Getting started

Cookie banner rules in the EU: when you need consent

Almost every website uses cookies, and in the EU you often need your visitor's consent before you place them. That is why sites show a cookie banner. But a banner alone is not enough: the consent has to be valid. This guide explains which cookies need consent, what the law says about valid consent, what you have to tell visitors and how to set up a banner that respects the rules.

Updated 30 October 2026 7 min read
In short
  • Under the ePrivacy Directive you need consent to store or read information on a visitor's device, unless it is strictly necessary for a service the visitor asked for.
  • Consent must be freely given, specific, informed and unambiguous, given by a clear action.
  • Pre-ticked boxes, silence or inactivity do not count as consent.
  • Tell visitors what each cookie is for, how long it lasts and whether third parties can access it.
  • Withdrawing consent must be as easy as giving it, and you must be able to show that consent was given.

Which rules apply

Two pieces of EU law work together. The ePrivacy Directive (2002/58/EC, as amended in 2009) decides when you need consent for cookies and similar technologies. The General Data Protection Regulation (GDPR) decides what valid consent looks like. Each EU country has written the ePrivacy rules into its own law, so details can differ per country. The rules are not limited to cookies that hold personal data. The Court of Justice of the EU ruled in the Planet49 case that they apply whether or not the information stored on the device is personal data.
Good to know
This guide is general information, not legal advice. National rules and the guidance of national data protection authorities can add details, so check the rules in the countries where your visitors are.

When you need consent

Under Article 5(3) of the ePrivacy Directive, storing information on a visitor's device, or reading information already stored there, is only allowed if the visitor has given consent after clear and comprehensive information about the purposes. There are two exceptions: technical storage only to carry out the transmission of a communication, and storage that is strictly necessary to provide a service the visitor explicitly asked for. A cookie that remembers what is in a shopping cart is a typical example of the second.

Usually no consent needed

  • Cookies strictly necessary for a service the visitor requested, such as the shopping cart
  • Technical storage only to transmit a communication
Good to know
Your Europe, the EU's official business portal, lists tracking cookies used for behavioural advertising, analytics or market research among the cookies that need consent.

What valid consent looks like

The GDPR defines consent as a freely given, specific, informed and unambiguous indication of a person's wishes, by a statement or a clear affirmative action. Its recitals add that silence, pre-ticked boxes or inactivity do not constitute consent. In the Planet49 case the Court of Justice confirmed that a pre-ticked checkbox the user has to untick does not give valid consent for cookies. Consent has to come before the cookies are placed. Your Europe puts it plainly: cookies cannot be set when the page is first opened, only after you have the visitor's consent.
  • Freely given, specific, informed and unambiguous
  • Given by a clear action, such as clicking a button
  • No pre-ticked boxes
  • No consent assumed from silence or inactivity
  • Asked before optional cookies are placed
  • Separate choices per purpose, such as statistics and marketing

What you have to tell visitors

Consent only counts if the visitor knows what they agree to. Give clear information about the purposes of the cookies. The Court of Justice ruled in Planet49 that the information must also include how long cookies remain active and whether third parties may have access to them. A cookie policy page is the usual place for the full details, with a short summary in the banner.
  • What each type of cookie is for
  • How long the cookies remain active
  • Whether third parties can access them
  • How to change or withdraw consent

Withdrawing consent and keeping proof

Visitors may withdraw their consent at any time, and the GDPR requires that withdrawing is as easy as giving consent. In practice: if one click accepts cookies, changing your mind should not take ten. Offer a link or button on every page, for example in the footer, that reopens the cookie settings. The GDPR also says you must be able to demonstrate that someone consented. Keep a record of when consent was given and for which purposes.

Setting up a good cookie banner

A banner that follows these rules is clear, honest and balanced. Because consent must be freely given and easy to withdraw, the safe choice is to make refusing as easy as accepting.
  • Load only strictly necessary cookies until the visitor chooses
  • Offer accept and reject options that are equally easy to use
  • Let visitors choose per purpose, such as statistics and marketing
  • Leave every optional category unticked by default
  • Link to your cookie policy with purposes, duration and third parties
  • Add a permanent link to change the cookie settings
  • Record when and for what consent was given

Cookies on a SitePack site

SitePack sites come with a cookie bar where visitors accept or refuse optional cookies, and apps that use marketing cookies respect that choice. The Meta Pixel app, for example, only sends data after the visitor has given marketing consent. In the admin you write your cookie policy and privacy policy in their own editors, and links to your legal pages appear in the footer automatically.

Keep reading

Ready to get started?

Put your first version together today. Fourteen days free to try, no payment details needed.

Start free View pricing
Cookie preferences

Cookies help us provide, protect and improve our products and services. By using our website, you agree to our use of cookies.