GDPR Cookie Consent Requirements 2026 — What Your Banner Must Actually Include

GDPR has been in force since 2018. Yet European Data Protection Authorities continue to issue significant fines for non-compliant cookie consent — not because organisations are ignoring the law entirely, but because they have implemented banners that look compliant while systematically violating the specific requirements that Article 7 and Recital 32 actually impose.

The gap is usually not ignorance. It is misunderstanding. A banner that says "we use cookies" is not consent. A banner with a prominent Accept button and a buried reject option is not freely given consent. A banner that lets analytics scripts fire before the visitor clicks anything is not prior consent. All three of these configurations are common — and all three have been the basis for enforcement actions in 2025 and 2026.

This guide is the complete specification of what GDPR actually requires from a cookie consent mechanism — from the legal basis through to the technical implementation details regulators are now checking.

What GDPR Actually Says About Consent

GDPR establishes consent as one of six lawful bases for processing personal data under Article 6. For cookie-based processing — analytics, advertising, personalisation — consent is almost always the only viable lawful basis, because legitimate interest is explicitly insufficient for advertising-related tracking under the guidance of multiple European DPAs.

Article 4(11) defines consent as "any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her."

Article 7 sets out the conditions for consent. Recital 32 provides the practical context: silence, pre-ticked boxes, and inactivity do not constitute consent. Article 7(3) establishes the withdrawal right — consent must be withdrawable at any time, and withdrawal must be as easy as giving consent.

The Five Requirements for Valid Cookie Consent

GDPR's consent definition contains five distinct requirements. All five must be met simultaneously. Meeting four out of five does not constitute valid consent — any single failure invalidates the entire consent.

What Your Banner Must Include — First Layer

The first layer is the initial banner that visitors see before interacting with your site. It must do a specific job: present the consent choice in a way that satisfies all five requirements above without requiring the visitor to navigate deeper to find the information they need to make an informed decision.

Non-negotiable first-layer elements

• Clear description of cookie categories — at least the categories used (e.g. Strictly Necessary, Analytics, Marketing), written in plain language, not technical jargon. The visitor must understand what they are consenting to before clicking.
• Accept All button — accepting all non-essential cookies in one click is the standard user expectation and must be available.
• Reject All button — at the same level as Accept All — this is the most commonly violated requirement. If Accept All is on the first layer, Reject All must also be on the first layer with equivalent visual prominence. Multiple DPA enforcement actions since 2022 have been based solely on this requirement.
• Link to preferences / manage cookies — access to granular category toggles for visitors who want to accept some but not all categories.
• Link to your privacy policy or cookie policy — for visitors who want the full detail before deciding.
• Statement that non-essential cookies are used and why — visitors must understand that their browsing data may be shared with third parties for analytics or advertising purposes.

The Second Layer — Preferences Panel Requirements

The preferences panel — the detailed view where visitors can accept or decline cookies by category — is the second layer. Visitors who click "Manage Preferences" or "Cookie Settings" on the first layer arrive here. It must meet its own set of requirements.

• Granular toggles per purpose category — separate on/off switches for each consent category (Analytics, Marketing, Personalisation, etc.). A single toggle for "all non-essential cookies" is insufficient — it must be possible to accept analytics without accepting marketing, for example.
• Strictly Necessary category clearly labelled and non-toggleable — essential cookies must be disclosed but cannot be declined. The UI should make clear why they cannot be turned off.
• Default state of all non-essential toggles must be OFF — pre-ticked or pre-enabled toggles for non-essential categories are explicitly prohibited. Every non-essential category must default to disabled and only be enabled by an active visitor action.
• Equal prominence for Accept All and Reject All — the same visual prominence requirement applies at the preferences panel level. If Accept All is a large coloured button, Reject All must also be a large coloured button of equivalent visual weight.
• List of specific cookies or at least specific vendors — the EDPB recommends and several DPAs require that the second layer lists the specific cookies used in each category, or at minimum the categories of third-party vendors who receive data.
• Save / Confirm selection button — visitors who configure granular choices must be able to save their specific selection, not just choose between all-or-nothing.

Dark Patterns GDPR Prohibits — With Specific Examples

In 2022, the EDPB published its Guidelines 03/2022 on dark patterns in social media platforms, which has since been extended as a general framework for consent interface design. Multiple DPAs have fined organisations specifically for dark patterns in cookie banners. Here are the prohibited patterns with concrete examples of how they manifest.

Where DPAs Are Actively Enforcing in 2026

Cookie consent enforcement has increased significantly across Europe since 2023. These are the most relevant enforcement actions that directly inform what your banner must do in 2026.

The Technical Requirements Beyond the UI

GDPR compliance is not just about how your banner looks — it is about what your website technically does in response to a visitor's consent decision. The UI requirements above are necessary but not sufficient. These are the technical requirements that the enforcement actions above make clear are being checked.

1. Prior consent — scripts must not fire before consent is given

The most fundamental technical requirement. Non-essential cookies and tracking scripts — Google Analytics, Meta Pixel, advertising tags, session-replay tools — must not execute until a visitor has actively consented to the relevant category. This requires actual script blocking at the JavaScript level, not a banner overlay that loads after the scripts have already fired.

In practice: a visitor arriving at your page for the first time, in incognito, with no prior consent state, must not generate any non-essential cookie or third-party tracking request before they have interacted with the banner. Test this by opening DevTools → Network tab in incognito and loading your homepage. If Google Analytics or any other tracker appears in the network waterfall before the banner is dismissed, your implementation is non-compliant.

2. Consent must be stored and honoured on subsequent visits

Consent is not a per-session event. When a visitor makes a choice — accept or decline — that choice must be stored and applied on all future visits until the consent naturally expires (12 months is the widely adopted standard), the cookie declaration materially changes, or the visitor actively changes their preference. Re-prompting a visitor who has already declined on every subsequent visit, or loading trackers on a visitor who previously declined, are both compliance failures confirmed in enforcement decisions.

3. Consent must be logged with a timestamp

GDPR's accountability principle (Article 5(2)) requires that you be able to demonstrate compliance. For consent, this means maintaining a record of when each visitor consented, what version of the consent notice they were shown, and what they agreed to. This log must be produceable in the event of a DPA investigation. The Irish DPC's 2024 fine was partly based on inability to demonstrate that valid consent had been obtained for third-party data transfers.

4. Withdrawal must be technically effective

When a visitor withdraws consent through the Manage Consent preferences panel, the processing must actually stop. This means the relevant third-party scripts must be blocked from firing on subsequent page loads, and any applicable opt-out signals (including GPC browser signals in US state law contexts) must be acted upon immediately. A withdrawal mechanism that records a preference in a database but does not actually suppress script execution is not a functioning withdrawal mechanism.

What compliant versus non-compliant looks like in practice

Complete GDPR Cookie Consent Checklist 2026

Frequently Asked Questions