Cookie consent
Cookie consent is the permission a visitor gives, through a clear affirmative action, before a website stores or reads non-essential cookies and similar trackers on their device.Cookie consent is the meeting point of two EU laws. Article 5(3) of the ePrivacy Directive decides when consent is needed: for any storage of or access to information on the user's device that is not strictly necessary. The GDPR decides what consent means: Article 4(11) requires an indication of wishes that is freely given, specific, informed and unambiguous, given by a statement or a clear affirmative action, and Article 7 requires that it can be proven and withdrawn as easily as it was given.
For a website this translates into concrete rules. Consent comes before the cookies, not after. It is given per purpose (analytics, marketing, functional), not in one bundle. Silence, scrolling, continuing to browse and pre-ticked boxes do not count. Refusing must be as easy as accepting, and the choice must be recorded so the site can show it later.
The UK applies the same model through PECR and the UK GDPR. Brazil, Türkiye, Quebec and South Africa ask for comparable consent under their own laws. The United States mostly does not: California's CCPA lets businesses use cookies by default and gives visitors the right to opt out of the sale or sharing of their data. See consent for the legal definition in detail.