Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteCONTROL is the privacy-design strategy most directly represented by a cookie control banner. In ENISA’s taxonomy, CONTROL gives people agency over processing of their personal data, including accepting, refusing, changing or withdrawing consent. A banner’s explanatory text also uses INFORM, which requires clear information about what is processed, why, how and with whom. Thus, the best concise answer is CONTROL, with INFORM supporting it.
What CONTROL means in ENISA’s taxonomy
ENISA’s report Privacy and Data Protection by Design – From Policy to Engineering (December 2014) defines the control strategy this way: “The control strategy states that data subjects should be provided agency over the processing of their personal data.” A cookie banner is a practical interface for that agency.
Its controls can let a visitor:
- accept optional cookies or other tracking;
- reject non-essential processing;
- choose purposes separately, such as analytics, advertising or personalization;
- open a preference center and change the decision later; and
- withdraw consent without an unreasonable obstacle.
Those actions are why CONTROL is the closest named strategy. The classification describes a design approach; it does not, by itself, prove that a website’s processing or consent mechanism complies with a particular law.
ENISA identifies eight privacy-design strategies overall. The number eight is a taxonomy count, not a statistic about cookie banners or user behavior. The source is the ENISA report (Privacy and Data Protection by Design – From Policy to Engineering).
Free tools Windows power users keep installed
One-click scans. No signup required.
Why INFORM is also present
INFORM concerns the information a person needs when personal data is processed. The same banner can therefore implement two strategies at once:
| Banner element | Primary strategy | What the visitor should learn or do |
|---|---|---|
| “Accept all,” “Reject optional” and purpose toggles | CONTROL | Make or refuse a meaningful processing choice. |
| Purpose descriptions | INFORM | Understand why data is used and what category of processing is proposed. |
| Vendor or third-party details | INFORM | See which organisations may receive or access data. |
| “Change privacy choices” link | CONTROL | Revisit or withdraw a previous decision. |
| Plain-language explanation of essential cookies | INFORM | Understand what is necessary for the requested service. |
A banner with a prominent consent button but no understandable explanation emphasizes CONTROL while neglecting INFORM. Conversely, a detailed notice with no practical way to refuse or later withdraw may inform people without giving them effective control.
What a banner does not establish
Calling an interface an example of CONTROL is a design classification, not a compliance verdict. A banner alone cannot demonstrate that:
- the stated purposes are lawful or sufficiently specific;
- optional processing is actually disabled before a person chooses it;
- the site has a valid legal basis for every purpose;
- records of consent, retention and vendor contracts are correct; or
- the design meets the rules of the visitor’s jurisdiction.
These questions concern the wider processing system, not just the visible dialog. A site can display a well-labelled banner while scripts still set optional cookies too early, or while its backend retains more data than the stated purpose needs.
How current data-protection-by-design guidance changes the analysis
The banner is one component of a broader duty. The European Data Protection Board’s February 2026 summary describes data protection by design and by default (DPbDD) as a mandatory, continuous GDPR duty for every organisation. It says privacy protection should be built into systems from the beginning and that defaults should be as privacy-friendly as possible. Its examples include designing security, minimisation and consent features into new software, hardware and processes, and limiting default processing to what each purpose requires (EDPB summary, February 2026).
The European Commission likewise says design measures should be implemented at the earliest stages of processing. Its examples of privacy-friendly defaults include collecting only necessary data, keeping it for the shortest time needed and restricting access (European Commission: Obligations).
For detailed European guidance, consult the EDPB’s final Guidelines 4/2019 on GDPR Article 25, dated 20 October 2020, and check the Board’s website for later updates (EDPB Guidelines 4/2019). The practical implication is that “CONTROL” should be implemented in code, defaults, records and operations, not treated as a decorative banner layer.
How to evaluate whether a banner really provides control
Use the following review sequence on a test browser profile. Record the URL, date, device and region because consent behavior can vary by geography and configuration.
- Check the initial state. Before clicking anything, inspect network requests, storage and page source. Optional tags should not run merely because the banner appeared, unless a specific legal or technical basis applies.
- Read the first layer. Confirm that the purpose of the processing, the broad data categories and the available choices are understandable without requiring specialist terminology.
- Test refusal. Select the clearest refusal option and reload the page. Check whether optional cookies, pixels and tags remain disabled.
- Test granular choices. Open the preference center. Purpose categories should be distinguishable, and a visitor should be able to turn one on without being forced to enable unrelated purposes.
- Test acceptance. Enable one purpose at a time and observe which requests and storage entries appear. The result should match the description shown in the interface.
- Test withdrawal. Find the persistent privacy link or settings control, withdraw or change consent, reload and verify that later processing follows the new choice.
- Check defaults and accessibility. Look for preselected optional purposes, confusing button hierarchy, keyboard access, readable contrast and labels that do not pressure a particular choice.
- Preserve evidence. Save screenshots, request logs, consent records and the configuration version so a later change can be compared with the tested behavior.
Choice presentation and jurisdiction
There is no single visual layout that answers every legal question worldwide. Compare a banner against the law, regulator guidance, processing purpose and audience that actually apply. Useful comparison axes are:
- Information: Can a visitor understand what is proposed, why it is proposed, how it works and which third parties are involved?
- Control: Can the visitor refuse, choose by purpose and later withdraw without undue friction?
- Defaults: Is processing limited to what is necessary until an affirmative choice is made?
- Presentation: Are labels clear, and does the layout avoid misleading or harmful design?
- Scope: Which country, regulator, processing operation and type of visitor are covered?
The UK Information Commissioner’s Office gives scenario-specific advice for consent-or-pay models: use concise, clear, plain language; keep consent for different purposes separate; avoid harmful design practices; and make withdrawal easy to access. This is UK guidance for that scenario, not a universal specification for every cookie banner (ICO privacy-by-design guidance).
Documenting a banner with automated screenshots
When a team reviews many pages, screenshots provide a visual record of the first-layer banner, preference center and withdrawal link. Capture the same URL with the same viewport and region, then pair each image with network and storage evidence. A screenshot proves what was visible; it does not prove which scripts ran, so keep both kinds of evidence.
Or skip the browser setup
ScreenshotNeo is the first service to try for automated website captures because it removes cookie banners, newsletter popups and chat widgets before the shot, bills only clean captures, and has the lowest paid plan. Its API can also preserve a banner when you need to document the visitor-facing state: use custom CSS or JavaScript, click an element before capture, wait for a selector, or supply cookies and headers. Full-page capture loads lazy images; you can choose a device preset or viewport, retina scale, dark mode, image format, PDF settings, caching TTL and signed links. Bulk capture handles up to 100 URLs per call, and async jobs can call a signed webhook.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
See the ScreenshotNeo documentation for current parameters. The basic calls below use the supplied target URL and save the returned image.
cURL
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpPython
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)Node.js
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);Responses identify the result with X-Page-Verdict and X-Billed headers. Bot checks or CAPTCHAs, blank pages, timeouts, failed loads and cache hits are not billed. For AI-assisted audits, its MCP server exposes take_screenshot, get_page_info and capture_pdf to Claude, Cursor and other MCP clients.
| Plan | Allowance | Price |
|---|---|---|
| Free | 1,000 shots per month | No card required |
| Starter | 3,000 shots | $5 |
| Growth | 15,000 shots | $15 |
| Pro | 60,000 shots | $39 |
| Scale | 250,000 shots | $99 |
| Business | 1,000,000 shots | $249 |
Yearly billing gives two months free, and every feature is available on every plan. Create a free ScreenshotNeo account to start with 1,000 screenshots a month and no card.
Troubleshooting a banner review
The banner appears in one region but not another
Consent-management rules, geolocation and stored consent may differ by jurisdiction. Use a fresh profile, set the intended timezone and geolocation, clear cookies, and record the region used for the test.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Optional tags fire before a choice
Inspect the tag manager trigger, script order and server-side collection. Block the optional request by default, then release it only after the relevant purpose is enabled. Test a reload, not just the first page view.
Rank #3
Reject and accept look different
Compare button labels, visual prominence, keyboard focus and the number of steps. If one path is obscured or materially harder, redesign it and retest withdrawal.
An automated screenshot is blank or blocked
Wait for a selector or network idle, supply required cookies or authorization headers, and check X-Page-Verdict. ScreenshotNeo does not bill blank pages, failed loads, timeouts or bot checks; a non-billed result still requires a separate investigation of the site’s response.
Captures are slow or inconsistent
Use a targeted element instead of a full page when appropriate, set an explicit wait condition rather than an unnecessarily long delay, and choose caching with a TTL when the page is unchanged. For large audits, submit bulk or asynchronous jobs and retain the webhook result with the test metadata.
Recommended Free Tools
FAQ
Is a cookie banner always required?
That depends on the cookies, processing operation, applicable law and jurisdiction. The CONTROL classification does not create a legal requirement by itself.
Best Value
Can a preference center be the only interface?
It can be part of the interface, but visitors still need a clear, accessible way to discover it and understand the choice being requested. Whether its placement and wording are sufficient is context-dependent.
Should essential cookies have an opt-out switch?
Essential processing may be treated differently from optional purposes, but the site should explain why it is necessary and avoid describing optional processing as essential merely to remove a choice.
Does a screenshot demonstrate consent compliance?
No. It records presentation at one moment. Compliance review also needs request traces, storage state, consent records, retention settings, vendor information and jurisdiction-specific legal analysis.
Frequently Asked Questions
What is the shortest answer to the title?
CONTROL; INFORM supports the banner’s explanatory text.
Which source defines these strategy names?
ENISA’s December 2014 report, Privacy and Data Protection by Design – From Policy to Engineering.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
