Cookie Consent (GDPR/ePrivacy)

What valid cookie consent looks like under GDPR and ePrivacy, why pre-ticked banners and pre-loaded trackers fail compliance, and how to fix your banner.

What it is

Under GDPR and the ePrivacy Directive, non-essential cookies and trackers (analytics, ads, social pixels) require prior, freely-given, specific consent. That means: no tracking before the user clicks accept, no pre-ticked boxes, and rejecting must be as easy as accepting.

Why it matters

61% of sites we scan load tracking scripts before consent — a direct GDPR violation. EU data protection authorities have issued fines specifically for this pattern. It's also the easiest thing for a competitor or activist to report.

How to fix it

CMP setup

Use a consent manager (OneTrust, CookieYes, or open-source Klaro) in blocking mode — scripts load only after consent.

Tag Manager

Gate all marketing/analytics tags behind consent state; fire pageview only on 'consent granted'.

Audit

Re-scan after setup: view source should show no tracker URLs before interaction.

See if your site passes

Check your cookie consent free

FAQ

Is a cookie banner enough?

No. The banner must actually block trackers until consent. A banner that loads Google Analytics on pageview regardless of choice is non-compliant.

What about legitimate interest?

It doesn't cover advertising or analytics cookies in the EU. Consent is required for non-essential storage.

More explainers: HSTS (HTTP Strict Transport Security) · Content-Security-Policy (CSP) · DMARC (Domain-based Message Authentication) · SPF (Sender Policy Framework) · DKIM (DomainKeys Identified Mail) · X-Frame-Options / frame-ancestors · llms.txt (AI Crawler Guidance) · all checks