# Is a free cookie banner enough? When it is and when it is not > A free cookie banner is legally enough if it blocks, offers Reject all and records consent. Where free plans fall short: traffic caps, short logs, no TCF. Source: https://cookiequiet.com/blog/is-a-free-cookie-banner-enough Published: 2026-10-21 Publisher: Cookiequiet A free cookie banner is legally enough when it does four things: blocks non-essential cookies until the visitor consents, offers Reject all as easily as Accept all, lets visitors withdraw, and keeps a record of each choice. Authorities test what the page does, not what the tool costs. Free plans fall short in practice, not in principle: a 5,000-pageview cap that a growing site passes mid-month, a consent log kept 7 or 30 days, manual blocking only, one website, or no IAB TCF for advertising. ## What does the law require, whatever the price? Under Article 5(3) of the ePrivacy Directive, storing or reading non-essential cookies needs prior consent, and the GDPR defines consent as freely given, specific, informed and unambiguous. Article 7(1) GDPR adds that the controller must be able to demonstrate that consent was given. The EDPB's cookie banner taskforce report of January 2023 recorded that a banner without a reject option on the same layer as accept was considered an infringement by a vast majority of authorities. So the checklist is short and price-blind: 1. Nothing non-essential runs before the choice. 2. Reject all sits next to Accept all, with the same weight. 3. A visitor can change their mind later, and the old cookies stop being read. 4. You can show, for a given visit, what was chosen and when. 5. The banner explains purposes and links to a cookie policy. Any free plan that does all five on your site is enough. If you are not sure you need a banner at all, start with [do I need a cookie banner](/guides/do-i-need-a-cookie-banner). ## When is a free plan fine? - **A personal site, portfolio or small blog** on one domain, with traffic under the plan's cap or on a plan without one. - **A small business site with a few third-party tools** (analytics, a map, a video embed) and no advertising that needs the TCF. - **A site that only uses exempt audience measurement.** In France, first-party analytics configured within the CNIL's conditions can run without consent, and a site with nothing else may not need a consent banner at all; see [analytics without consent](/blog/analytics-without-consent). ## When is a free plan not enough? Each of these limits was read on the vendor's own pricing page on 20 or 21 October 2026. ### The traffic cap is below your traffic CookieYes Free stops at 5,000 pageviews a month, Termly Free at 10,000 banner views, CookieScript Free at 10,000 pageviews, and Usercentrics and CookieHub Free at 1,000 sessions. CookieHub's page says the free banner stops showing above the limit until you upgrade. A banner that disappears while the trackers keep running is worse than no tool at all, because it looks compliant. ### The consent log is too short to prove anything Cookie Notice and Compliance Free keeps 7 days of consent history, CookieHub Free up to 1 month, Cookiequiet Free 30 days. A complaint usually arrives weeks or months after the visit. Cookiebot Free keeps records up to 12 months but makes consent expire after up to 1 month, so visitors are asked again every month. If you may need to prove a choice later, you need a longer log; see [how long to keep consent records](/guides/how-long-to-keep-consent-records). ### Blocking is manual Cookiebot Free has manual blocking only: every script must be marked by hand, and one missed tag runs before consent. That is fine for a developer with three scripts; risky for a marketing site where tags are added every month. ### You run several sites, or need geo-targeting Free plans cover one site or domain. Most also exclude geo-targeting: CookieYes needs Pro ($25 a month), Termly Pro+ ($20), Usercentrics Plus (€15). Without it, you choose between showing an opt-in banner to visitors who do not need one or not showing it to visitors who do. ### You show programmatic ads in Europe Google AdSense, Ad Manager and AdMob ads to visitors in the EEA, UK or Switzerland need a Google-certified CMP using the IAB TCF. No free plan in our [comparison of free banners](/blog/best-free-cookie-banner) includes the TCF. ## What does Cookiequiet's free plan leave out? Being honest about our own: Cookiequiet Free covers one website with unlimited pageviews, Reject all, blocking until consent, the auto-blocker for about 80 known trackers, Google Consent Mode v2, geo-targeting and a scan of 10 pages a month. Its limits are a 30-day consent log, policies in one language, monthly rather than weekly scans, and a small "Cookie banner by Cookiequiet" link. If you need to prove consent beyond a month, Starter at €3 a month or €29 a year keeps the log 1 year with CSV export, and Pro at €9 a month or €99 a year keeps it 5 years; the [pricing page](/pricing) lists the rest. Setup is the same on every plan: one script tag before your other scripts, no plugin or tag-manager configuration needed. ## How do you check your own banner? Open your site in a private window, before clicking anything, and look at the cookies and network requests: only necessary ones should be there. Click Reject all and reload: still nothing non-essential. Accept, then withdraw, and check the old cookies stop being read. The free [cookie scanner](/tools/cookie-scanner) shows what loads before consent on up to five pages, without an account. If your free plan passes these checks and its limits fit your traffic and your need for proof, it is enough. ## Questions ### Can I be fined for using a free cookie banner? Not for the price. Authorities fine sites for cookies placed before consent, refusals that do not work, missing Reject all buttons and missing proof. A free banner that blocks, offers Reject all and records consent meets the same test as a paid one. ### How long should a free plan keep consent records? Long enough to answer a complaint, which usually comes weeks or months after the visit. A 7-day or 30-day log proves little. Many organisations keep consent records for the life of the consent plus a period to cover claims. ### What happens if my site passes a free plan's traffic limit? It depends on the vendor: some bill or ask for an upgrade, and CookieHub's free banner stops showing until you upgrade. Cookiequiet Free has no traffic limit for its one website. ## Sources - [Directive 2002/58/EC (ePrivacy Directive), Article 5(3), EUR-Lex](https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng) - [Regulation (EU) 2016/679 (GDPR), Articles 4(11) and 7, EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng) - [EDPB, Report of the work undertaken by the Cookie Banner Taskforce (17 January 2023)](https://www.edpb.europa.eu/documents/task-force-report/report-of-the-work-undertaken-by-the-cookie-banner-taskforce_en) - [CNIL, Sheet n°16: Use analytics on your websites and applications](https://www.cnil.fr/en/sheet-ndeg16-use-analytics-your-websites-and-applications) - [CookieYes pricing page (checked 20 October 2026)](https://www.cookieyes.com/pricing/) - [CookieHub pricing page (checked 21 October 2026)](https://www.cookiehub.com/pricing) - [Cookiebot pricing page (checked 21 October 2026)](https://www.cookiebot.com/en/pricing/) - [Cookie Notice and Compliance pricing (checked 21 October 2026)](https://cookie-compliance.co/pricing/)