Cookie Consent Under GDPR and ePrivacy
Cookie consent is governed by two overlapping EU regulations: the GDPR (for the personal data aspect) and the ePrivacy Directive (for the device storage aspect). Together, they require that non-essential cookies are only placed after the user has given explicit, informed consent.
Enforcement has intensified dramatically. The French CNIL has issued some of its largest fines specifically for cookie consent violations. Common violations include loading analytics before consent, making the reject option harder to find than accept, using pre-ticked checkboxes, and not providing clear information about each cookie's purpose.
The key principle is simple: no non-essential cookies before consent. This means your analytics, marketing pixels, social media widgets, and advertising scripts must all wait until the user clicks accept. Only strictly necessary cookies (session management, security, load balancing) can be set without consent.
Frequently Asked Questions
Which cookies need consent?
All non-essential cookies require consent before being placed. This includes analytics cookies (Google Analytics), marketing/advertising cookies, social media cookies, and any tracking technologies. Only strictly necessary cookies — those essential for the website to function (session cookies, CSRF tokens, load balancer cookies) — are exempt from consent requirements.
Is Google Analytics consent-free?
No. Google Analytics cookies are classified as analytics/statistics cookies and require user consent before loading, even in GA4. The fact that data is anonymized or that IP anonymization is enabled does not eliminate the consent requirement under the ePrivacy Directive, which governs access to the user's device regardless of whether the data collected is personal.
Related Tools
Privacy Policy Generator
Your privacy policy should reference your cookie practices.
GDPR Compliance Checklist
Cookie consent is one part of broader GDPR compliance.
Disclaimer: This tool is for informational purposes only and does not constitute legal advice. Consult qualified professionals. Created by ClevSec.
Last updated: April 2026