Is your consent banner truly compliant?

Based on the requirements and recommendations of

• the European Data Protection Board (EDPB), 
• the French Commission on Information Technology and Liberties (CNIL) and 
• the German Data Protection Conference (DSK)

If consent can be given at the top level, users must be able to reject all access requiring consent at that same level.

All buttons must be visible at a glance on any screen size, including mobile.

The banner must not obstruct access to the imprint (legal notice) or the privacy policy, and the consent dialogue must not appear on those pages.

Users must be able to consent to each purpose specifically and independently. A first-level button, such as "Adjust settings" that opens a detailed overview, is one way to provide this.

Checkboxes and sliders must be deactivated by default (opt-in).

The user’s decision — whether consent or rejection — must be stored so that the banner does not appear with every new page view.

Withdrawing consent must be as easy as giving it. An easily accessible link or a static icon (for example, bottom left of the screen) must be permanently available on every page.

Services and cookies must be grouped by their concrete, precise purposes. There must be no uncategorized cookies and no "Other" category.

The main reason is the misuse of data and the possibility of re-identifying users despite IP anonymization. This applies without exception to the so-called extended consent mode (Advanced Consent Mode) of Google Analytics 4 (GA4): the GA4 script loads immediately, before the user makes any selection in the banner. If the user rejects cookies — or does not respond — GA4 sets no cookies in the browser but sends so-called "cookieless pings" to Google's servers.

Cookies used to bill affiliate activities are not exempt from the consent requirement.

Even ostensibly privacy-friendly web analytics services such as Matomo or Piwik PRO cannot be used without consent by default, because they actively read the screen resolution, among other things.

Running separate Consent Management and Tag Management solutions carries a very high risk of incorrect triggers without consent, because every new service must be configured in two different systems. It also requires complex "Trigger Group" configurations in the Tag Manager.

A legally and technically correct configuration becomes even harder with hybrid tracking (with and without cookies), when recording enhanced conversions that involve personal targeting data, or with dual conversion tracking (via both pixel and server side), which requires strict deduplication of the conversion data. The pitfalls are numerous and can lead to both legal violations and costly configuration errors in automated ads bidding.

Many website operators rely on the automatic scanning, blocking, and categorization features of Consent Management solutions. These tools can support manual review, but they are error-prone — especially for less frequently used services. Caution is also warranted because scans are sometimes run only weekly, which can temporarily leave the site non-compliant. Integrated Tag and Consent Management makes automatic scanning and blocking unnecessary.

Because Google Maps and YouTube transmit IP addresses and other device data to Google and set cookies when their scripts and iFrames load, they must not load by default without consent. Here, so-called content blocking is recommended: without consent, only a notice about the hidden content appears, with the option to activate it deliberately via consent.