What is cookie consent, and when is it required?
Cookie consent is a visitor’s permission for a website to store or read cookies and similar trackers on their device. In the EU and the UK it is required before any cookie that is not strictly necessary, and it must be a clear, informed choice that the visitor can withdraw as easily as they gave it.
When cookie consent is required
The rule is about access to the device, not about personal data. Article 5(3) of the ePrivacy Directive requires consent before storing information on a visitor’s device or reading information already there. The only exceptions are storage needed to carry a communication, and storage strictly necessary for a service the visitor explicitly asked for.
In practice, a session cookie that keeps someone logged in, a load-balancing cookie and a cookie that remembers the contents of a basket are strictly necessary. Analytics, advertising, social media plugins and most personalisation are not, so they need consent first.
What makes consent valid
Consent takes its meaning from the GDPR: a freely given, specific, informed and unambiguous indication of wishes, given by a statement or a clear affirmative action (Article 4(11)). Article 7 adds that you must be able to demonstrate it, and that withdrawing must be as easy as giving it.
European courts and regulators have turned that into concrete design rules.
- No pre-ticked boxes. The Court of Justice ruled in Planet49 (C-673/17, 2019) that a pre-checked box is not consent.
- Reject as easy as accept. France’s CNIL fined Google €150 million and Facebook €60 million in 2022 because refusing took more clicks than accepting.
- No consent by scrolling. Continuing to browse is not a clear affirmative action.
- Per purpose. Visitors can accept analytics and refuse advertising.
- Nothing runs early. Non-essential tags wait for the choice; they do not load and then stop.
Outside Europe
The United States has no federal cookie consent rule. California’s CCPA, as amended by the CPRA, works the other way round: businesses must let people opt out of the sale or sharing of their personal information, including through cookies used for cross-context advertising, and must honour browser opt-out signals such as the Global Privacy Control.
India’s DPDP Act makes consent the main basis for processing personal data, requires a clear notice with it, and creates registered consent managers through which people can give, manage and withdraw consent.
Evidence of consent
When a regulator, auditor or customer asks about cookies, they want three things: the notice visitors see, a record of each visitor’s choice with the notice version it was given against, and proof that tags respect the choice. A consent management platform produces all three.
In Certifyi, cookie consent for your websites is managed alongside your privacy frameworks and privacy risks, so a question about cookies is answered from the same workspace as the rest of your privacy programme.
Questions
Cookie consent, answered
Do strictly necessary cookies need consent?
No. They are exempt when they are strictly necessary for a service the visitor asked for, such as a login session or a shopping basket. List them in the cookie policy all the same.
How long does cookie consent last?
The law sets no fixed period. Many European regulators consider asking again after six to thirteen months reasonable, and you should ask again whenever the purposes or vendors change.
Can we show a “cookie wall” that blocks the site until visitors accept?
Most European regulators say a wall that gives no real alternative makes consent not freely given. Some accept a wall that offers a genuine alternative, such as a paid option, under conditions. Check the guidance for each market.
Working through this for an audit?
Talk it through with someone who has run the audit before, or look up another term.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them