By Daniel de Almeida Afonso · Last updated: October 9, 2026
A cookie banner is the notice that tells visitors which cookies and similar trackers your site uses and, where the law requires it, asks for their consent before those trackers run. If you serve visitors in the EU, you need one for any non-essential cookie, and it must let people refuse as easily as they accept. If you serve US visitors, you usually need a notice and a working opt-out instead.
This guide covers what a banner is, who needs one, what the main laws require, and what compliant banner text looks like, with copy you can adapt. It also explains how to choose between a free plugin, a custom build, and a consent management platform (CMP). It is general information, not legal advice.
What is a cookie banner?
A cookie banner is the interface layer that informs users about cookies and collects their choices. Most laws do not literally say "banner." They require information, valid consent or an opt-out, and proof that you honored the choice. A banner is simply the most practical way to deliver all three.
Cookies and similar technologies
Cookies are small text files that a website stores on a visitor's device. Each one serves a purpose, such as keeping a session open, remembering a language setting, measuring traffic, or building an advertising profile. Many cookies come from third-party tools you add to your site, such as analytics and ad platforms.
Cookie law applies to more than cookies. The EU rules also cover local storage, tracking pixels, SDKs, and browser fingerprinting. When this article says "cookies," it means all of these.
Banner vs. notice vs. policy
Three terms are often confused:
- Cookie banner or cookie notice: the short message shown when someone arrives, usually with choice buttons.
- Cookie policy (or cookie declaration): the detailed page that lists each cookie, its purpose, its provider, and how long it lasts.
- Consent record: the log that proves who agreed to what, and when.
The banner gives quick information and captures a choice. The policy gives the full detail. The record proves you honored the choice.
Who needs a cookie banner, and what you gain
Who needs one
You likely need a banner if both of these are true:
- Your site or app sets or reads cookies or similar trackers that are not strictly necessary.
- You have visitors in a region that requires consent or an opt-out, such as the EU or EEA, the UK, Brazil, or California.
Common triggers include analytics tools, advertising pixels, embedded video and social widgets, A/B testing tools, and chat widgets that set their own cookies. This applies to businesses of every size and sector. Where you are based matters less than where your visitors are.
Who may not need one
The EU rule has an exemption. Consent is not required for cookies that are strictly necessary to deliver a service the user asked for, or for transmitting a communication. Typical examples are a shopping cart, a login session, and a security token.
A site that uses only those cookies does not need a consent banner under the EU rules. It still has to tell visitors about them in its privacy notice. Be careful here, because analytics and advertising cookies are rarely "strictly necessary," even when they feel essential to you.
Benefits of a well-built banner
A banner is mainly a compliance tool, but a good one also delivers practical value:
- Legal footing: it lets you collect valid consent and block trackers until you have it.
- Evidence: a logged choice is proof you can show a regulator.
- Visitor control: people can decline what they dislike and change their minds later.
- Cleaner data: analytics based on real consent are easier to defend than data collected in a gray area.
- Credibility: a clear, honest banner signals that you treat privacy seriously. Treat this as a soft benefit, not a guaranteed lift in conversions.
What the law requires
Rules differ by region. The sections below cover the frameworks most sites meet first.
European Union and EEA
Two laws apply. The ePrivacy Directive (2002/58/EC), Article 5(3), requires consent before storing or accessing information on a user's device, except for strictly necessary purposes. The GDPR defines what valid consent is and governs any personal data the cookies collect.
Under the GDPR, consent must be freely given, specific, informed, and unambiguous. It must come from a clear affirmative action. The user must also be able to withdraw consent as easily as they gave it (Article 7(3)).
The Planet49 ruling
The turning point was the Court of Justice of the EU's Planet49 judgment of 1 October 2019 (Case C-673/17). It came from a reference by the German Federal Court of Justice, about a German gaming company that used a pre-ticked checkbox for cookie consent. The Court held that a pre-ticked box does not produce valid consent under either the ePrivacy Directive or the GDPR. It also held that users must be told how long cookies last and whether third parties can access them. Our Planet49 explainer walks through the details. The Court's own text is on EUR-Lex.
What EU regulators say about banners
The European Data Protection Board (EDPB) sets the common standard in its Guidelines 05/2020 on consent. Its main points for banners:
- Scrolling or swiping through a page can never count as consent.
- Continuing to browse is not a clear affirmative action.
- A "cookie wall" that blocks access unless the user accepts non-essential cookies does not give a genuine choice.
- Consent for different purposes must be separable.
The EDPB's Guidelines 03/2022 on deceptive design patterns (final version, February 2023) target social media interfaces. They also give useful do's and don'ts for any consent interface, such as not steering users toward "accept" with color, size, or placement. National regulators such as France's CNIL apply the same idea strictly: refusing must be as easy as accepting. For the full EU picture, see our GDPR cookie consent guide.
What is changing in the EU
Two items are worth watching. Neither has changed your obligations yet.
- ePrivacy Regulation: the long-planned replacement for the ePrivacy Directive is dead. The European Commission announced its withdrawal in its 2025 work programme, citing no foreseeable agreement. The 2002 Directive and the national laws based on it still apply.
- Digital Omnibus: in November 2025 the Commission proposed moving cookie and tracking rules for personal data into the GDPR, with a refusal option as easy as accepting and browser-level signals. As of this update the proposal is still in negotiation. Reports differ on details, including what happens to the browser-signal article, so check the Council and Parliament pages before you plan around it.
United States
US law mostly works on an opt-out model, with no general rule that you must obtain consent before setting a cookie. State laws instead give people the right to opt out of the sale or sharing of personal data and of targeted advertising. Sensitive data usually needs opt-in consent.
California is the clearest example:
- The CCPA, as amended by the CPRA, applies to businesses with annual gross revenue above $26,625,000 (the figure adjusted for inflation from January 2025), or that meet the data-volume or data-sale tests.
- If you sell or share personal information, you must offer a clear opt-out, such as a "Do Not Sell or Share My Personal Information" link.
- You must honor opt-out preference signals such as Global Privacy Control (GPC).
- Choices must be symmetrical. Opting out cannot take more steps than opting in.
- The administrative fine is up to $2,663 per violation, or $7,988 for intentional violations and those involving minors, under the amounts the agency published for 2025.
Enforcement has focused on exactly these banner mechanics. In 2022 Sephora settled for $1.2 million, in part because it ignored GPC signals. In March 2025 the California Privacy Protection Agency fined American Honda $632,500. Its consent tool took two steps to decline advertising cookies and one step to accept them.
Many other states now have comprehensive privacy laws, and several require businesses to honor universal opt-out signals. Our US state privacy laws overview tracks them. Older versions of this article said that Virginia and Colorado impose no cookie-related duties. That is out of date, so check each state where you have visitors.
Brazil, Canada, and elsewhere
- Brazil (LGPD): consent must be free, informed, and unambiguous, and you need a legal basis before processing. Non-essential trackers generally follow the consent route. Fines can reach 2% of Brazilian revenue, capped at R$50 million per infraction. Older versions of this article said 4%, which is the GDPR figure.
- Canada (PIPEDA): you must obtain meaningful consent, which can be implied for low-risk uses and should be express for sensitive ones. The banner text must not be misleading.
- Other countries: most modern privacy laws expect clear notice and some form of consent. Check local rules before you assume a market has none.
Opt-in vs. opt-out at a glance
| Opt-in (EU model) | Opt-out (US model) | |
|---|---|---|
| Default for non-essential trackers | Off until the user agrees | On until the user objects |
| What the banner must do | Ask for consent per purpose, with equal accept and reject options | Give notice and a working opt-out, and honor GPC |
| Typical laws | GDPR with ePrivacy, LGPD | CCPA and most US state laws |
Choose opt-in design if you have EU, UK, or Brazilian visitors. Choose opt-out design if your visitors are only in US states that follow the opt-out model. If you serve both, show regional behavior based on location, or use the stricter opt-in standard everywhere.
What a compliant banner does
The four consent tests translate into concrete design rules.
- Freely given: do not block the whole site until the user accepts. Offer a real "Reject all" option.
- Informed: say what the cookies do, who sets them, and link to your cookie and privacy policies.
- Specific: ask per purpose, such as analytics and advertising. Do not bundle everything into one "I agree."
- Unambiguous: require a click. Toggles start off. Scrolling, closing the banner, or continuing to browse is not consent.
Beyond the design, the banner has to work technically:
- Block before consent: non-essential scripts must not fire until the user opts in.
- Honor refusal: a "Reject all" must stop all non-essential trackers.
- Log the choice: store the choice, the date, and the banner version.
- Let users change their mind: keep a persistent link or icon to reopen settings.
Cookie banner text examples
Banner wording is where many sites fail. Good copy is short, specific, neutral, and gives the same weight to each choice. The samples below are original templates written for this guide. Adapt them to your actual cookies and have counsel review the final wording.
Example 1: EU first layer
Your privacy choices
We use cookies to run this site. With your permission, we also use them to measure traffic and to show relevant ads. You can accept all, reject all, or choose which purposes to allow. See our Cookie Policy for details.
[Accept all] [Reject all] [Manage choices]
Why it works: it names the purposes, does not pressure, and offers accept and reject at the same level. Buttons should match in size, color weight, and position.
Example 2: Purpose labels for the preference layer
- Strictly necessary (always on): Keeps the site secure and remembers your cookie choice. These cannot be turned off.
- Analytics (off by default): Helps us see which pages are useful so we can improve them.
- Advertising (off by default): Lets us and our partners show and measure ads based on your browsing.
Why it works: each label states the purpose in plain language, and each optional toggle starts off.
Example 3: US opt-out notice
We use cookies and similar tools to run our site, understand how it is used, and support advertising. Some advertising uses count as "sharing" personal information under California law. You can opt out at any time. We honor Global Privacy Control signals.
[Accept all] [Reject non-essential] [Do Not Sell or Share My Personal Information]
Why it works: it names the practice that triggers the opt-out right and gives a clear opt-out path.
Wording to avoid
- "By continuing to browse, you agree to cookies." Browsing is not a clear affirmative action under the EDPB's guidance.
- A bright "Accept" beside a faint "Settings" link. This is the asymmetry that regulators have penalized.
- "We value your privacy" with only an "OK" button. It offers no choice.
- Vague promises like "to improve your experience." They do not state a specific purpose.
- Pre-ticked boxes. The Planet49 ruling rules them out.
Cookie banner design
The law fixes the substance of consent. It leaves the look to you. You can match your brand with colors, fonts, and tone, as long as accept and reject stay equally easy to find and use.
You have three design levers: the visual style, the position, and the copy. Common positions are a bar at the bottom, a corner box, or a centered dialog. A centered dialog that blocks the page draws the most scrutiny, because it can look like a wall. Whatever you pick, keep it readable on mobile and accessible by keyboard and screen reader. Our cookie banner design guide covers layouts and patterns in more depth.
What non-compliance costs
Fines scale with the law that applies:
- GDPR: up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious infringements. Cookie consent cases are often brought under national laws that implement the ePrivacy Directive.
- CCPA/CPRA: up to $2,663 per violation, or $7,988 for intentional violations and those involving minors.
- LGPD: up to 2% of Brazilian revenue, capped at R$50 million per infraction.
Regulators have used these powers on cookie banners specifically:
- January 2022: the CNIL fined Google EUR 150 million and Facebook EUR 60 million because refusing cookies took several clicks while accepting took one.
- September 2025: the CNIL fined Google EUR 325 million in total (EUR 200 million for Google LLC and EUR 125 million for Google Ireland). The decision covered ads inserted into Gmail and cookies placed during Google account creation without valid consent. Read the CNIL announcement.
- 2019: Spain's AEPD fined Vueling EUR 30,000 for a cookie banner with no valid way to refuse. Small companies are not exempt.
Complaints also drive enforcement. The privacy group NOYB filed hundreds of cookie banner complaints in 2021, and a single unhappy visitor can alert a regulator. A non-compliant banner also costs trust, because visitors increasingly recognize misleading consent screens.
Google Consent Mode and the IAB TCF
If you run Google advertising or measurement tools for EEA visitors, two technical standards sit behind your banner. Neither one replaces it.
- Google Consent Mode v2: it passes the visitor's choice to Google tags. It adds two signals, ad_user_data and ad_personalization, to the original analytics_storage and ad_storage. Since March 2024, Google requires valid consent signals for EEA users to keep personalized advertising and remarketing features. Consent Mode transmits consent. It does not collect it, so you still need a compliant banner or CMP. See our Consent Mode v2 guide.
- IAB Transparency and Consent Framework (TCF): an industry standard that lets publishers, ad tech vendors, and CMPs exchange consent signals in the advertising supply chain. TCF v2.3 became the required version for new consent strings around the end of February 2026. Google's documentation gives 1 March 2026. If you monetize with programmatic ads, confirm that your CMP generates v2.3 strings.
Build it yourself, use a plugin, or buy a CMP
There are three realistic ways to get a banner on your site.
| Free plugin | Build it yourself | Paid CMP | |
|---|---|---|---|
| Compliance upkeep | Often limited; check what it actually blocks | You track law changes and update the code | The vendor maintains it, but you still verify |
| Consent records | Frequently missing | You must build logging | Usually included |
| Cost | No license fee | Developer and legal time | Subscription |
| Design freedom | Limited | Full | Broad, often with CSS control |
Free tools can work for a simple site that needs only a notice. Many fall short on the points that matter in the EU: they do not block scripts before consent, and they do not keep records. Test any tool yourself before you trust its claims.
Choose a free plugin if you only need a simple notice, or your visitors are in opt-out regions and your tracking is light.
Choose to build it yourself if you have developers and in-house legal review, and you need a very custom experience.
Choose a paid CMP if you serve EU or UK visitors, run advertising, or operate across several regions and want consent logging, scanning, and updates handled for you.
Whatever you choose, check it against the requirements in this guide before you launch.
Implementation checklist
- Scan your site to list every cookie and tracker, including those set by third-party tags.
- Classify each one by purpose: strictly necessary, analytics, advertising, or other.
- Decide which regions you serve and which model applies: opt-in, opt-out, or both.
- Write the banner and policy text in plain language. Match the wording to the cookies you actually use.
- Block non-essential scripts until consent, and test that "Reject all" really stops them.
- Log choices and give visitors a way to change them.
- Honor GPC for US visitors.
- Retest after every site or tag change. New scripts often reintroduce trackers.
Frequently asked questions
Is a cookie banner legally required?
No law uses the word "banner." But in the EU, you must get consent before setting non-essential cookies, and a banner is the standard way to do it. In opt-out regions like most US states, you need a notice and a working opt-out, which a banner or footer link can provide.
Do I need a banner if I only use essential cookies?
Under the EU rules, no consent is needed for strictly necessary cookies, so a consent banner is not required for them. Disclose them in your privacy notice. Check that none of your cookies serve analytics or advertising, because those need consent.
Can I say "by continuing to browse, you accept cookies"?
Not for EU visitors. The EDPB says scrolling or continued browsing cannot count as valid consent. You need a clear affirmative action, such as clicking "Accept."
Does my banner need a "Reject all" button?
For EU visitors, refusing must be as easy as accepting. In practice, regulators such as the CNIL expect a reject option at the first layer. California rules require that opting out is no harder than opting in.
Does a cookie banner replace my cookie policy?
No. The banner is a short notice with choices. The policy is the detailed record of each cookie and its purpose. You need both.
Do I need a banner in the US?
Often you need a notice and an opt-out for sale, sharing, and targeted advertising, plus honoring GPC. A banner is a convenient way to deliver these, but it is not required by name. Check each state where you have visitors.
