Why Your Cookie Banner Is Probably Illegal

The EU has issued over €200 million in cookie banner-specific fines since 2022. France's CNIL fined two major tech companies a combined €210 million in a single action for making it harder to reject cookies than to accept them. The enforcement era is here.

The Most Common Violations

• —Pre-ticked consent boxes: Consent must be an affirmative action. A pre-ticked box is not valid consent under GDPR.
• —No "Reject All" button at the first level: If you have an "Accept All" button, a "Reject All" must be equally prominent.
• —Nudging colors: Making "Accept" green and "Reject" grey or small is a dark pattern regulators specifically cite.
• —Consent by scrolling or browsing: "By continuing to use this site you consent" is not valid consent.
• —Bundled consent: You cannot bundle cookie consent with acceptance of terms of service.

What a Compliant Banner Looks Like

Accept and Reject buttons at equal visual weight on the first layer. Granular category toggles on the second layer. Easy withdrawal of consent at any time. Consent stored with a timestamp and renewed at minimum every 12 months.