GDPR Cookie Consent: Practical Compliance Guide
What EU law actually requires for cookies and trackers under GDPR and ePrivacy — and how to verify your site complies with a free scan.
Who this applies to
Any website serving visitors in the EU/EEA that uses non-essential cookies or trackers (analytics, advertising, social pixels, embedded video). It doesn't matter where your company is based.
Practical technical guidance, not legal advice.
Key requirements
Prior consent
No non-essential cookies or trackers before the user actively consents. Loading Google Analytics on pageview — before any click — is non-compliant.
Freely given & specific
No pre-ticked boxes. Consent must be opt-in per purpose (necessary, analytics, marketing), not bundled into one 'accept all' with no alternative.
As easy to reject as accept
'Reject all' must be as prominent as 'Accept all'. Hiding reject behind layers of settings has drawn enforcement action.
Withdrawable
Users must be able to change their mind as easily as they consented — a persistent settings link, not a buried page.
Documented
You must be able to prove when and what each user consented to (consent records).
How AIClicks helps
Cookie consent checker
Detects tracking scripts present before consent and flags pre-ticked patterns.
Full site scan
Privacy module covers consent, tracker inventory, and data-exposure checks with evidence.
Monitoring
Alerts you when a site update reintroduces pre-consent trackers.
Compliance steps
- Run the free cookie checker to see what's loading before consent today.
- Deploy a consent manager in blocking mode (scripts gated on consent state).
- Configure per-purpose toggles with reject-as-easy-as-accept.
- Re-scan to verify zero trackers fire before interaction.
- Set up monitoring so future deploys don't regress.
FAQ
Is this legal advice?
No. This is practical technical guidance. For legal questions, consult a privacy lawyer.
What are the fines?
GDPR fines reach up to €20M or 4% of global turnover. Cookie-specific enforcement has produced many smaller but painful fines across the EU.
Does 'legitimate interest' cover analytics?
No — EU regulators consistently require consent for non-essential cookies including analytics.
More guides: NIS2 Website Security: What It Means in Practice · Email Authentication (SPF, DKIM, DMARC): Deployment Guide · EU AI Act Transparency: Website & Content Obligations · all guides