GDPR cookie banner: what it must do, and what we found

The short answer

A GDPR cookie banner has to ask before any non-essential cookie or tag runs. It needs a Reject that is as easy to find and press as Accept, with nothing pre-ticked. It has to say what each cookie is for and who gets the data, and visitors must be able to change their mind later. When we loaded 72 European banners from a US connection, 25 had no Reject on the first screen and 26 were already sending data to trackers before anyone clicked.

The two laws behind it

The "GDPR cookie banner" rests on two laws. The ePrivacy Directive (Article 5(3)) says you need consent before you store or read anything on a visitor's device, unless it's strictly necessary for something they asked for. The GDPR sets the standard that consent has to meet: freely given, specific, informed and unambiguous.

So the cookie rule comes from ePrivacy, and the quality bar comes from the GDPR. A shopping cart cookie or a login cookie needs no consent. Analytics, advertising pixels and session recording do.

The requirements, with the source for each

What the banner must do	Where it comes from
Hold non-essential cookies and tags until the visitor says yes	ePrivacy Directive Art. 5(3). EDPB Cookie Banner Taskforce, para. 7: no cookies that need consent "can be set without a consent"
Treat only a clear action as consent. Scrolling or carrying on browsing doesn't count	GDPR Art. 4(11) and recital 32. EDPB Guidelines 05/2020, para. 86
Leave every optional box unticked	Court of Justice of the EU, Planet49 (1 October 2019). EDPB Taskforce, para. 10
Offer Reject wherever Accept appears	EDPB Taskforce, para. 8: a "vast majority" of EU regulators treat a missing reject option as an infringement
Make Reject as visible as Accept. A "refuse" link buried in the text, or unreadable contrast, falls short	EDPB Taskforce, paras. 14 and 18. CNIL: "Refuser doit désormais être aussi facile que d'accepter"
Let people into the site without accepting (no cookie wall)	EDPB Guidelines 05/2020, paras. 39 to 41
Let people choose by purpose, such as analytics apart from advertising	EDPB Guidelines 05/2020, para. 42
Say what each cookie is for, how long it lasts and whether third parties can read it	GDPR Art. 4(11) ("informed"). Planet49 (duration and third-party access)
Make it as easy to withdraw consent as to give it, at any time	GDPR Art. 7(3). EDPB Guidelines 05/2020, paras. 113 and 114. EDPB Taskforce, para. 32 (an icon or a link)
Keep proof of each consent	GDPR Art. 7(1)
Stop when someone says no	CNIL's €150 million fine against SHEIN (1 September 2025), partly for cookies placed after "Refuse all"

The UK follows the same idea under its own law, PECR, with the UK GDPR's consent standard. The ICO says it is consulting on revised cookie guidance, so check its page before relying on any change.

What we found on 160 European websites

On 14 October 2026 we took 160 random sites on EU country domains (.de, .fr, .it, .nl, .pl and others) from the Tranco top-sites list, between rank 20,000 and 200,000. That range covers mid-sized sites.

We loaded each one in a fresh browser set to the country's language, from a US connection. We read the banner's first screen and logged every request to an ad or analytics service, before any click and again after pressing Reject.

141 sites loaded, and 72 showed us a banner. We don't name them.

What we checked	Banners
Reject (or "only necessary", "continue without accepting") on the first screen	47 of 72
No Reject on the first screen	25 of 72
Reject and Accept with the same colour and roughly the same size	25 of 46 measured
Reject with no fill (outline or plain text) beside a filled Accept button	6 of 46
Sent data to a tracker, or set a tracking cookie, before any click	26 of 72
Sent only Google's cookieless pings (what Consent Mode sends while the answer is no) before any click	8 of 72
Still sent tracking data after Reject and a reload	10 of 45

Before any click, Google (with consent granted, or without Consent Mode, Google's way of passing the visitor's answer to its tags) heard from 15 sites. Microsoft's Clarity or ads tag heard from 7, Meta from 6, TikTok from 4 and LinkedIn from 3.

All 10 sites that kept tracking after Reject were already tracking before the click. That suggests the tags on those sites aren't connected to the banner at all.

The test has limits. Some sites apply their non-EU rules to a US address while still showing a banner, so the "before a click" figure may overstate what an EU visitor gets. And we loaded one page per site, so a homepage can differ from the rest of the site.

Where banners go wrong

No Reject on the first screen

The banner shows Accept and "Settings", and refusing takes a second screen. About a third of the banners we saw (25 of 72) did this, or showed Accept alone. The EDPB taskforce named it first, and it's an easy fix: add a "Reject all" button next to "Accept all".

A Reject that doesn't look like a button

A filled Accept button beside a plain text link. The EDPB taskforce judges colours case by case, but it says a "refuse" link tucked into the banner's text, with too little visual support to catch the eye, doesn't lead to valid consent. Giving both buttons the same style removes the doubt.

Our accessibility checklist covers the same buttons from the keyboard and screen-reader side.

Tags that fire anyway

The banner looks right, but a tag pasted into the theme or loaded above the banner script runs before anyone answers. Google's tags can listen through Consent Mode. Most other tags, Meta's pixel among them, run as soon as they load unless the banner holds them back.

No way back

After a visitor answers, the banner disappears and there's nothing to reopen it. A small button or a footer link fixes this.

Open a private window, ideally with a VPN set to an EU country, and load your homepage.
Is "Reject all" on the first screen, and as easy to see as "Accept all"?
Before clicking, open the browser's developer tools, go to the Network tab and filter for collect, facebook, clarity and bat.bing in turn. Reload. Anything there is tracking before consent, except a Google request marked gcs=G100, which is a cookieless ping Consent Mode sends by design.
Press Reject, reload, and check the Network tab again.
Look for a way to change your mind. Then click into a second page and make sure the banner remembers your answer.

If you sell to the US as well, the rules there work the other way round: visitors opt out rather than opt in. Our guide on whether you need a banner in the US covers that side.

How TagSentry's banner handles this

In the EU, EEA and UK, TagSentry's banner asks first. TagSentry's one line of code sets every Google Consent Mode signal to denied before any tag runs. Trackers pasted outside Tag Manager are held once you approve them, and Google's tags run cookieless by default until a visitor says yes.

Reject all and Accept all sit side by side on the first screen with the same look, and nothing is pre-ticked. Closing the banner without choosing (with Escape, or the X where your site shows one) stores nothing, and the defaults stay as they are. Visitors can reopen their choices from our button, or from a link in your footer.

Every answer is saved as a consent record of when the visitor answered, what they were shown and what they chose. Records are kept for 24 months with no IP address or browser details, and export as a CSV. How consent works has the detail for each region.