GDPR Cookie Consent Compliance Checker

Formula

Compliance Score = Σ(Requirement Weight × Met); Risk = Critical Failures × Enforcement Likelihood × Maximum Fine

The compliance score weights requirements by regulatory importance, with critical requirements carrying higher weight. Risk assessment combines the number of critical failures with jurisdiction-specific enforcement likelihood and maximum potential fines. This framework works because regulators prioritize certain violations (consent timing, equal choice options) over others (documentation details), and scoring reflects this priority.

Worked Examples

Example 1: E-commerce Site Audit

Problem:A site shows Accept All button, tiny Manage Preferences link, pre-sets analytics, fires GA before consent.

Solution:Critical violations: cookies before consent, pre-ticked boxes, unequal buttons. Fix: block GA until consent, remove pre-ticked, add prominent Reject All.

Result:Non-Compliant | 3 critical failures | HIGH fine risk

Example 2: B2B SaaS Assessment

Problem:B2B platform uses only auth cookies plus one analytics cookie. No consent banner, arguing B2B exemption.

Solution:There is NO B2B exemption. Analytics cookie requires consent. Options: remove analytics or implement minimal consent banner.

Result:Non-Compliant | Need consent for analytics | Consider server-side

Example 3: Media Publisher Compliance

Problem:News site uses 47 third-party cookies. Banner shows only Accept and buried More Options.

Solution:Add first-layer Reject All, implement TCF 2.0, block cookies until consent. Expect 45-55% consent rate vs 95% with dark patterns.

Result:Major gaps | Add Reject All | ~20% initial revenue impact

Frequently Asked Questions

What cookies require consent under GDPR?

All non-essential cookies require consent: analytics, marketing, advertising, and social media plugins. Essential cookies for session, authentication, and security are exempt but should still be disclosed.

What makes cookie consent valid under GDPR?

Valid consent must be: freely given, specific, informed, unambiguous, and withdrawable. Pre-ticked boxes and implied consent are not valid.

Do I need a cookie consent banner?

If you use any non-essential cookies and have EU/UK visitors, yes. If your site only uses strictly necessary cookies, you don't need a consent banner but should have a cookie policy.

How long does cookie consent last?

GDPR doesn't specify duration, but regulators suggest 6-12 months maximum. After this period, re-obtain consent.

What records must I keep of consent?

Keep: who consented, when, what they were told, what they agreed to, and how they can withdraw. Consent management platforms typically handle this.

What are the fines for non-compliance?

GDPR: up to €20M or 4% of global annual revenue. UK GDPR: £17.5M/4%. CCPA: $7,500 per intentional violation.

Does GDPR apply to US companies?

Yes, if you process data of EU residents. GDPR has extraterritorial scope regardless of company location.

What is a consent management platform?

CMPs like OneTrust, Cookiebot automate cookie consent collection, banner display, preference management, and record-keeping.

How do cookie walls affect compliance?

Cookie walls (accept or leave) are generally non-compliant because consent isn't freely given. Avoid them entirely.

What is GDPR and who does it apply to?

The General Data Protection Regulation protects EU residents' personal data. It applies to any organization that processes EU residents' data regardless of where the organization is based. Key requirements include obtaining consent, allowing data deletion requests, reporting breaches within 72 hours, and appointing a Data Protection Officer for large-scale processing.

Background & Theory

GDPR cookie consent compliance ensures websites collect valid consent before setting non-essential cookies, giving users meaningful control over their data. ## Concept Overview Cookie consent under GDPR requires affirmative, informed action before setting non-essential cookies. This means no tracking until the user actively chooses, with clear information about what cookies do and genuine ability to decline. The technical challenge is blocking scripts until consent. Tag managers, analytics, and ad tech must wait for consent signals. Consent management platforms orchestrate this flow while maintaining records for accountability. ## Key Variables & Intuition • **Essential cookies** — Required for basic function; no consent needed but disclose • **Analytics cookies** — Track user behavior; consent required • **Marketing cookies** — Enable targeted advertising; consent required • **Consent validity** — Freely given, specific, informed, unambiguous • **Consent records** — Who, when, what, how to withdraw ## Assumptions • Users understand cookie purposes when explained clearly • Technical implementation matches stated consent flow • Consent management platform functions correctly • Cookie audit is current and complete ## Limitations & Edge Cases • Server-side tracking may bypass cookie consent (still requires legal basis) • Browser fingerprinting requires consent even without cookies • Third-party scripts may set cookies despite consent settings • Mobile apps have different but related requirements ## Interpretation Guide **Compliance Levels:** - Fully Compliant: All critical requirements met, score 90%+ - Mostly Compliant: No critical failures, score 70-89% - Partially Compliant: Minor critical failures or low score - Non-Compliant: Critical requirements missing ## Practical Tips • **Audit cookies regularly** — Third-party scripts change; keep inventory current • **Test consent flow** — Verify cookies actually blocked until consent • **Use a CMP** — Consent management platforms handle complexity • **Document everything** — Keep consent records for accountability • **Train team** — Marketing and dev teams need compliance awareness • **Monitor enforcement** — Regulatory guidance evolves; stay current ## Common Mistakes • **Assuming consent** — Continued browsing is not consent • **Dark patterns** — Hidden reject buttons invite regulatory action • **Pre-ticked boxes** — Automatically violates GDPR • **Cookie walls** — Blocking access for declining is non-compliant • **Ignoring third parties** — You're responsible for all cookies on your site • **Set and forget** — Compliance requires ongoing monitoring

History

Cookie consent regulation evolved from early internet privacy concerns through the EU's ePrivacy Directive to today's strict GDPR enforcement regime with significant fines. ## Origins & Why It Emerged Cookies emerged in the 1990s as a web development convenience—maintaining session state and user preferences. Their tracking potential was quickly recognized by advertisers, leading to pervasive cross-site tracking. The EU ePrivacy Directive (2002, revised 2009) first required consent for non-essential cookies. However, enforcement was weak and cookie banners became permission theater—clicking through without meaningful choice. GDPR (2018) transformed the landscape. Its strict consent requirements (freely given, specific, informed, unambiguous) and massive fines (4% of global revenue) created real consequences. Regulators began actively enforcing cookie rules. ## How It Evolved in Practice Early cookie banners were compliance theater. Sites showed banners, users clicked OK, and nothing changed. This notice and consent model failed to give users real control. Enforcement action changed behavior. The French CNIL fined Google €150M and Amazon €35M for cookie violations in 2021-2022. UK ICO issued guidance requiring equally easy accept/reject options. Suddenly, compliance mattered. Consent management platforms industrialized compliance. Tools like OneTrust, Cookiebot, and TrustArc provided standardized consent flows, preference centers, and audit trails. ## Modern Usage Today Modern cookie consent is complex and contested. Some sites implement genuine choice; others use dark patterns to maximize consent rates while claiming compliance. Regulatory scrutiny intensifies. NOYB filed mass complaints against sites with deceptive consent flows. The ePrivacy Regulation, when finalized, will further strengthen cookie rules. ## Common Misconceptions Historically • **Implied consent is valid** — Scrolling or continued browsing is NOT valid consent under GDPR • **B2B sites are exempt** — GDPR applies to all personal data processing regardless of context • **Cookie walls are acceptable** — Denying service for refusing cookies is generally non-compliant • **One-time consent is forever** — Consent should be refreshed periodically (6-12 months)