Organisations should move from passive browsing-based consent to an explicit positive action, then present the main purposes clearly on the first layer. They should also give visitors an easy way to revisit settings and withdraw consent later, and keep evidence that consent was valid. A compliant banner is both a user choice mechanism and a defensible record of consent.
What CNIL expects from a compliant consent flow
CNIL’s practical expectation is that consent must be an active choice, not assumed from continued browsing or from a pre-ticked preference. That means the first screen should make the main purposes understandable at a glance, with the ability to accept, refuse, or configure without friction. A flow that nudges choice but preserves user control is the baseline.
For practitioners, the key design test is whether the visitor can understand what they are agreeing to before any optional tracker is set. If the banner forces a decision through ambiguity, bundles too many purposes together, or hides refusal behind extra steps, it stops looking like consent and starts looking like interface pressure.
Practical implementation details matter as much as legal wording. Consent state should be durable enough to support later proof, and the interface should let a user return to settings and withdraw consent without hunting through the site. That turns the banner into a lifecycle process, not a one-time prompt.
- Present the main purposes on the first layer.
- Offer accept, refuse, and settings in a comparable way.
- Make withdrawal as easy as granting consent.
- Retain evidence that the recorded choice was valid.
Common failure modes in cookie banners
Most non-compliant flows fail in predictable ways: they treat mere page use as consent, bury refusals, or make the “details” path easier than the refusal path. Another common mistake is hiding too much behind a generic “continue” button, which may feel operationally convenient but weakens the evidential value of the choice.
Another issue is fragmentation. If purposes are described too broadly, or if a visitor must configure each vendor separately before they can refuse, the flow becomes confusing rather than informative. CNIL expects the user’s decision to be specific enough to be meaningful, which means the design has to help the person understand the categories being enabled.
Cookie consent also fails when organisations focus only on the banner and ignore the records behind it. If the site cannot show what text was displayed, which version was accepted, and when the preference changed, it becomes difficult to defend the consent state later.
EU General Data Protection Regulation (GDPR) remains the core legal reference for consent, including the requirements around lawful processing, transparency, and accountability.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while GDPR and ISO/IEC 27001:2022 define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| GDPR | GDPR — EU General Data Protection Regulation | Consent flow design must meet EU consent and transparency obligations. |
| Recommendation — Align banner choices with valid consent, transparency, and withdrawal requirements. | ||
| NIST SP 800-53 Rev 5 | AU-9 — Protection of Audit Information | Consent records need tamper-resistant evidence of user choices and changes. |
| Recommendation — Protect consent logs so recorded choices remain defensible and reviewable. | ||
| ISO/IEC 27001:2022 | A.5.34 — Privacy and protection of PII | Cookie consent flows handle personal-data consent and privacy notice expectations. |
| Recommendation — Document consent handling as part of privacy and PII governance. | ||
Practitioner Guidance
What to verify: Test the banner the way a visitor experiences it, not the way the CMS or consent tool describes it. Confirm that refusal is one click or an equivalent low-friction path, that no optional tags fire before choice, and that preference changes propagate across the site consistently.
Evidence to retain: Keep a record of the banner copy, purpose list, timestamp, consent version, and withdrawal path in use at the time of the choice. If challenged, the organisation should be able to show not just that consent was collected, but that the interface made informed, unforced consent possible.
Common mistake: Treating compliance as a visual redesign is usually insufficient. The harder problems are tag sequencing, vendor coordination, and recordkeeping, because those are what determine whether consent is actually valid after the banner is closed.
Practitioner takeaway: A CNIL-aligned banner is judged by the quality of the choice it creates and the proof you can later produce, so design for clarity, refusal symmetry, and auditable consent history together.
Related resources from NHI Mgmt Group
- How should organisations design cookie consent flows to satisfy strict privacy rules?
- How should organisations update cookie consent workflows to meet the TTDSG’s requirements?
- How do organisations operationalise NHI ownership at scale?
- Why do misleading consent statements present significant risks?
