Legal and compliance
What is Cookie consent?
Permission obtained before setting any cookie that is not strictly necessary for the site to function. Valid consent must be freely given, specific, informed and as easy to refuse as to accept — which most banners are not, because they set analytics cookies before anything is clicked.
Also called: cookie banner · consent management
What makes a banner non-compliant
- Non-essential cookies set before consent is given — the most common failure by far
- Reject buried behind a settings page while Accept is one click
- Pre-ticked category boxes, which are not consent
- No way to withdraw consent later
- Continuing to browse treated as agreement
Which cookies are exempt
Strictly necessary ones: session identifiers, cart contents, load balancing, security tokens, and the record of the consent choice itself. Analytics is not strictly necessary regardless of how useful it is, which is the point most often argued and least often won.
The simplest compliant answer
Set no non-essential cookies. A privacy-respecting analytics tool that uses none removes the banner entirely — which is faster, better for conversion, and eliminates the whole compliance surface rather than managing it.
Where this is covered in depth
A definition can only go so far. Core Web Vitals, and the order that actually reduces them covers this properly — 3 minutes, free, no email required.
Who wrote this
Anas Bin Masud builds e-commerce sites and does technical SEO for businesses in the UK, Canada and Pakistan. These definitions come from client work rather than from a content brief — where an entry describes a mistake, it is usually one found on a real site. More about how I work.