GDPR Cookie Consent Compliance Checker

Formula

Compliance Score = Σ(Requirement Weight × Met); Risk = Critical Failures × Enforcement Likelihood × Maximum Fine

The compliance score weights requirements by regulatory importance, with critical requirements carrying higher weight. Risk assessment combines the number of critical failures with jurisdiction-specific enforcement likelihood and maximum potential fines. This framework works because regulators prioritize certain violations (consent timing, equal choice options) over others (documentation details), and scoring reflects this priority.

Worked Examples

Example 1: E-commerce Site Audit

Problem:A site shows Accept All button, tiny Manage Preferences link, pre-sets analytics, fires GA before consent.

Solution:Critical violations: cookies before consent, pre-ticked boxes, unequal buttons. Fix: block GA until consent, remove pre-ticked, add prominent Reject All.

Result:Non-Compliant | 3 critical failures | HIGH fine risk

Example 2: B2B SaaS Assessment

Problem:B2B platform uses only auth cookies plus one analytics cookie. No consent banner, arguing B2B exemption.

Solution:There is NO B2B exemption. Analytics cookie requires consent. Options: remove analytics or implement minimal consent banner.

Result:Non-Compliant | Need consent for analytics | Consider server-side

Example 3: Media Publisher Compliance

Problem:News site uses 47 third-party cookies. Banner shows only Accept and buried More Options.

Solution:Add first-layer Reject All, implement TCF 2.0, block cookies until consent. Expect 45-55% consent rate vs 95% with dark patterns.

Result:Major gaps | Add Reject All | ~20% initial revenue impact

Frequently Asked Questions

What cookies require consent under GDPR?

All non-essential cookies require consent: analytics, marketing, advertising, and social media plugins. Essential cookies for session, authentication, and security are exempt but should still be disclosed.

What makes cookie consent valid under GDPR?

Valid consent must be: freely given, specific, informed, unambiguous, and withdrawable. Pre-ticked boxes and implied consent are not valid.

Do I need a cookie consent banner?

If you use any non-essential cookies and have EU/UK visitors, yes. If your site only uses strictly necessary cookies, you don't need a consent banner but should have a cookie policy.

What is the reject all requirement?

Recent guidance requires that rejecting cookies be as easy as accepting them. Accept All buttons must have equally prominent Reject All options.

How long does cookie consent last?

GDPR doesn't specify duration, but regulators suggest 6-12 months maximum. After this period, re-obtain consent.

What records must I keep of consent?

Keep: who consented, when, what they were told, what they agreed to, and how they can withdraw. Consent management platforms typically handle this.

What are the fines for non-compliance?

GDPR: up to €20M or 4% of global annual revenue. UK GDPR: £17.5M/4%. CCPA: $7,500 per intentional violation.

Does GDPR apply to US companies?

Yes, if you process data of EU residents. GDPR has extraterritorial scope regardless of company location.

What is a consent management platform?

CMPs like OneTrust, Cookiebot automate cookie consent collection, banner display, preference management, and record-keeping.

How do cookie walls affect compliance?

Cookie walls (accept or leave) are generally non-compliant because consent isn't freely given. Avoid them entirely.

Background & Theory

GDPR cookie consent compliance ensures websites collect valid consent before setting non-essential cookies, giving users meaningful control over their data.

Concept Overview

Cookie consent under GDPR requires affirmative, informed action before setting non-essential cookies. This means no tracking until the user actively chooses, with clear information about what cookies do and genuine ability to decline.

The technical challenge is blocking scripts until consent. Tag managers, analytics, and ad tech must wait for consent signals. Consent management platforms orchestrate this flow while maintaining records for accountability.

Key Variables & Intuition

Essential cookies — Required for basic function; no consent needed but disclose
Analytics cookies — Track user behavior; consent required
Marketing cookies — Enable targeted advertising; consent required
Consent validity — Freely given, specific, informed, unambiguous
Consent records — Who, when, what, how to withdraw

Assumptions

Users understand cookie purposes when explained clearly
Technical implementation matches stated consent flow
Consent management platform functions correctly
Cookie audit is current and complete

Limitations & Edge Cases

Server-side tracking may bypass cookie consent (still requires legal basis)
Browser fingerprinting requires consent even without cookies
Third-party scripts may set cookies despite consent settings
Mobile apps have different but related requirements

Interpretation Guide

Compliance Levels:

Fully Compliant: All critical requirements met, score 90%+
Mostly Compliant: No critical failures, score 70-89%
Partially Compliant: Minor critical failures or low score
Non-Compliant: Critical requirements missing

Practical Tips

Audit cookies regularly — Third-party scripts change; keep inventory current
Test consent flow — Verify cookies actually blocked until consent
Use a CMP — Consent management platforms handle complexity
Document everything — Keep consent records for accountability
Train team — Marketing and dev teams need compliance awareness
Monitor enforcement — Regulatory guidance evolves; stay current

Common Mistakes

Assuming consent — Continued browsing is not consent
Dark patterns — Hidden reject buttons invite regulatory action
Pre-ticked boxes — Automatically violates GDPR
Cookie walls — Blocking access for declining is non-compliant
Ignoring third parties — You're responsible for all cookies on your site
Set and forget — Compliance requires ongoing monitoring

History

Cookie consent regulation evolved from early internet privacy concerns through the EU's ePrivacy Directive to today's strict GDPR enforcement regime with significant fines.

Origins & Why It Emerged

Cookies emerged in the 1990s as a web development convenience—maintaining session state and user preferences. Their tracking potential was quickly recognized by advertisers, leading to pervasive cross-site tracking.

The EU ePrivacy Directive (2002, revised 2009) first required consent for non-essential cookies. However, enforcement was weak and cookie banners became permission theater—clicking through without meaningful choice.

GDPR (2018) transformed the landscape. Its strict consent requirements (freely given, specific, informed, unambiguous) and massive fines (4% of global revenue) created real consequences. Regulators began actively enforcing cookie rules.

How It Evolved in Practice

Early cookie banners were compliance theater. Sites showed banners, users clicked OK, and nothing changed. This notice and consent model failed to give users real control.

Enforcement action changed behavior. The French CNIL fined Google €150M and Amazon €35M for cookie violations in 2021-2022. UK ICO issued guidance requiring equally easy accept/reject options. Suddenly, compliance mattered.

Consent management platforms industrialized compliance. Tools like OneTrust, Cookiebot, and TrustArc provided standardized consent flows, preference centers, and audit trails.

Modern Usage Today

Modern cookie consent is complex and contested. Some sites implement genuine choice; others use dark patterns to maximize consent rates while claiming compliance.

Regulatory scrutiny intensifies. NOYB filed mass complaints against sites with deceptive consent flows. The ePrivacy Regulation, when finalized, will further strengthen cookie rules.

Common Misconceptions Historically

Implied consent is valid — Scrolling or continued browsing is NOT valid consent under GDPR
B2B sites are exempt — GDPR applies to all personal data processing regardless of context
Cookie walls are acceptable — Denying service for refusing cookies is generally non-compliant
One-time consent is forever — Consent should be refreshed periodically (6-12 months)