StrongPrivacy

Guide

What a GDPR cookie banner actually has to do.

A checklist, with the reasoning attached. Most banners fail on two items, and they are the same two items every time.

Applies in
EEA, with UK close behind
Fails most often on
Refusal parity and prior consent
Evidence
Per-visitor records
Not required
A modal overlay

The checklist

  1. 1

    Nothing optional runs first

    Prior consent means the optional loader is not created before the applicable grant. Test for duplicate installations and secondary loaders, because controlling one path does not control another.

  2. 2

    Refusing is as easy as accepting

    Give refusal comparable prominence and effort to acceptance. Exact presentation requirements vary, but making refusal materially harder is a recurring regulatory concern and a strong indicator of manipulative design.

  3. 3

    No pre-ticked anything

    Settled by the Court of Justice in Planet49. Optional categories start off.

  4. 4

    Granular choices are available without accepting first

    A visitor must be able to reach per-category controls from the banner, not only after agreeing to everything.

  5. 5

    Withdrawal is as easy as consent

    A preference centre reachable from every page, not a support email.

  6. 6

    The information is genuinely informative

    What the categories cover, who the parties are, and a link to the privacy notice. In a language the visitor reads.

  7. 7

    You can demonstrate it afterwards

    Per-visitor records tied to the configuration version that was live.

What is not required

  • A full-screen modal: a corner card is fine, as long as nothing optional runs
  • A cookie wall as such, though conditioning access on consent raises a freely-given problem that needs its own analysis
  • Blocking strictly necessary storage, which is exempt and should not be gated
  • Re-asking on every page, which is a defect rather than diligence

A five-minute self-assessment

Two questions

Open the site in a fresh profile: does the network panel show a marketing host before you touch anything? Then count the clicks to refuse everything against the clicks to accept everything. If the first answer is yes or the second is uneven, you have found the work.

Common questions

Can I make the accept button more prominent?

Prominence asymmetry is the defect regulators cite most. Same level, same weight, same cost in clicks is the standard to design to.

Is a cookie wall allowed?

It raises a direct question about whether consent is freely given, and European guidance has been sceptical. Some national positions are more permissive than others. It needs advice rather than a default.

Sources and verification

Verified on . Product-behaviour statements were checked against the current implementation and tests. The links below are the verification basis recorded for this article. They support the stated facts, not a legal conclusion for every site or configuration; recheck changing vendor behaviour before relying on it in production.

See what your own site is loading

A browser scan reports the requests and storage it observed during the sampled journey. Use configured workspace scans to compare the states and pages that matter to your implementation.

Run a free scanSee pricing