Cookie consent

What cookie consent is about

Cookie consent is the visitor's permission for cookies that are not strictly necessary and the scripts running behind them. Technically necessary cookies, for instance for the basket or the login, need no consent. Everything serving analytics, advertising or the embedding of third party content does. The boundary therefore runs not along the cookie but along the purpose.

Consent is therefore an exception to a prohibition: without permission those scripts must not run. That is the core statement, and most mistakes arise from turning that order around.

What makes consent valid

Four properties are required. Consent must be free, so it may not be forced through disadvantages. It must be informed, meaning the visitor has to see beforehand which providers pursue which purpose. It must be unambiguous, so it results from an active step and not from a pre ticked box. And it must be provable, with the time, the content and the version of the banner the visitor saw.

The designs that are not permissible

• Hiding the refusal: if accepting is one click and refusing is three, the consent is not free.
• All or nothing: without the option to allow individual purposes, freedom of choice is missing.
• Pre ticked boxes: consent has to be given actively.
• Pressure through blocked access: anyone denying access to the site without consent applies pressure.
• Asking again on every visit: anyone forgetting a refusal asks repeatedly. That is permissible but a sign of poor implementation.
• Loading before the decision: if scripts have already loaded before the visitor chose, the banner is decoration.

What is often overlooked in practice

The most common mistake is not in the banner but behind it. A new analytics tool, an embedded map or a video feature gets added without being registered in the consent tool. The banner then looks correct while the script loads without permission. Every new tool therefore needs the question of whether it requires consent, and that question belongs on the check list for every change.

The second mistake is missing logging. Consent that cannot be proven counts as not given in a dispute. The third mistake is missing deletion. Anyone who has given consent can withdraw it, and afterwards the data has to be removed.

Frequent questions

• Do I need a banner with analytics only? Yes, as soon as the analytics does not work anonymously.
• How long does consent last? It lasts until withdrawal; asking again after some months is sensible.
• What happens on breaches? Fines are possible, and competitors can raise a formal challenge.