Saying no should be as easy as yes.

What valid consent means

Article 5(3) of the ePrivacy Directive asks for consent and takes the meaning of consent from the GDPR. Article 4(11) GDPR defines it as a freely given, specific, informed and unambiguous indication of someone’s wishes, by a statement or a clear affirmative action.

Article 7 adds two duties that shape every banner. You must be able to show that a visitor consented, and withdrawing consent must be as easy as giving it.

In practice, people need to know what they agree to before they choose, they can choose per purpose when there is more than one, and only a clear click counts. The CNIL, France’s regulator, says carrying on browsing or scrolling isn’t consent, and treats anything other than a clear yes as a refusal.

Nothing ticked in advance

In Planet49 (C-673/17, 1 October 2019) the EU’s Court of Justice ruled that a pre-ticked checkbox, which the visitor has to untick to refuse, doesn’t give valid consent to cookies.

The same judgment says what visitors must be told: how long the cookies will be active and whether third parties can access them. That detail can sit on a second layer or in your cookie policy, as long as visitors can reach it before they choose.

This goes for every layer. The EDPB’s Cookie Banner Taskforce confirmed that pre-ticked boxes on the second layer are just as invalid, and the Dutch AP says the same. With switches, each one starts off, and it must be clear whether it is on.

Reject next to accept

The European Data Protection Board (EDPB) set up the Cookie Banner Taskforce to coordinate complaints about banners across the EU. In its report, adopted in January 2023, a large majority of regulators found that a layer with an accept button and no way to refuse breaks the rules. A reject option hidden as a link in the text, with nothing to draw attention to it, doesn’t give valid consent either.

The taskforce agreed that no single standard for colours or contrast can be imposed, so each banner is judged case by case. Its clear example of a misleading design was a reject button whose text is so faint that almost nobody can read it.

The Dutch Data Protection Authority (AP) sets out nine rules for clear banners. Applied to the first layer:

• Accept and reject sit on the same layer. If accepting takes one click, so does rejecting.
• Rejecting takes no extra steps, such as a second “Are you sure?”.
• The reject button is as visible as accept: no link in the text, no colour that fades into the background, no scrolling to find it.
• Buttons say what they do, such as “Accept” and “Reject”. “OK” or “Got it” only confirms that someone read the text.
• Before anyone chooses, the text says that personal data is processed, by whom and for which purposes.
• If you share data with third parties, the first layer says so and how many there are.
• The banner says that consent can be withdrawn, and how.

Withdrawing, and how long a choice lasts

Article 7(3) GDPR lets people withdraw consent at any time, says they must be told so before they consent, and makes withdrawing as easy as giving consent. The taskforce and the AP both leave the method open. They mention an icon or floating button that stays in view on every page, a link in a fixed, visible place, or the option at the top of your cookie policy.

When someone withdraws, stop the tools that relied on their consent. If third parties received data on the basis of that consent, the AP says you must tell them too.

No EU law sets how long a choice lasts. The CNIL considers six months good practice, for a refusal as much as for consent, and says the right period depends on the site and its audience. A refusal needs remembering too: without it, the CNIL notes, visitors would be asked again on every page, which could undermine their freedom to choose.

Gatelamp keeps a choice for six months by default, a refusal too, and asks again when a site adds a tool.

Keep proof of each choice

Article 7(1) GDPR says you must be able to show that a visitor consented. Your banner as it looks today doesn’t show what someone saw last spring.

Keep a record per choice: when it was made, what was chosen per purpose, and which version of the banner was shown. A random ID stored with the choice is enough to find the record if someone asks, without keeping their IP address.

Keep each version of the banner as well. The CNIL suggests, among other options, a dated screenshot of the banner for every version of the site and a dated history of how your consent tool was configured.

Do and don’t

Use this list when you design a new banner or review one you already run. It sums up the points above.

Then test it the way a visitor would: on a phone, with only a keyboard, and once with “Reject all” to check that nothing that needs consent loads afterwards.

• Do put “Reject all” next to “Accept all”, with the same size, weight and contrast.
• Do start every category off, on every layer.
• Do name the purposes and say how many third parties get data.
• Do keep a “Cookie settings” button or link on every page.
• Do remember a refusal as long as you remember consent.
• Do load tools that need consent only after a yes.
• Don’t hide reject behind “Settings” or in a line of text.
• Don’t use “OK” or “Got it” as the only button.
• Don’t count scrolling, closing the banner or carrying on browsing as consent.
• Don’t design the banner so it looks as if visitors must accept to use the site.
• Don’t call tracking cookies “essential”.