Consent Banner

A consent banner, also called a cookie banner or cookie notice, appears on a visitor's first visit. It is usually an overlay, a bar at the bottom of the page or a modal dialog. Non-essential processing may begin only after the visitor interacts with it.

The banner is the visible part of a wider duty in data protection. Behind it sits a consent management platform or an in-house script that works in three steps:

1. 1

   Inform first

   The banner shows who will set the technologies, for which purposes, and which choices exist.

2. 2

   Block until a choice

   Non-essential cookies, pixels, and scripts stay blocked until the visitor decides.

3. 3

   Record and re-offer

   The choice is logged with a timestamp and the notice version. A footer link lets the visitor change it later.

In the European Union, the rule comes from Article 5(3) of the ePrivacy Directive. Storing or reading information on a user's device, which is what cookies and similar trackers do, requires consent. The exception covers only storage strictly necessary for a service the user explicitly requested, such as shopping cart contents or a login session. Analytics and advertising cookies never fall under it.

The GDPR sets the standard that consent must meet: freely given, specific, informed, and unambiguous, expressed through a clear affirmative action. Where sensitive data is processed on the basis of consent, the GDPR requires that consent to be explicit. ePrivacy decides when consent is needed, and the GDPR decides what counts as valid consent. National rules add their own detail, so the wording varies slightly between member states. The opt-in principle applies across the EU, the EEA, and the UK.

Not every banner asks for permission in the same way. Two models dominate, and an international site often runs both at once. Under US state laws such as the CCPA, an opt-out signal sent by the browser or device must be honored.

Whatever model applies, the choice must be provable, because the burden of proof lies with the site operator. A compliant setup records the following for every choice, and keeping that record is part of compliance management:

• when consent was given or refused
• which purposes and vendors the choice covered
• which version of the notice the visitor saw

A banner can be on screen and still be invalid. Supervisory authorities and courts have repeatedly ruled against designs that make accepting easier than refusing.

Regulators apply a simple test: symmetry. Refusing must take one click and look as prominent as accepting, and withdrawing consent must be as easy as giving it. Consent obtained through manipulation is not freely given, and consent that is not freely given does not exist.

In online advertising, the dominant signaling method is the IAB Transparency and Consent Framework, usually shortened to TCF. A consent platform that supports it encodes the visitor's choices, such as purposes consented to, vendors allowed, and objections to legitimate-interest processing, into a standard consent string. Advertising vendors along the chain can read that string and are expected to honor it.

TCF is an industry framework, not a law. Participation is contractual, and both the framework and individual notices built on it have drawn regulatory scrutiny. Whatever tool is used, the rule matters more: no non-essential tracking before a valid, symmetrical choice, and behavioral profiling for advertising needs that same clear consent.

Further reading: Use Anexet Ultimate DLP system for GDPR compliance.