Free tools Windows power users keep installed
One-click scans. No signup required.
A good cookie consent banner makes the visitor’s real choices clear: accept optional tracking, reject it, or choose by purpose. Where consent is required, silence, scrolling, and continued browsing are not consent. The examples below show practical first-layer and settings designs, plus patterns regulators warn against. They are examples to adapt—not proof that a particular website complies with every law.
Example 1: A clear first-layer banner
Keep the opening screen short enough to understand, but specific enough to explain what the visitor is being asked to allow. Use purpose descriptions that match the site’s actual practices; do not list analytics, advertising, or social-media tracking if the site does not use them.
Suggested copy and controls
Your privacy choices
We use necessary technologies to run this site. With your permission, we also use [plain-language purposes that match this site]. Choose which optional purposes to allow. You can change your choice later. See our privacy and cookie details.
Accept all Reject all Choose purposes
![Accident Report Book GDPR Compliant: Essential Workplace Safety Log for Incidents, Health and HSE Reporting Across All Sectors [A4 Size]](https://m.media-amazon.com/images/I/41TlU+HXpHL._SL160_.jpg)
Present “Accept all” and “Reject all” at the same level, with comparable visibility, legibility, and ease of activation. “Choose purposes” can open a more detailed layer. The UK Information Commissioner’s Office (ICO) illustrates equally prominent accept and reject options; France’s CNIL recommends equal simplicity and has described obscured or visually weakened rejection controls as a concern. See the ICO’s practical consent guidance and CNIL’s website guidance.
Example 2: A purpose-by-purpose settings layer
The second layer should let visitors make a real choice for each optional purpose that relies on consent. Explain the activity in ordinary language, identify relevant third parties receiving information, and keep optional controls off by default where consent is the basis.
#1 Best Overall
Suggested settings structure
- Necessary: Explain the site functions these technologies support. If a technology is exempt from consent under the applicable rules, explain its role; do not use “necessary” as a label for optional tracking.
- Analytics: Describe what is measured and, where relevant, name providers receiving information.
- Social media: Describe any tracking or sharing related to social-media features and identify relevant third parties.
- Advertising: Explain whether information is used to select or personalize ads and identify relevant third parties.
Offer clear actions such as “Save my choices,” “Accept all,” and “Reject all.” A necessary category may be informational rather than a toggle if it cannot be switched off within the site. The ICO’s illustrated example includes essential, analytics, social-media tracking, and advertising categories, with optional controls off by default. Treat those categories as examples, not a universal list.
Provide a route back to these controls after the initial decision, such as a persistent footer link labeled “Cookie settings” or a visible settings control. Make it possible to change or withdraw a previous choice. The ICO illustrates a settings icon for revisiting choices; the exact interface can vary.
Example 3: Google advertising and measurement
If a site uses Google services in a context covered by Google’s EU User Consent Policy, the banner and consent signals must address the policy requirements that apply to those services. Google describes the policy scope as the EEA, UK, and Switzerland. Its expectations are platform-policy requirements, not a substitute for local law or a universal rule for every website.
Depending on the relevant service and context, provide clear information about personal-data use, address advertising personalization on the first layer where the policy requires it, disclose sharing with Google, and ensure signals passed to Google reflect the visitor’s choices. Consult Google’s current consent-audit guidance and EU User Consent Policy checklist when configuring the specific products in use.
Examples of patterns to use or avoid
| Pattern | What the visitor sees | How to assess it |
|---|---|---|
| Clear, equal choices | “Accept all” and “Reject all” are similarly prominent, alongside a way to customize. | A strong first-layer pattern consistent with ICO illustrations and CNIL recommendations. |
| Rejection buried in copy | A prominent accept button, while rejection is low-contrast text or hidden in explanatory copy. | CNIL has identified obscured placement and disproportionate size or style as potentially misleading. |
| Several ways to accept, one obscure refusal | Multiple acceptance routes but only one ambiguous or hard-to-find rejection route. | CNIL described this imbalance in a December 2024 enforcement notice. |
| “By continuing” consent | The banner treats scrolling or continued use as acceptance. | The ICO says inactivity is not consent; CNIL guidance treats continued navigation as refusal. |
| Optional controls already on | Analytics or advertising toggles are preselected where consent is required. | Keep technologies that require consent inactive until valid consent is obtained. |
| No way to revisit settings | The visitor cannot readily find or change the initial choice later. | Add a persistent settings route or visible control. |
Why the jurisdiction and actual setup matter
There is no single banner layout that automatically satisfies every privacy regime. Requirements depend on the technologies used, their purposes, the site’s legal basis, and the visitor’s location. The ICO’s practical guidance concerns UK rules, including PECR requirements for storing information on or accessing information from a device. CNIL’s examples and enforcement statements concern French rules and are evaluated in their context.
CNIL has said the law does not mandate one particular presentation of choices, while emphasizing that a design must not mislead users for consent to be valid. It also says complaints and designs are considered case by case. Its guidance says a six-month period for remembering consent or refusal is generally appropriate; that is CNIL’s recommendation, not a universal legal duration.
Consent-or-pay models need separate consideration. The ICO’s privacy-by-design material addresses that specific model, including neutral choices, meaningful information, review or a DPIA, and restrictions on non-essential technologies before consent. It should not be treated as a rule written for every ordinary cookie banner.
Recommended Free Tools
How to implement the examples
- Inventory the technologies. List what the site stores or accesses, each purpose, whether it is optional, and any third parties receiving information.
- Map purposes to controls. Use plain descriptions and controls that reflect the site’s real processing. Do not bundle unrelated purposes merely for convenience.
- Build balanced first-layer choices. Make acceptance and refusal comparably visible and straightforward, with an obvious route to customize.
- Enforce the choice technically. Ensure technologies requiring consent do not run before valid consent. A banner that looks correct but loads optional trackers first does not implement the choice.
- Persist and honor preferences. Record the selection, apply it consistently, and provide a route to revisit or withdraw it. Set retention in line with the rules applicable to the site.
- Check integrations and jurisdictions. If Google services are used, review its policy requirements for the applicable region and make sure consent signals reflect choices. Review the whole design against the site’s relevant laws.
- Test the visitor experience. Verify that reject and accept work, that customization saves the intended settings, that optional technologies stay blocked when required, and that the settings route remains available.
A consent management platform (CMP) can help operate the banner and consent process, but purchasing one does not by itself establish compliance. Evaluate whether it supports the needed jurisdictions, integrations, purpose-level controls, and enforcement of choices.
Or skip the browser setup
To inspect how a site’s banner appears without setting up a browser capture workflow, ScreenshotNeo can return a screenshot from one API request. Cookie banners, popups, and chat widgets are removed before the shot; each step can be turned off. Bot checks, blank pages, timeouts, and failed loads are not billed, and cache hits cost nothing.
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSee the ScreenshotNeo API documentation for request options. An MCP server offers AI agents tools to take screenshots, get page information, and capture PDFs. The Free plan includes 1,000 shots a month with no card; paid plans start at $5 for 3,000 shots. Learn about ScreenshotNeo or sign up free for 1,000 screenshots a month with no card.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common implementation problems
Optional trackers fire before the visitor acts
Likely cause: The banner displays controls, but tags or scripts load independently of the saved consent state. Fix: Gate technologies requiring consent so they remain inactive until the relevant choice is recorded; verify with the site’s tag and network behavior.
Reject is difficult to find
Likely cause: The design gives acceptance a prominent button but relegates refusal to low-contrast text, another screen, or unclear wording. Fix: Put a clear reject action on the first layer and make it comparably visible and easy to use.
Visitors cannot tell what a category means
Likely cause: Categories use internal labels or bundle unrelated activities. Fix: Describe the activity in plain language, identify relevant third parties, and separate purposes where the visitor should be able to choose independently.
Choices cannot be changed later
Likely cause: The banner disappears without leaving a settings route. Fix: Add a persistent cookie-settings link or control and ensure it opens the saved preferences.
Google policy checks flag consent handling
Likely cause: Required disclosures or signals for a Google service and covered region are missing or do not match the user’s selections. Fix: Review Google’s current policy guidance for the products and geography involved, then test that each choice produces the expected signal.
FAQ
Does every website need a cookie banner?
Not necessarily. Whether consent or a banner is required depends on the technologies, purposes, legal basis, and jurisdictions involved. A site should assess its actual setup rather than assume every cookie has the same treatment.
Can I use the same banner design everywhere?
You can use a common interface, but its disclosures, controls, technology behavior, and regional policy settings may need to differ. A single visual design is not evidence of universal compliance.
