What a compliant cookie banner looks like
A cookie banner asks for consent before services load that need it. Rejecting must be as easy as agreeing, and nothing beyond the necessary may be ticked in advance.
How it works
If your website uses services that need consent, you have to ask first. These are mainly statistics and marketing, but also external content such as videos or maps that send data to third parties as they load. The banner is the tool for this, usually provided by a consent tool (also called a CMP, consent management platform).
Under Article 4(11) and Article 7 of the GDPR, valid consent is freely given, specific, informed and unambiguous. Recital 32 of the GDPR states explicitly that silence, pre-ticked boxes or inactivity do not constitute consent.
If you need no consent because nothing of the kind loads, you need no banner either. bytereport only rates a missing banner as an error when something that needs consent loads before it.
What matters
- Reject on the first level. Rejecting must be as easy as agreeing. If visitors can agree with one click, a reject button right next to it is the safe way. If “Reject” sits behind “Settings” or is missing altogether, rejecting is harder than agreeing. bytereport looks for the button in the banner first, then in the settings.
- Equal design. “Reject” is as large and as legible as “Accept”, not a faint text link next to it.
- No preselection. In the settings, only the “necessary” category is permanently on. Statistics, marketing and external media stay off until someone switches them on.
- Ask in an informed way. The banner names purposes and services in plain words and links the privacy policy.
- Ask first, load later. A banner only helps if the services really wait for the choice (see before consent).
How to set it up
You set the buttons and the preselection in the consent tool, usually where the banner's layout or content is configured. The common tools can show a “Reject all” button on the first level and switch categories off by default. Whoever looks after the website, or your agency, does this. Afterwards, check in a private window how the banner looks on a first visit, on a computer and on a phone.
This is not legal advice; your data protection officer or a lawyer decides the individual case.