GDPR Cookie Consent Checker

Cookie consent is governed by two EU laws. Article 5(3) of the ePrivacy Directive, applied through each country's national law, allows storing or reading information on a user's device only with consent, unless it is strictly necessary for the service the user asked for or for transmitting a communication. The GDPR defines what consent means: freely given, specific, informed and unambiguous, given by a clear affirmative action (Article 4(11)), and as easy to withdraw as to give (Article 7(3)).

In 2023 the national data protection authorities agreed, in the EDPB Cookie Banner Taskforce report, which banner practices do not produce valid consent: no reject option on any layer, pre-ticked boxes, a reject option hidden as a link in the text, claiming legitimate interest for cookies, and no easy way to withdraw. The Court of Justice confirmed in Planet49 (C-673/17) that pre-ticked boxes are not valid consent, whether or not the cookie data is personal data. Our article Cookie Banners: What EU Regulators Actually Check goes through each point.

The key principle is simple: no non-essential cookies before consent. This means your analytics, marketing pixels, social media widgets, and advertising scripts must all wait until the user clicks accept. Only strictly necessary cookies (session management, security, load balancing, remembering the user's consent choice) can be set without consent.

These are the items the tool above checks, in 4 areas. Items marked critical are the ones regulators check first; a single "no" on any of them usually means the consent is not valid. The same list is available to AI assistants through our MCP server.

Cookie Banner & Consent (7 items)

The banner must ask before anything non-essential runs, and saying no must be as easy as saying yes (GDPR Articles 4(11) and 7(3); the EDPB Cookie Banner Taskforce report). Guide: cookie banner requirements.

• Cookie consent banner is displayed before any non-essential cookies are set (critical)
• Banner offers clear Accept and Reject options with equal prominence (critical)
• Rejecting cookies is as easy as accepting them (no dark patterns) (critical)
• No pre-ticked boxes for non-essential cookies (critical)
• Consent is obtained before loading analytics, marketing, or tracking scripts
• Cookie wall (blocking access until consent) is NOT used
• Users can change or withdraw cookie consent at any time

Cookie Information & Transparency (5 items)

Consent only counts if it is informed: visitors need to know which cookies you use, who sets them and why (GDPR Articles 12 and 13). Your privacy policy should describe the same cookies.

• Cookie policy lists all cookies used with name, purpose, provider, duration, and type
• Cookies are categorized (Necessary, Analytics, Marketing, Functional)
• Third-party cookies and their providers are disclosed
• Cookie policy is easily accessible from every page
• Cookie information is written in clear, plain language

Technical Implementation (6 items)

A compliant banner design is not enough if the scripts behind it fire anyway. These items check that the code respects the choice, and that you can prove consent later (GDPR Article 7(1)).

• Non-essential cookies are blocked until explicit consent is given (critical)
• Third-party scripts (analytics, ads) do not load before consent
• Cookie consent preferences are stored and respected on return visits
• Consent records (who, when, what) are logged for accountability
• Cookie consent mechanism works correctly on mobile devices
• No cookies with excessive lifetimes (review cookies lasting >12 months)

Legal Compliance (5 items)

The legal groundwork behind the banner: national cookie rules, the exemption for strictly necessary cookies, and contracts with the third parties that set cookies. Guide: GDPR lawful basis.

• Cookie consent meets GDPR requirements (freely given, specific, informed, unambiguous)
• ePrivacy Directive (cookie law) requirements are addressed
• Legal basis is documented for each cookie category
• Cookie policy references are included in main privacy policy
• Each third-party cookie provider's role is settled: a processor with a data processing agreement, or a joint controller with an Art. 26 arrangement

Several checklist items, especially the critical technical ones, are hard to answer from memory. You can check them with any desktop browser and no extra software:

1. Start clean. Open a private (incognito) window, so no earlier choice is stored.
2. Open the developer tools before the page loads (F12, or right-click and choose Inspect). In Chrome and Edge, go to Application › Cookies; in Firefox, Storage › Cookies. Keep the Network tab open too.
3. Load your site and do not touch the banner. Only strictly necessary cookies should appear. Analytics cookies (for example _ga), advertising cookies (for example _fbp, _gcl_au) or requests to tracking domains in the Network tab mean scripts run before consent (items "Non-essential cookies are blocked" and "Third-party scripts do not load").
4. Click Reject. Then reload and browse two or three pages. Nothing new should be set, and the banner should not keep coming back on every page.
5. Withdraw consent. In a new private window, accept everything, then look for the link or icon that reopens the settings. Withdrawing should take no more clicks than accepting did.
6. Repeat on a phone. Check that Accept and Reject are both visible without scrolling and that the settings layer is usable on a small screen.

Do this again after every change to your tag manager, analytics or advertising setup. New tags are the most common way a compliant site becomes non-compliant.