GDPR cookie consent in brief
The General Data Protection Regulation (GDPR) is a European law that governs all collection and processing of personal data from individuals inside the EU.
Under the GDPR, it is the legal responsibility of website owners and operators to make sure that personal data is collected and processed lawfully.
A website outside of the EU is required to comply with the GDPR if it collects data from users inside the EU.
Although cookies are mentioned only once in the GDPR, cookie consent is nonetheless a cornerstone of compliance for websites with EU-located users.
This is because one of the most common ways for personal data to be collected and shared online is through website cookies. The GDPR sets out specific rules for the use of cookies.
That’s why, under the GDPR, cookie consent is the most frequently used legal basis that allows websites to process personal data and use cookies.
GDPR requires a website to only collect personal data from users after they have given their explicit consent to the specific purposes of its use.
Websites must comply with the following GDPR cookie consent requirements:
Prior and explicit consent must be obtained before any activation of cookies (apart from whitelisted, necessary cookies).
Consent must be granular, i.e. users must be able to activate some cookies rather than others and not be forced to consent to either all or none.
Consent must be freely given, i.e. not allowed to be forced.
Consent must be as easily withdrawn as they are given.
Consent must be securely stored as legal documentation.
Consent must be renewed at least once per year.
However, some national data protection guidelines recommend more frequent renewal, e.g. 6 months. Check your local data protection guidelines for compliance.
Typically, GDPR cookie compliance is achieved on websites through cookie banners that allow users to select and accept certain cookies for activation rather than others, when visiting a site.
The European Data Protection Board’s (EDPB) guidelines from May 2020 clarify what constitutes valid consent on websites in compliance with the GDPR.
EDPB guidelines state that your website’s cookie banner is not allowed to have pre-ticked checkboxes and continued scrolling or browsing by users cannot be considered as valid consent for processing of personal data.
Users must freely give a clear and affirmative action to indicate their consent in order for your website to activate cookies and process personal data.