Cookie Consent and Privacy Law, Plainly

Cookie banners are the most visible piece of privacy law on the internet, and also the most misunderstood. Most site owners install one because everyone else has one, click through the settings without reading them, and end up with a banner that annoys visitors and fails to do the one legal job it exists for. This post explains what the law generally expects, in plain English, so you can make deliberate choices instead of cargo-culting a plugin.

One disclaimer up front: this is a practical overview, not legal advice. If you process sensitive data at scale or operate in a regulated industry, talk to a lawyer. For a typical small-business website, though, the rules are more understandable than the banners suggest.

What a cookie actually is, and why the law cares

A cookie is a small piece of text a website stores in your browser so it can recognize you later. That's it. Cookies keep you logged in, remember your shopping cart, and remember that you already dismissed the newsletter popup. None of that is sinister.

The law cares because the same mechanism is used for something else: tracking. An analytics or advertising cookie set by a third party can follow a person across many sites, building a profile of their interests, habits, and location. European lawmakers decided — reasonably — that people should get a say before that happens on their devices.

The key distinction the law draws is not "cookies vs. no cookies." It's strictly necessary vs. everything else:

• Strictly necessary cookies make the site work: session cookies for logins, cart cookies for a shop, a cookie remembering your consent choice itself, basic security and load-balancing cookies. These generally need no consent. You can usually set them without asking, and there is rarely a reason to list them behind an opt-in toggle.
• Everything else — analytics, advertising, social media embeds, A/B testing tools, heatmaps — generally needs consent before the cookie is set. Not after. Before.

That single sentence — non-essential cookies generally need consent before they're set — is the heart of cookie rules in many places. Many compliance failures are failures of that one rule.

The laws in play, briefly

Three legal regimes come up constantly. Here's what each one actually does:

The ePrivacy Directive (the actual "cookie law")

People say "GDPR cookie banner," but the rule requiring consent for cookies predates GDPR. The ePrivacy Directive (2002, amended in 2009) is the EU law that generally requires informed consent for storing or reading information on a user's device, unless it's strictly necessary for a service the user asked for. Each EU country implemented it slightly differently, which is why enforcement details vary between, say, France and Germany.

GDPR

GDPR (2018) governs personal data generally, and it changed cookie consent in one crucial way: it defined what valid consent means. Under GDPR, valid consent is generally understood to be freely given, specific, informed, and unambiguous, given by a clear affirmative action. Pre-ticked boxes are generally not accepted. "By continuing to browse you agree" is generally not accepted either. Silence is not consent. If your banner assumes consent from scrolling, it is unlikely to count.

US state laws (CCPA/CPRA and friends)

The United States has no federal equivalent, but California's CCPA/CPRA — and a growing list of state laws in Virginia, Colorado, Texas, and elsewhere — take a different approach: opt-out rather than opt-in. You can generally set tracking cookies, but you may need to let users opt out of the "sale" or "sharing" of their personal information, which courts and regulators have interpreted broadly enough to cover much ad tech. Practically, that can mean a "Do Not Sell or Share My Personal Information" link and honoring the Global Privacy Control browser signal; check with a qualified advisor what applies to you.

Does any of this apply to your site?

The tests are about your audience, not your server location:

• GDPR/ePrivacy may apply if you offer goods or services to people in the EU/EEA (or UK, under its nearly identical UK GDPR), or monitor their behavior. A US bakery with a purely local clientele is probably out of scope. An online store that ships to Europe, or a SaaS with European signups, is in scope.
• CCPA/CPRA may apply if you're a for-profit business handling California residents' data and you cross thresholds — gross annual revenue over $25 million, personal information of 100,000 or more California residents or households, or 50% or more of revenue from selling personal information (California Attorney General). Many small businesses genuinely fall below these thresholds.

Here's the honest practical answer: if your site serves an international audience, building to a strict standard (EU-style opt-in consent) can cover you in many places and is often simpler than maintaining region-specific behavior. If you're truly local to one non-EU country, you have more latitude — but check your own country's rules, because Brazil (LGPD), Canada (PIPEDA), and others have their own versions.

What a compliant setup actually looks like

Strip away the vendor marketing and an EU-style consent flow that regulators tend to accept usually has five properties:

1. Non-essential cookies are blocked until consent. This is the part most "install and forget" setups get wrong. The banner appears, but Google Analytics fired on page load anyway. A consent management tool must actually gate the scripts, not just display a notice next to them.
2. Reject is as easy as Accept. Regulators — the French CNIL most prominently — have challenged banners with a one-click "Accept all" but a multi-click journey to refuse. Consider a "Reject all" button at the same level as "Accept all." Yes, your analytics numbers will drop. That drop is the law working as intended.
3. Consent is specific. Users should be able to accept analytics but refuse advertising, typically via a "Preferences" panel with categories. Bundling everything into one take-it-or-leave-it choice weakens the "freely given" requirement.
4. Consent is recorded and revocable. You will generally want to be able to show that and when a user consented, and users need a way to change their mind later — usually a small persistent "Cookie settings" link in the footer.
5. The information is honest. The banner and cookie policy should say what you actually use, in language a human can parse. "We and our 847 partners" is a confession, not a disclosure.

Dark patterns: the stuff that gets people fined

Enforcement in this area has focused less on "you have no banner" and more on "your banner is manipulative." Patterns regulators have explicitly called out:

• No reject option on the first layer — accept is one click, rejecting requires opening settings and toggling ten switches.
• Visual nudging — a bright, prominent Accept button next to a gray, low-contrast "manage options" link. Some contrast in design is tolerated; making Reject nearly invisible is not.
• Cookie walls — "accept tracking or leave." Often treated as problematic in the EU for ordinary sites, with narrow, contested exceptions for "consent or pay" news models.
• Ignoring the choice — the user rejects, and the tracking scripts load anyway. This is both common and trivially detectable by anyone who opens browser developer tools, which is exactly how activists and regulators find it.
• Nagging — re-showing the full banner on every page view after rejection. A rejection should be remembered at least as long as an acceptance.

A useful rule of thumb: if a design choice only makes sense as a way to inflate your accept rate, a regulator will read it the same way.

Do you even need that tracking?

Before configuring consent for a dozen scripts, ask a better question: which of these do you actually use?

Many small-business sites carry analytics nobody reads, a Facebook pixel from an ad campaign that ended two years ago, and a heatmap tool from a redesign long shipped. Every one of those adds consent complexity, page weight, and legal exposure for zero value. The cheapest compliance strategy is deletion.

For the tracking you do want, there's often a lower-friction option:

A site that only uses strictly necessary cookies plus cookieless aggregate analytics may not need a consent banner in some jurisdictions — just a clear privacy policy; check with a qualified advisor. That's a genuinely achievable end state for a lot of brochure sites, and your visitors will notice the absence of the banner the way you notice the absence of a headache.

A practical setup checklist

For a WordPress site, the path looks like this:

1. Audit what you set. Open your site in a private browsing window with dev tools open (Application → Cookies, plus the Network tab). Note every cookie and third-party request before you've clicked anything. That pre-consent snapshot is your compliance reality, whatever your policy claims.
2. Remove what you don't use. Old pixels, dead analytics, forgotten chat widgets.
3. Pick a consent management plugin that actually blocks scripts, not one that merely displays a notice. It should support prior blocking, per-category consent, a reject-all button, consent logging, and Google Consent Mode if you use Google tools.
4. Configure honest categories — necessary, analytics, marketing is a common trio — and map each script to one.
5. Test in a clean browser. Reject everything; confirm no analytics or marketing requests fire. Accept; confirm they do. This ten-minute test is the difference between compliance and decoration.
6. Update your privacy policy to match reality: what you collect, why, with whom it's shared, and how to withdraw consent.
7. Re-audit twice a year, or whenever you add a plugin — WordPress plugins are enthusiastic about quietly adding third-party scripts.

The honest conclusion

Cookie consent law is often mocked, and the banner ecosystem has earned much of the mockery. But the underlying rule is simple and defensible: don't track people on their own devices without asking first, and make "no" a real option. A small-business site can meet that standard with an afternoon of work — audit, delete, gate, test — and can often escape banner purgatory entirely by choosing tools that don't track in the first place. Fewer scripts, an honest banner or none at all, and a privacy policy that describes what actually happens: that's the whole game. Rules differ by country and change over time, so check with a qualified advisor about your own situation.

Photo: VGIO Studios on Pexels