GDPR and cookies: what the law requires

What is the GDPR?

The General Data Protection Regulation is the European Union's data protection law. It was adopted on 27 April 2016 and has applied since 25 May 2018 in every EU member state and, through the EEA agreement, in Iceland, Liechtenstein and Norway. It is a regulation, not a directive, so the same text applies everywhere without national transposition, although member states run their own supervisory authorities and set some details locally.

The GDPR does not mention cookies by name. It matters for cookie banners for two reasons. First, Recital 30 says that online identifiers such as IP addresses and cookie identifiers can identify a person, so most cookies process personal data. Second, the ePrivacy Directive, which does regulate cookies, borrows the GDPR's definition of consent. In practice the two laws work together: the ePrivacy Directive decides whether you may store or read a cookie, and the GDPR decides what you may do with the data and how consent must look.

Who does the GDPR apply to?

Article 3 gives the GDPR a wide territorial scope. It applies to any organization established in the EU, whatever the nationality of its visitors, and to organizations outside the EU that offer goods or services to people in the EU or monitor their behavior. Behavioral advertising and analytics are forms of monitoring, so a website in the United States or Australia that tracks visitors from France or Germany is within scope. There is no size threshold and no exemption for small businesses.

What does the GDPR require for cookies and consent?

Consent is defined in Article 4(11) as a freely given, specific, informed and unambiguous indication of the person's wishes, given by a statement or a clear affirmative action. Article 7 adds the conditions: the controller must be able to demonstrate that consent was given, the request must be clearly distinguishable from other matters, and withdrawing consent must be as easy as giving it. Recital 32 rules out silence, pre-ticked boxes and inactivity. Recital 43 says consent is presumed not to be freely given when it is bundled: separate purposes need separate consent.

The Court of Justice applied these rules to cookies in Planet49 (C-673/17, 1 October 2019). A pre-ticked checkbox is not valid consent, the rule applies whether or not the cookie contains personal data, and the information given to the user must include how long the cookies last and whether third parties can access them.

The European Data Protection Board's Guidelines 05/2020 on consent (4 May 2020) settled two more questions: scrolling or swiping through a page is not consent, and a cookie wall that blocks access to a site until the visitor accepts tracking does not produce freely given consent.

Not every cookie needs consent. Cookies that are strictly necessary to provide a service the visitor asked for (session, shopping cart, login, security, load balancing, storing the consent choice itself) are exempt under the ePrivacy Directive. Audience measurement is exempt only under specific national conditions, such as the CNIL's exemption for first-party analytics with truncated IP addresses and no cross-site tracking. Everything else, including advertising pixels, social media embeds and most analytics, needs prior consent. Legitimate interest cannot replace consent for setting cookies, a point the EDPB's cookie banner task force restated in 2023.

What must a compliant banner do?

Put together, the GDPR, the ePrivacy Directive and the authorities' guidance describe a banner that:

• blocks all non-essential cookies and scripts until the visitor has chosen;
• shows an Accept and a Reject option of the same prominence on the first screen, since a majority of EU authorities consider a banner without a reject option on the same layer as the accept button to be an infringement (EDPB task force report, January 2023);
• lets visitors choose by purpose (analytics, marketing, functional) with nothing pre-ticked;
• explains who sets the cookies, for what purpose, for how long and who receives the data, before the choice;
• allows withdrawal at any time through a link or icon that is as easy to find as the original choice;
• records the choice, so you can demonstrate consent under Article 7(1).

Dark patterns are a separate risk. Making the Reject option a small text link, giving the accept button a strong color and the reject button an unreadable one, or re-asking on every page are the kind of designs the task force flagged as misleading and that the CNIL has fined.

Enforcement and fines

Article 83 sets two tiers: up to 10 million euros or 2% of worldwide annual turnover for breaches of the controller's obligations, and up to 20 million euros or 4% for breaches of the principles, of the conditions for consent and of data subjects' rights. Cookie decisions are usually taken under the national law that transposes the ePrivacy Directive, using the GDPR's consent standard, which is why the French CNIL can act directly against companies headquartered in Ireland without the one-stop-shop mechanism.

The CNIL has built the largest body of cookie fines in Europe:

The consent framework used by the advertising industry has been tested too. The Belgian authority fined IAB Europe 250,000 euros on 2 February 2022 over the Transparency and Consent Framework, the Court of Justice confirmed on 7 March 2024 (C-604/22) that the TC String is personal data, and the Brussels Market Court confirmed the fine on 14 May 2025 while annulling the decision on procedural grounds.

How Cookiequiet handles the GDPR

Cookiequiet's banner is built around these rules: nothing non-essential runs before a choice, Accept all and Reject all have the same size and weight on the first screen, the four categories are off by default in the preferences center, and every string is shown in the visitor's language (24 languages). The consent log records each choice with its date, categories, banner version and a hashed IP, which is the evidence Article 7(1) asks for. Geo-targeting lets you show the banner only to visitors in the EEA, the UK and the other regulated countries, or everywhere. The cookie scanner lists what your site actually sets so the cookie table in the banner is accurate. Policies are templates written for the GDPR, not legal advice. See the Reject all guide for the design details and the fines of 2026 for the latest enforcement.