The EDPB cookie banner taskforce report: what Europe's regulators agreed on

The report of the EDPB's cookie banner taskforce, adopted on 17 January 2023, is the closest thing Europe has to a common rulebook for cookie banners. It records the positions that the data protection authorities of the EU and EEA agreed on when handling several hundred complaints filed by the association NOYB: a banner with an accept button and no reject option on the same layer is an infringement for a vast majority of authorities; pre-ticked boxes never produce valid consent; a reject option hidden as a link in a paragraph does not either; colours and contrast are judged case by case, with unreadable text manifestly misleading; and withdrawing consent must be as easy as giving it. It is eight pages long and worth reading in full; here is what it says and what it does not.

Why there was a taskforce

Between May 2021 and August 2022, eighteen authorities received complaints from NOYB about the design of cookie banners on hundreds of websites. Cookies fall under the ePrivacy Directive as transposed nationally, not under the GDPR's one-stop-shop mechanism, so each authority was competent for its own residents and there was no lead authority to coordinate. The authorities set up a taskforce voluntarily, coordinated by the CNIL and the Austrian authority, and met thirteen times. The report's disclaimer is careful: the positions are a minimum threshold, a common denominator for assessing these complaints; they do not prejudge the analysis of each website, and national rules and national guidance still apply on top.

The legal framework, restated

Two points of law open the report. First, for the placement or reading of cookies, the applicable framework is only the national law transposing the ePrivacy Directive; the GDPR applies to what happens afterwards with the data collected, including to the consent when it is the legal basis for that processing. Second, concepts from the GDPR, in particular the conditions for valid consent, are indispensable to assess whether the national ePrivacy law was infringed. The report also confirms that the legal basis for placing or reading cookies under article 5(3) cannot be the controller's legitimate interest, and that where the ePrivacy requirement is not met, the subsequent processing of the data cannot comply with the GDPR either.

The practices, one by one

No reject button on the first layer (type A). Some banners had an accept button and a button leading to further options, but no button to reject. The taskforce first recalls that no cookies requiring consent can be set without consent, and that consent must be a positive action. Asked whether a banner without a refuse option on any layer that has a consent button infringes the directive, a vast majority of authorities said yes: the absence of such an option is not in line with the requirements for valid consent. A few authorities disagreed because article 5(3) does not literally mention a reject option. This is the paragraph behind the Reject all button; the design consequences are in the Reject all guide.

Pre-ticked boxes (type B). Several banners offered per-category options with the boxes pre-ticked on the second layer. The taskforce confirms that pre-ticked boxes do not lead to valid consent, citing recital 32 of the GDPR: "Silence, pre-ticked boxes or inactivity should not therefore constitute consent."

Deceptive link design (type C). Some banners offered rejection as a link rather than a button. The taskforce agreed that a banner must make clear what it is about, what consent is sought for and how to consent, and that a site must not design the banner to give the impression that consent is required to access the content, nor clearly push the user to consent. Two examples that do not produce valid consent: a link behind "refuse" or "continue without accepting" embedded in a paragraph of the banner text without visual support to draw attention to it, and the same link placed outside the banner where the accept buttons are, again without visual support.

Deceptive button colours and contrast (types D and E). Some banners highlighted the accept button through colour and contrast. The taskforce agreed that a general standard on colour or contrast cannot be imposed; conformity requires a case-by-case check that the colours and contrast are not obviously misleading and do not produce an unintended consent. One practice was named as manifestly misleading: an alternative to consent offered as a button whose text is unreadable against its background for virtually any user.

Legitimate interest claimed, list of purposes (type H). Some banners offered acceptance on the first layer with no refusal, and on the second layer distinguished refusing cookies from objecting to processing presented as legitimate interest, for purposes such as creating a personalised content profile or selecting personalised ads. The taskforce found that no overriding legitimate interest could be considered to exist for such processing, that placing legitimate interest in deeper layers could confuse users into thinking they must refuse twice, and that cookies cannot be placed on the basis of legitimate interest at all.

Inaccurately classified essential cookies (type I). Some sites labelled as essential cookies and processing that serve purposes nobody would call strictly necessary. The taskforce notes the practical difficulty of a stable list, because cookies change constantly, and places the responsibility on website owners to maintain the list of their cookies, provide it to authorities on request and demonstrate the essentiality of each. It observes that scanning tools can list the cookies placed but cannot determine their nature, so the owner's documentation is what authorities will ask for, and it recalls the Article 29 Working Party's opinion of 2012 that cookies remembering a user's preferences about a service should be deemed essential.

No withdraw icon (type K). Some sites had no permanently visible icon to return to the privacy settings. The taskforce says website owners should put in place easily accessible solutions to withdraw consent at any time, such as a small hovering, permanently visible icon or a link in a visible, standardised place. It then limits itself: owners can be required to provide an easily accessible solution once consent is given, but not a specific one such as a hovering icon. The test is whether withdrawing is as easy as consenting, assessed case by case, alongside the two other conditions: the possibility to withdraw, and to do so at any time.

What the report does not do

It does not set a colour standard, does not require a specific withdrawal widget, does not decide any individual complaint and does not replace national rules. Its value is that the EU and EEA authorities that took part put their names to the same minimum, so a banner that fails it fails everywhere. The CNIL cited the report in its formal notices of December 2024 against publishers whose reject option was a discreet link, and its positions match the CNIL's own guidelines of 2020, explained in our article on the CNIL rules. The fines that followed are in the fines round-up.

Applying it to your banner

Cookiequiet's banner is built to this table by default: Accept all and Reject all of the same size on the first screen, Customize beside them, categories off, no legitimate interest layer, a cookie table generated from the scan that you complete with the reasons, and a preferences link you can place in the footer or show as a floating button.