What Is a Cookie Banner? Requirements, Examples and Best Practices

A cookie banner is the pop-up or bar a website shows to visitors on their first visit to tell them about the cookies and trackers it uses and to ask for their consent. Under the GDPR and the ePrivacy Directive, websites that use non-essential cookies, such as analytics or advertising cookies, must get opt-in consent before setting them, and the cookie banner is how most websites collect that consent.

Cookie Banner, Cookie Notice and Related Terms

Term	Meaning
Cookie banner	The pop-up, bar or box that informs visitors about cookies and collects their choice. Also called a cookie consent banner or cookie pop-up.
Cookie notice	A banner that only informs visitors, without offering a real choice. Not enough for GDPR consent.
Preference center	The second layer of the banner where visitors can accept or reject individual cookie categories or vendors.
Cookie policy	The page that lists the cookies you use, their purpose, provider and duration. The banner should link to it.
Cookie wall	A banner that blocks access to the site until the visitor accepts cookies. Generally not allowed in the EU without a genuine alternative.
Consent Management Platform (CMP)	The software that shows the banner, blocks cookies until consent, stores consent records and passes consent signals to vendors.

Do You Need a Cookie Banner?

Region	Cookie banner required?
EU and EEA (GDPR and ePrivacy Directive)	Yes, if you use any cookies or trackers that are not strictly necessary. Consent must be opt-in and collected before those cookies are set.
United Kingdom (UK GDPR and PECR)	Yes, under the same opt-in rules for non-essential cookies.
Switzerland (nFADP)	Transparency is required; opt-in consent is expected for many tracking uses. A banner is the common approach.
United States (CCPA/CPRA and state laws)	An opt-in banner is not generally required, but you must offer an opt-out of the sale or sharing of personal data, such as a "Do Not Sell or Share My Personal Information" link, and honour Global Privacy Control signals. Many sites use a banner to do this.
Brazil (LGPD), Canada, and other countries	Rules vary; many regulators expect clear information and consent for non-essential tracking.

If your website only uses strictly necessary cookies, such as a session cookie for a shopping cart or a cookie that stores the consent choice itself, you do not need consent for them, although you must still explain them in your cookie policy.

Google also requires publishers and advertisers that serve ads or use Google Ads and Google Analytics measurement for users in the EEA, the UK and Switzerland to use a Google-certified CMP or send consent signals through Google Consent Mode v2.

Requirements for a GDPR-Compliant Cookie Banner

A compliant cookie banner should:

1. Block non-essential cookies and tags until the visitor gives consent
2. Offer Accept and Reject options with equal prominence on the first layer, so rejecting is as easy as accepting
3. Let visitors choose by category, such as analytics, marketing and personalisation, with no categories pre-ticked
4. Explain in plain language who you are, what cookies are used for, and which third parties receive data
5. Link to your cookie policy and privacy policy
6. Not treat scrolling, continued browsing or closing the banner as consent
7. Not block access to the site as a condition of accepting non-essential cookies
8. Let visitors withdraw or change consent at any time, as easily as they gave it, for example through a floating icon or a link in the footer
9. Record each consent, including the time, the choices made and the banner version, so you can prove it
10. Ask again when purposes or vendors change, and refresh consent periodically
11. Be available in the visitor's language and accessible to people using keyboards and screen readers

What regulators check

In 2023, the EDPB's cookie banner taskforce agreed a common position on practices that breach the rules, including:

• No reject option on the first layer
• Pre-ticked boxes for non-essential purposes
• A reject option shown only as a link inside text, or hidden in a second layer
• Deceptive button colours or contrast that push visitors towards Accept
• Claiming legitimate interest for non-essential cookies
• Classifying tracking cookies as strictly necessary
• No easy way to withdraw consent after giving it

The French CNIL, the UK ICO and other authorities have also written to or fined websites whose banners made rejecting harder than accepting.

Cookie Banner Dark Patterns to Avoid

• "Accept all" as a large coloured button and "Reject" as small grey text
• Only "Accept" and "Settings" on the first layer, with reject hidden behind extra clicks
• Pre-enabled toggles in the preference center
• Confusing wording such as "Don't not reject"
• Repeatedly showing the banner after a visitor rejects, until they accept
• Walls of legal text that hide the purposes of processing
• A close icon that is treated as acceptance

Cookie Banner Text Example

A short, clear first layer might read:

We use cookies

We use necessary cookies to make our site work. With your consent, we also use analytics cookies to understand how the site is used and marketing cookies to show you relevant ads, including through our advertising partners. You can accept all, reject all, or choose your preferences. You can change your choice at any time using the cookie icon at the bottom of the page. Read our cookie policy for details.

[Accept all] [Reject all] [Customise]

Cookie Banner Layouts

Layout	Description	Notes
Bottom or top bar	A full-width bar at the edge of the screen	Less intrusive; make sure buttons are clear and visible on mobile.
Modal or pop-up	A centred box that overlays the page	Most noticeable; must not become a cookie wall.
Corner box	A small box in a corner of the screen	Unobtrusive, but can be too easy to overlook on large screens.
Two-layer banner	A short first layer with a link to a detailed preference center	The recommended approach: simple first choice, full detail when wanted.

Whatever layout you choose, keep the first layer short, show Accept and Reject side by side, and match the banner to your brand so visitors recognise it as part of your site.

How to Add a Cookie Banner to Your Website

1. Scan your website. Use a cookie checker to find every cookie and tracker your site sets, including those set before consent.
2. Categorise your cookies. Group them into strictly necessary, functional, analytics and marketing.
3. Choose a CMP. Pick one that blocks tags until consent, supports Google Consent Mode v2 and, for publishers, the IAB TCF.
4. Configure the banner. Set the text, languages, layout, colours, categories and vendors, and show Accept and Reject with equal prominence.
5. Install the script. Add the CMP tag to your site directly, through Google Tag Manager, or with a plugin for WordPress or Shopify.
6. Block tags until consent. Make sure analytics and advertising tags only fire after the right consent, or run in Consent Mode.
7. Test it. Check that no non-essential cookies are set before consent, that rejecting works, and that consent signals reach Google and other vendors.
8. Publish your cookie policy and review regularly. Re-scan the site when you add new tools.

Cookie Banners, Google Consent Mode v2 and IAB TCF

• Google Consent Mode v2 passes the visitor's choices from the banner to Google tags using the ad_storage, analytics_storage, ad_user_data and ad_personalization signals. It is required for ads personalisation and measurement for EEA and UK users.
• The IAB Transparency and Consent Framework (TCF) is the standard publishers and ad tech vendors use to share consent choices in programmatic advertising. The banner must list the TCF purposes and vendors and generate a TC string.
• The Global Privacy Platform (GPP) extends this to US state privacy laws.

Learn more about Google Consent Mode, IAB TCF and GPP.

Cookie Banner Fines

Cookie banners are one of the most actively enforced areas of privacy law. Examples from the French CNIL include:

Company	Fine	Year	Reason
Google	€100 million	2020	Advertising cookies set without prior consent
Amazon	€35 million	2020	Advertising cookies set without prior consent
Google	€150 million	2022	Refusing cookies was harder than accepting them
Facebook (Meta)	€60 million	2022	Refusing cookies was harder than accepting them
Microsoft (Bing)	€60 million	2022	Advertising cookies set without consent and no easy refusal
Google	€325 million	2025	Ads in Gmail and cookies set when creating a Google account without valid consent
Shein	€150 million	2025	Cookies set before consent and refusal not respected

How UniConsent Helps

UniConsent is a Google-certified and IAB Europe-registered CMP that gives you a compliant cookie banner in minutes:

• A customisable cookie consent banner with Accept, Reject and granular choices, in your brand colours
• Automatic blocking of non-essential cookies and scripts until consent
• A cookie scanner that finds and categorises cookies and keeps your cookie declaration up to date
• Google Consent Mode v2, IAB TCF v2.3 and GPP support
• Geo-targeting, showing opt-in consent in Europe and opt-out choices in the US
• Banners in all EU languages
• Consent records that prove each visitor's choice

Not sure what your site sets today? Run a free scan with the UniConsent Cookie Checker.

Frequently Asked Questions

What is a cookie banner?

A cookie banner is the pop-up or bar that tells website visitors which cookies and trackers the site uses and asks for their consent before non-essential cookies are set.

Is a cookie banner required by law?

In the EU, EEA and UK, yes, if your site uses cookies that are not strictly necessary, such as analytics or advertising cookies. In the US, an opt-in banner is not generally required, but you must offer an opt-out of the sale or sharing of personal data.

Does a cookie banner need a reject button?

In the EU and UK, regulators expect a reject option on the first layer that is as easy to use as the accept option. A banner with only Accept and Settings is widely considered non-compliant.

Can I use a cookie wall?

Generally not. Blocking access unless visitors accept non-essential cookies means consent is not freely given. Some authorities accept limited "consent or pay" models where a genuine alternative is offered.

How long is cookie consent valid?

The GDPR does not set a fixed period, but you should ask again when your purposes or vendors change and refresh consent periodically. Many sites ask again after 6 to 12 months; the CNIL recommends keeping the visitor's choice for 6 months.

What is the difference between a cookie banner and a cookie policy?

The cookie banner is the interactive notice where visitors make their choice. The cookie policy is the detailed page listing each cookie, its purpose, provider and duration. You need both, and the banner should link to the policy.

Do I need consent for Google Analytics cookies?

Yes, in the EU and UK. Google Analytics cookies are not strictly necessary, so they need prior consent. With Google Consent Mode v2, Google tags adjust their behaviour based on the visitor's choice.

Further Reading

• EDPB: Report of the work undertaken by the Cookie Banner Taskforce
• CNIL: Cookies and other trackers
• ICO: Guidance on the use of storage and access technologies
• UniConsent: Reject all button on cookie banners
• UniConsent: Cookie banner dark patterns guidelines
• UniConsent: Cookie Consent Laws
• UniConsent: What Is a Session Cookie?