What Makes Cookie Consent Valid? Six Checks for Your Banner

 

Many websites show a cookie banner and assume the job is done. Yet if the consent behind your analytics and ad data doesn't meet the legal standard, the data built on it becomes hard to rely on, and your reports rest on choices that don't count.

What valid consent means

Under the GDPR, consent has to be freely given, specific, informed and unambiguous, shown through a clear affirmative act. Recital 32 adds that "Silence, pre-ticked boxes or inactivity should not therefore constitute consent."

In January 2023, the European Data Protection Board published a report from its cookie banner taskforce. It sets out shared positions that EU regulators use when they handle complaints. Six of them make a useful checklist for any website owner.

Six checks for your banner

1. Reject sits on the same layer as Accept. A majority of authorities in the taskforce said a layer with an accept button and no reject option does not meet the requirements for valid consent.

2. Every box starts unticked. The taskforce confirmed that pre-ticked boxes on a second layer do not lead to valid consent.

3. Reject is a clear button. A refusal link tucked into a paragraph of text, with no visual support, was one of the examples the taskforce said does not lead to valid consent.

4. Both choices are readable. The taskforce said colour and contrast need case-by-case review, but a button with text so faint it is unreadable to almost anyone is clearly misleading.

5. "Essential" cookies really are essential. Website owners are expected to keep a cookie list and show why each cookie labelled essential is strictly necessary.

6. Changing your mind stays easy. Article 7(3) of the GDPR says "It shall be as easy to withdraw as to give consent." The taskforce pointed to a small, permanently visible icon or a link in a visible, standard place as ways to do this.

Bringing it together

These checks cover the banner itself. What happens after the click matters too. Tags have to respect the choice, records have to prove it, and settings have to match each visitor's region. That wider picture is set out in our consent management best practices for growing businesses.

Seers AI helps with both sides. It blocks tracking cookies until visitors consent, shows the right banner for each visitor's region, and keeps detailed consent logs you can pull up instantly when someone asks for proof.