Anyone who manages a website likely knows — users must be shown a cookie notice. But did you know that many cookie banners in Europe are actually illegal? Increasingly, companies risk fines simply because they don’t comply with the General Data Protection Regulation (GDPR).
In this article, we’ll explore the most common mistakes in cookie usage and how to make your cookie banner legal — without losing user trust.
1. Consent is not freely given
❌ Mistake:
The cookie banner only shows an “Accept” button, with no option to decline or customize settings.
✅ Legal:
Users must be able to decline non-essential cookies just as easily as accepting them. A “Reject” or “Only essential cookies” button is mandatory.
2. Consent is not granular
❌ Mistake:
One general agreement for all cookies, without any options to choose.
✅ Legal:
Users should be able to choose which types of cookies to accept — for example, analytics, marketing, personalization. This is usually done through a detailed settings menu.
3. Cookies load before consent
❌ Mistake:
Advertising or analytics cookies are activated before the user has given consent.
✅ Legal:
No non-essential cookie may be activated before consent. A mechanism must be in place to enable them only after the user agrees.
4. Insufficient information
❌ Mistake:
It’s unclear who collects the data, for what purpose, or how long the data is stored.
✅ Legal:
Consent is only valid if users receive clear, understandable, and complete information. Ideally, there should be a link to a full cookie policy with all details.
5. Consent cannot be withdrawn
❌ Mistake:
Once given, the user cannot easily change their consent.
✅ Legal:
Users must be able to withdraw consent at any time, just as easily as they gave it. This means having a visible “Cookie settings” button or link on every page (e.g., in the footer).
Bonus: UX Mistakes That Undermine Trust
- Unbalanced button design: The “Accept” button is bright green, while “Reject” is grey and barely visible. This manipulative design can be seen as forced consent (known as a dark pattern).
- Intrusive banner design: An overly large or aggressive banner that blocks content and can’t be easily dismissed frustrates users and ruins their experience.
Summary
A compliant cookie banner is not just a legal formality — it’s a matter of trust. Users are increasingly aware of their rights, and violations can be costly. Want to stay safe? Evaluate your cookie banner’s functionality and ensure it meets GDPR and the ePrivacy Directive requirements.