Storing or reading information on a visitor's device (cookies, local storage, pixels, fingerprinting) requires their prior consent, unless it is strictly necessary for a service they asked for. The rule comes from Article 5(3) of the ePrivacy Directive (2002/58/EC); the GDPR defines what valid consent means.
What needs consent, and what does not
- No consent needed: cookies strictly necessary for what the visitor asked for, such as a shopping cart, a login session, load balancing, or remembering their consent choice.
- Consent needed: analytics, advertising and retargeting, social media pixels, A/B testing tools, embedded videos and maps that set trackers, and most third-party chat widgets.
Some authorities accept tightly configured audience measurement without consent (France's CNIL does under strict conditions), but this is a national exception, not an EU-wide rule.
What valid consent looks like
- Before any non-essential tracker loads, not after the page has already sent data.
- Freely given: refusing must be as easy as accepting. A "Reject all" option on the first layer, next to "Accept all", is what most EU authorities expect.
- Specific and informed: say what each category is for and name the third parties.
- Unambiguous: an active click. Pre-ticked boxes are not consent (Court of Justice, Planet49, C-673/17, 2019), and neither is "by continuing to browse you accept".
- Easy to withdraw: a link or button on every page to change the choice later.
- Recorded: keep proof of what each visitor agreed to and when.
Common mistakes regulators fine
- Trackers firing before the visitor answers the banner.
- No reject button on the first screen, or a reject option hidden behind "Settings".
- Colours and wording that push visitors to accept (dark patterns).
- Choices not respected: tags still loading after "Reject".
- A cookie list that no longer matches the tools on the site.
Fonts, maps, videos and chat widgets loaded from another company's server can send visitors' IP addresses to that company. In January 2022 a Munich court (LG München I) awarded damages for loading Google Fonts from Google's servers without consent. Host such files yourself or load them only after consent. See Third-Party Services.
This guide is general information about EU rules, not legal advice. Requirements can differ by country and by business: check with your data protection authority or a lawyer for your case.