Consent Requirements Wizard

Do You Need Cookie Consent? Answer These Questions

Before your first visitor lands, two questions determine whether GDPR consent applies to your site. First: do any of your visitors come from the EU, EEA, or UK? If yes, GDPR and UK GDPR reach you regardless of where your servers are. Second: does your site set any cookies beyond those strictly necessary for the service to function? If both answers are yes, you need a lawful basis for each non-essential cookie — and for most tracking, analytics, and advertising cookies, that basis must be explicit consent.

The wizard above walks through these questions in sequence. The sections below explain the legal framework behind each answer.

GDPR Legal Bases — Consent vs Legitimate Interest vs Necessity

Article 6 GDPR defines six lawful bases for processing personal data. Three are practically relevant for websites: consent, legitimate interest, and necessity for contract performance. Choosing the wrong one is not a technicality — it is the processing itself that becomes unlawful.

When Consent Is Mandatory (Art. 7)

Article 7 GDPR sets out the conditions for valid consent. It must be freely given, specific, informed, and unambiguous. For cookies, the Article 29 Working Party guidance (now EDPB) is clear: non-essential cookies require prior consent before being set. This covers Google Analytics, Meta Pixel, advertising networks, A/B testing tools, and session-replay software. Article 7(3) adds that withdrawal must be as easy as giving consent — a user who accepted must be able to reject with equal effort. Pre-ticked boxes, consent buried in terms, and cookie walls (access conditional on acceptance) all fail the freely-given standard.

What GDPR consent actually requires goes beyond a banner — the technical implementation must match the legal promise. Read the full analysis of what GDPR consent actually requires to understand how consent integrates with identity and authentication.

When Legitimate Interest Applies

Legitimate interest under Art. 6(1)(f) requires a three-part test: a genuine interest, necessity of the processing to achieve it, and a balancing check confirming the user’s rights do not override it. For cookies, the ePrivacy Directive applies a stricter rule that sits on top of GDPR (see below). Even if GDPR legitimate interest passes the balancing test, the ePrivacy layer often requires consent anyway for any cookie that accesses or stores information on the user’s device. In practice, legitimate interest rarely justifies tracking cookies for EU users. It may, however, cover server-side log analysis, fraud prevention signals, and some security checks that do not involve setting cookies on the device.

ePrivacy Directive and GDPR — Two Laws, Both Apply to Cookies

A common mistake: treating GDPR as the only applicable law. The EU ePrivacy Directive (2002/58/EC, updated 2009) is older and, for cookies specifically, more stringent. It requires prior informed consent for any storage of information — or access to information stored — on a user’s terminal device, unless the cookie is strictly necessary for a service explicitly requested by the user.

“Strictly necessary” is interpreted narrowly: it covers session authentication, shopping cart state, load-balancing tokens, and security headers. It does not cover analytics, even when the data is claimed to be aggregated. It does not cover social-sharing buttons, advertising pixels, or A/B testing cookies. Each EU member state has transposed ePrivacy into national law with variations in enforcement, but the underlying requirement is consistent: prior consent before the cookie fires.

GDPR then governs what happens to the personal data collected through those cookies — legal basis, retention, data subject rights, processor agreements. Both laws apply in sequence: ePrivacy controls the act of setting the cookie; GDPR controls what you do with the resulting data. Meeting GDPR alone is not enough.

What a Valid Consent Banner Must Include

Article 7 GDPR and EDPB guidelines establish the minimum requirements for a compliant consent banner. Regulators have moved from formal checklists to enforcement of real-world effect, so design choices matter as much as policy language.

• No cookies before consent is given. Tracking scripts must not fire, and non-essential cookies must not be set, until the user makes an active choice. Loading analytics in parallel while the banner is displayed is a violation.
• A Reject All option at the same level as Accept All. Burying “Reject” in a secondary menu, making it grey text, or requiring extra clicks creates a dark pattern. The EDPB and national DPAs (France’s CNIL, Germany’s DSK, Ireland’s DPC) have all enforced this explicitly.
• Granular category controls. Users must be able to accept analytics without accepting advertising, and vice versa. A single “Accept all or reject all” toggle with no middle ground fails the specific and granular requirement.
• Named purposes and data recipients. “Third-party partners” is insufficient. The banner or its linked privacy notice must identify the categories of recipients and the specific processing purpose.
• Easy withdrawal at any time. A persistent link or icon must allow users to revisit and change their choices without re-loading the banner. Consent changed must be effective immediately — not at next session.
• Consent records. You must be able to demonstrate that consent was obtained: timestamp, banner version, choices made, and the text presented at the time. Without records, you cannot prove lawful basis to a regulator.

After implementing your banner, test your consent banner for compliance with our checker, then look up individual tracker weights in the Tracker Weight Database and Cookie Knowledge Base — to verify which trackers your implementation actually blocks.

Country-Level Variations

GDPR sets a floor, not a ceiling. Member state implementations and national DPA guidance create variation that affects how you deploy a consent solution in practice.

• France (CNIL). The CNIL requires that Reject be accessible in a single click on the banner itself, without navigating to a settings panel. Cookie lifetime must be 13 months maximum. CNIL has issued significant fines against Google and Facebook for non-compliant banner design.
• Germany (DSK). German courts have pushed further: the Bundesgerichtshof ruled that consent must be explicit and active, rejecting opt-out models for tracking. The DSK guidance treats analytics cookies as non-essential categorically.
• Italy (Garante). The Garante has clarified that scrolling does not constitute consent — a banner must appear and require a deliberate action.
• UK (ICO, UK GDPR). Post-Brexit UK GDPR mirrors EU GDPR but is enforced by the ICO independently. The ICO’s cookie guidance is broadly aligned with EDPB but has historically been more permissive on analytics under soft enforcement — though the direction has tightened since 2023.
• California (CCPA/CPRA). The US does not operate on an opt-in model. CCPA requires a “Do Not Sell or Share My Personal Information” link and a mechanism to honor the Global Privacy Control signal. There is no requirement for prior consent before setting cookies — only an opt-out mechanism.
• Brazil (LGPD). Brazil’s LGPD broadly follows GDPR’s structure and applies to any processing of data from individuals in Brazil. Consent must be freely given and can be revoked. The LGPD permits legitimate interest for some categories where GDPR would require consent, but cookie-specific guidance continues to evolve.

For a structured audit of your full compliance posture across these jurisdictions, work through the full GDPR compliance self-assessment.

FAQ — GDPR Consent Requirements

Does Google Analytics require GDPR consent?

Yes. Google Analytics (both Universal Analytics and GA4) sets cookies that process personal data, including persistent identifiers linked to individual devices. Under the ePrivacy Directive and GDPR, these cookies require explicit opt-in consent from EU/EEA users before the analytics script loads. This applies even if you enable IP anonymization or use GA4’s cookieless measurement mode, because the browser ping itself constitutes personal data processing in most EU DPA interpretations. Privacy-first alternatives that do not set cookies — such as Plausible, Fathom, or Umami — do not trigger this requirement.

What is the difference between consent and legitimate interest under GDPR?

Consent under Art. 6(1)(a) is an active, specific choice made by the user before processing begins. Legitimate interest under Art. 6(1)(f) is a controller’s own justification, subject to a balancing test against user rights. For cookies, the ePrivacy Directive imposes consent as the default requirement regardless of which GDPR basis the controller prefers. Legitimate interest cannot be used to sidestep the ePrivacy consent requirement for non-essential cookies. Outside of cookies, legitimate interest may apply to some data uses — fraud detection, direct marketing with existing customers (with opt-out), internal analytics on server logs — but only after a documented balancing test.

Do I need a consent banner if I only use first-party cookies?

It depends on what those first-party cookies do. Strictly necessary first-party cookies — session tokens, CSRF protection, language preferences — do not require consent under the ePrivacy exemption for cookies strictly necessary to deliver a service the user requested. But first-party analytics cookies that track behavior across sessions, or first-party cookies set by a tag manager that fires third-party code, are not exempt. The origin of the cookie (first-party vs third-party) is not the test; the purpose and necessity are.

How long can I store consent records?

There is no single GDPR-mandated duration for storing consent records. The principle is proportionality: keep records for as long as you might need to demonstrate lawful basis if challenged. Practically, most practitioners align consent record retention with the duration of the underlying processing — typically 12 to 24 months, aligned with cookie lifetimes — plus a reasonable period to respond to regulator inquiries. Some DPAs have informally indicated 3 years as reasonable. Records must include the timestamp, the banner version shown, and the choices made.

Does GDPR apply to my site if I have no EU users?

GDPR applies when you offer goods or services to individuals in the EU/EEA (or monitor their behavior), regardless of where your business is incorporated or your servers are located. If your site has no EU-specific targeting, currency, or language, you may be able to argue the offering test is not met. In practice, if you have any EU/EEA visitors in your analytics — or if you cannot exclude EU visitors — regulators take the position that GDPR applies. The safest approach is to implement consent for EU traffic using geolocation-based banner triggering.

What makes a consent banner valid under Art. 7 GDPR?

Article 7 requires four things: the controller can demonstrate consent was given; the request is in clear and plain language; the data subject can withdraw at any time as easily as they gave consent; and where consent is a condition of service, the controller must assess whether it was truly freely given. Practically: no pre-ticked boxes, no paywall for rejecting, equal prominence for Accept and Reject, named purposes, and a persistent mechanism to change choices. Dark patterns that nudge users toward acceptance — color contrast manipulation, extra steps to reject, misleading button labels — have been specifically called out in EDPB guidance and national enforcement decisions.