GDPR cookie consent banner requirements: a checklist
The eight things a GDPR cookie consent banner must get right – prior consent, a real reject button, proof and easy withdrawal – and how to meet them.
A cookie banner is where the GDPR and the ePrivacy Directive meet your website. The ePrivacy rules say when you need consent – before storing or reading anything on the visitor’s device that isn’t strictly necessary. The GDPR says what counts as consent. Here is what that means for a banner, with the source for each point and how Omea Consent handles it.
This checklist summarises EU rules and regulator guidance. It is not legal advice – check with your DPO or a lawyer, especially for national rules (the UK applies similar rules under PECR).
The checklist
1. No non-essential cookies before consent
Analytics and advertising cookies, pixels and similar trackers may only run after the visitor agrees. Strictly necessary storage is exempt. Source: ePrivacy Directive art. 5(3).
In Omea Consent: scripts in Scripts stay inert until their category is accepted, nothing is stored in the browser before a choice, and auto-blocking can hold code from your theme and other plugins. A cookie scan checks what is actually set before any choice.
2. Consent is an active choice – no pre-ticked boxes
Silence, scrolling or pre-ticked boxes are not consent. Source: GDPR art. 4(11), CJEU Planet49 (C-673/17).
In Omea Consent: every optional category starts switched off.
3. Rejecting is as easy as accepting
Visitors must be able to refuse as easily as they agree – on the same layer, with equal prominence. Source: EDPB cookie banner taskforce report.
In Omea Consent: Accept all and Reject all are both primary buttons on the banner itself. Even the Pro full-screen layout keeps reject as easy as accept, so it is not a cookie wall.
4. Choices are granular
Visitors should be able to consent to some purposes and not others.
In Omea Consent: the preferences window has a switch per category – Functional, Statistics and Marketing – with Necessary always on. See Cookie consent categories explained.
5. Consent is informed
The visitor must know what they agree to: the purposes, and which cookies are used.
In Omea Consent: the banner links your privacy policy, and the generated cookie policy lists every cookie by category with purpose, provider and duration – updated from your scans.
6. You can prove consent
You must be able to demonstrate that the visitor consented. Source: GDPR art. 7(1).
In Omea Consent: the consent log stores every choice on your own site with a consent ID, time, categories and banner version, with CSV export.
7. Withdrawing is as easy as giving
Visitors must be able to change their mind at any time, as easily as they agreed. Source: GDPR art. 7(3).
In Omea Consent: after a choice, a round cookie icon stays on every page. You can also add a Cookie settings link to your footer. Withdrawing reloads the page and deletes that category’s cookies.
8. Ask again when things change
Consent covers what you asked about. When purposes or texts change, ask again, and don’t rely on very old choices.
In Omea Consent: a choice is remembered for 180 days by default (up to 365), and Ask again when categories or banner texts change is on by default. See Why the cookie banner asks visitors again.
Set it up
All eight points are covered by the free plugin. Follow How to add a GDPR cookie banner to WordPress – it takes about ten minutes.
Frequently asked questions
Does a cookie banner need a Reject all button?
Consent must be as easy to refuse as to give. European regulators, summarised in the EDPB cookie banner taskforce report, have found banners without a reject option on the first layer to be non-compliant. Omea Consent shows Reject all next to Accept all.
Do strictly necessary cookies need consent?
No. The ePrivacy Directive exempts storage that is strictly necessary for a service the user asked for. Everything else – analytics and advertising included – needs consent first.
How long should I keep proof of consent?
The GDPR sets no fixed period. Keep records at least as long as a choice stays valid, plus the time you may need to prove it. Omea Consent’s default retention is 365 days.
Is a cookie banner enough to be GDPR compliant?
No. The banner covers consent for cookies and similar technologies. You still need a privacy policy, a legal basis for other processing and the other GDPR duties. This checklist is not legal advice.