informed and unambiguous positive act.

The consequence is an ordering requirement, and it is where implementations break. In September 2025 the CNIL fined Shein's Irish operating company €150 million after finding that advertising cookies were placed as soon as users arrived on the site, before they had interacted with the banner at all — and that when users did click "refuse all" or withdraw consent, new cookies were still set and existing ones were still read. The banner text was not the problem. The tag manager was.

Which trackers need consent, and which genuinely do not

The strictly necessary exception is narrow and it is judged from the user's point of view, not the business's. A session cookie, a load balancer, a security token, the contents of a basket: essential to a service the user asked for. Analytics is not, however useful it is to you — the user did not ask to be measured.

The UK diverged here in 2025. The Data (Use and Access) Act added new exceptions to PECR, and the ICO finalised its guidance on 29 April 2026. Low-risk analytics can now fall inside a "statistical purposes" exception, and adapting how a site looks to a stated preference inside an "appearance" exception. Neither removes the transparency duty: you must still describe what you are doing and give a simple, free way to object. The EU has no equivalent, so a site serving both markets is running two rules at once.

Reject has to be as easy as accept

The ICO's published checklist for consent mechanisms is explicit: the mechanism must make it as easy to refuse as to accept, it must require a positive action before non-exempt technologies are set, and its good-practice illustration shows equally prominent "accept all" and "reject all" buttons on the first layer. Its bad-practice illustration is a banner offering "accept all" and "more options" with no reject.

The CNIL has been issuing formal orders on exactly this point since 2021, and the design failures it names are familiar: a coloured accept button beside a grey link, a reject that needs two clicks, a "continue browsing" that is treated as agreement. Article 7(3) of the GDPR adds the other half — it must be as easy to withdraw consent as to give it, which means a durable control somewhere on the site and not only a first-visit banner.

The US model is opt-out, and the signal is the hard part

US state privacy law does not require prior consent for ordinary tracking. It gives residents a right to opt out of the sale of personal information and of targeted advertising, and requires you to make that right easy to exercise. As of June 2026, 24 states have enacted comprehensive privacy statutes, with Indiana, Kentucky and Rhode Island among those taking effect during 2026.

The part that catches people is the universal opt-out mechanism. From January 2026, Connecticut and Oregon joined California, Colorado, Delaware, Maryland, Minnesota, Montana, New Hampshire, New Jersey and Texas in requiring sites to recognise a browser-level signal — in practice Global Privacy Control. Your site has to read the header and act on it without the visitor doing anything else. California's updated regulations went further from 1 January 2026 and require a business to show on the site that the signal has been processed.

If you sell into both markets, build for prior consent and let the opt-out fall out of it. The reverse does not work: an opt-out architecture cannot be retrofitted into consent-before-setting, because the tags have already fired. The same logic applies to the vendors behind the tags — whether they are your processors and what they may do with the data is a data processing agreement question, and it decides whether a US-style "we do not sell data" claim survives contact with your ad stack.

How long consent lasts, and what you have to keep

Neither PECR nor the UK GDPR sets a fixed expiry. The ICO's guidance says the right interval depends on the scope of the original consent, how often people visit and whether your tracking has changed, and gives six months as a general guideline before asking again — particularly where someone has refused. Re-prompting a visitor who said no, on every visit, in the hope of a different answer, is specifically called out as unfair. If your purposes change, you need fresh consent regardless of when the last one was given.

Article 7(1) of the GDPR puts the burden of proof on you: where processing is based on consent, the controller must be able to demonstrate that the person consented. In practice that means a record, per visitor, of what was shown, what was chosen, when, and against which version of your tracker list. Most consent platforms store this; almost nobody checks that theirs does, or tests that an export can be produced.

A cookie policy is not a privacy policy

They answer different questions and are often wrongly merged. A privacy policy describes personal data across the whole business — what you collect, the lawful basis, retention, transfers, and the rights people can exercise. A cookie policy describes what is written to and read from the device, which is a narrower and much more concrete list, and it is the document the banner's second layer is really summarising.

Both pages describe the same infrastructure, so write them from one inventory. The cookie policy and privacy policy templates are built to be filled in from a single audit, and the wider question of which pages a site is actually obliged to publish is covered in which legal pages your website needs.

What is coming, and what to build now

The European Commission's Digital Omnibus, published in November 2025, proposes moving terminal-equipment consent into the GDPR itself and making browser-level signals binding on controllers. It is a proposal in negotiation, not law, and the earliest realistic application is 2027 or later. Nothing in it changes what you must do today.

What it does tell you is the direction: away from per-site banners and towards machine-readable preferences expressed once. That is the same direction the US states have already taken. A site built to read and obey a signal, with the banner as the fallback for visitors who send none, is the version that survives both the current rules and the next set. A site built the other way round will be rebuilt.