Cookie Consent Banner Requirements: What Your Website Actually Needs in 2026

Most cookie banners on the internet are non-compliant with the laws they're pretending to satisfy. A banner that just says "This site uses cookies" with an OK button, or one where "Accept" is a big blue button and "Reject" is a barely visible grey link, both fail the actual legal standard in the EU and UK. Here's what's actually required.

The legal basis

In the EU, cookie rules come from the ePrivacy Directive, implemented differently by each member state, working alongside GDPR for anything involving personal data. In the UK, the equivalent is PECR (Privacy and Electronic Communications Regulations), enforced by the ICO alongside UK GDPR. Both require prior, informed, freely given consent before setting non-essential cookies — not after the fact, not implied by continued browsing.

What counts as "non-essential"

• Strictly necessary (no consent required): cookies needed for the site to function — session cookies, load balancing, a shopping cart, security tokens.
• Everything else (consent required): analytics (including Google Analytics), advertising and retargeting pixels, social media embeds that track users, A/B testing tools, most chat widgets that set tracking cookies.

What a compliant banner actually needs

• Cookies must not be set before consent — the most commonly violated requirement. Analytics and ad scripts frequently fire on page load, before the user has interacted with the banner at all.
• Reject must be as easy as Accept. Regulators, including the UK ICO and French CNIL, have explicitly flagged banners with a prominent "Accept All" and a buried or multi-click "Reject" as non-compliant.
• No pre-ticked boxes. Consent has to be an affirmative act — pre-checked consent toggles don't count as consent under GDPR.
• Granular choice where you're using multiple categories of non-essential cookies — analytics vs. advertising, for instance — rather than one all-or-nothing toggle, at least for anything beyond the simplest setups.
• Easy withdrawal. A visible way to change cookie preferences after the fact, not just at first visit.
• A link to your cookie policy that actually lists the cookies in use, their purpose, and their duration.

Common banner mistakes

1. Loading Google Analytics or ad pixels immediately, with the banner appearing after the fact as a formality
2. "Accept" as a solid button, "Reject"/"Manage" as small grey text — a known dark pattern regulators actively pursue
3. Treating a banner dismissal (clicking the X or scrolling past) as consent — this generally does not count as valid consent
4. No functioning way to withdraw consent later without clearing browser cookies manually
5. A cookie policy that lists generic cookie categories instead of the actual cookies the site sets

What about the US?

US state privacy laws generally don't require prior consent for cookies the way GDPR/PECR do, but several — California's CCPA/CPRA among them — require a working "Do Not Sell or Share My Personal Information" opt-out where applicable, which functionally needs similar banner infrastructure even though the legal trigger is different.

Frequently asked questions

Do I need a cookie banner if I only use essential cookies?

No — strictly necessary cookies don't require consent. You should still disclose them in a cookie policy, but a consent banner isn't legally required if nothing non-essential is set.

Is a "cookie wall" that blocks access until you accept legal?

Generally not, under EU/UK guidance — consent has to be freely given, and blocking all site access unless someone accepts non-essential tracking is viewed as coercive rather than freely given consent.

Does using a cookie consent management platform make me compliant automatically?

No — the platform is a tool, not a guarantee. It still needs to be configured correctly: blocking scripts until consent, offering genuine reject options, and matching your actual cookie inventory.

This article is general information about how these documents and obligations usually work. It is not legal advice on your specific situation, and reading it does not create a lawyer-client relationship. Laws referenced here change — verify current requirements before relying on this for a live decision.