Prefer to listen? Click play for AI narration

If you run a small business, your cookie banner is often the first thing a visitor sees. It is also one of the first things we look at when we audit a website. Anyone can check it in seconds, and European data protection authorities have reviewed banners in coordinated actions.

Most banner problems are design choices, not legal puzzles. Here are the five mistakes we check first, what the law says, and how to fix each one.

First, the rules in one minute

Two laws work together here:

Mistake 1: Pre-ticked boxes or “implied” consent

What it looks like: analytics and marketing toggles that are already switched on, or a banner that says “By continuing to browse, you accept cookies.”

What the law requires: GDPR Recital 32 states plainly that “silence, pre-ticked boxes or inactivity should not therefore constitute consent.” The Court of Justice of the EU confirmed this for cookies in Planet49 (C-673/17, judgment of 1 October 2019): a pre-ticked checkbox that the user must untick to refuse does not give valid consent. The Court also held that this applies whether or not the information stored on the device is personal data, and that users must be told how long cookies last and whether third parties can access them.

The EDPB Guidelines 05/2020 on consent go further: merely continuing to use a website is not an indication of consent, and scrolling or swiping “will not under any circumstances” satisfy the requirement of a clear and affirmative action.

How to fix it:

Mistake 2: No equal “Reject all” on the first layer

What it looks like: a big “Accept all” button, next to “Settings” or “Manage preferences”. To refuse, the visitor has to open a second screen and switch things off one by one.

What the law requires: consent must be freely given, and refusing should not take more effort than accepting. In the EDPB Cookie Banner Taskforce report (adopted 17 January 2023), the vast majority of authorities considered that having no reject or refuse option on the same layer as the accept option breaches Article 5(3) of the ePrivacy Directive. Some national regulators, such as France's CNIL, had already taken this position in their own guidance and sanctions.

How to fix it:

Mistake 3: Cookies set before consent

What it looks like: the banner looks perfect, but when you open the browser's developer tools on the first page load, analytics, advertising or social media cookies are already there before anyone clicks.

What the law requires: Article 5(3) requires consent before storing or accessing information on the device, unless the exemption for strictly necessary cookies applies. A banner that asks for consent after the trackers have already loaded is just decoration. Under GDPR Article 7(1), you must also be able to show that consent was obtained.

How to fix it:

Mistake 4: Dark patterns in colours and layout

What it looks like: a bright, high-contrast “Accept” button and a pale grey “Reject” link. Or a reject option written as small text inside a paragraph. Or a banner that closes when you click the X and quietly counts that as consent.

What the law requires: the Taskforce report addresses several of these practices. Authorities agreed they cannot impose one standard colour or contrast on every website. Instead, each banner is assessed case by case to see whether its design is obviously misleading. The report also lists practices that can make consent invalid, including a reject option shown only as a link inside the text and misleading button design. The EDPB Guidelines 03/2022 on deceptive design patterns (written for social media platforms, but useful for understanding how regulators think) describe tactics such as “skipping”, “hindering” and “stirring” users towards a choice.

How to fix it:

Mistake 5: Withdrawing consent is harder than giving it

What it looks like: accepting takes one click on the homepage, but changing your mind means finding a link hidden at the bottom of the privacy policy, or emailing the company.

What the law requires: GDPR Article 7(3) is very clear: “It shall be as easy to withdraw as to give consent.” The person must also be told about this right before they give consent. The EDPB consent guidelines add that when consent is given with one mouse-click, swipe or keystroke, people must in practice be able to withdraw it equally easily, through the same interface.

How to fix it:

A quick self-check before you call it done

When we audit a site, we check in this order: default state, first layer, activity before a click, button design, then withdrawal. You can do the same in a private browser window.

If you'd rather have a fast first look, try GDPRGard's free 30-second AI audit. There's no signup. And if you want to know what's at stake, our free fine-risk calculator gives you a rough sense of your exposure.

FAQ

Do I need a cookie banner if I only use “essential” cookies?

Cookies that are strictly necessary for a service the user asked for (for example, a shopping cart or a login session) are exempt from consent under Article 5(3) of the ePrivacy Directive. Analytics and advertising cookies are generally not considered strictly necessary.

Is “Accept” plus “Settings” enough?

Generally, no. According to the EDPB Cookie Banner Taskforce report, most European authorities consider that the first layer must offer a way to refuse that is as accessible as the way to accept.

Can I use a “cookie wall” that blocks the site until people accept?

The EDPB Guidelines 05/2020 state that making access to content conditional on accepting cookies does not produce freely given consent. National rules and guidance can differ in their details, so check your country's regulator.

Does the cookie consent rule apply even if cookies don't contain personal data?

Yes. In Planet49, the Court of Justice held that the consent requirement in Article 5(3) applies to information stored on the user's device whether or not it is personal data.

How often should I re-check my banner?

Check it whenever you add a new tool, plugin or tracking tag, and after updates to your consent platform. Periodic checks help too.

Sources

This article is for general information only and isn't legal advice. National rules transposing the ePrivacy Directive vary across EU Member States, so check your local regulator's guidance or speak to a qualified professional about your specific situation.

Share this article

Also read:

⚠️ This article is for informational purposes only and does not constitute legal advice. For complex compliance situations, consult a qualified data protection professional. GDPR and EU AI Act requirements are subject to ongoing regulatory guidance — verify current obligations with your legal adviser.