Most cookie consent failures are not missing banners; they are banners that say one thing while the page's tags do another. The ICO is testing the UK's top 1,000 websites, California treats a browser's Global Privacy Control signal as a binding opt-out, and plaintiffs in the US use wiretap statutes against tracking pixels and session replay. This guide covers the legal triggers (ePrivacy Article 5(3), PECR and the CCPA regulations), cookie categories and the strictly necessary test, banner design, consent management platforms, GPC, Google Consent Mode v2, the IAB Transparency and Consent Framework, consent logging and what browser changes to third-party cookies mean for identity providers. It is written for privacy engineers, web and marketing technology owners, security teams who own tag governance, and DPOs who need to know what the implementation actually does.
Key takeaways
- The trigger is device access, not personal data. ePrivacy Article 5(3) and UK PECR regulation 6 require consent for storing or reading information on a user's device unless an exception applies, whether or not the data is personal.
- Reject must be as easy as accept. The EDPB cookie banner taskforce treats a first layer with no reject option as an infringement, and California's 11 CCR 7004 calls "Accept All" next to "More Information" asymmetrical.
- GPC is a legal signal in several US states. Under 11 CCR 7025, a business that sells or shares personal information must treat
Sec-GPC: 1as a valid opt-out request, and frictionless processing rules out pop-ups in response. - The banner is the easy part; enforcement is in the tags. Consent Mode, TCF strings and tag manager triggers must actually block or degrade every non-essential script until consent, and you need logs to prove it.
- Third-party cookies are not going away in Chrome, but they are already blocked elsewhere. Google kept user choice in Chrome in 2025, while Safari blocks third-party cookies by default; federated login and embedded widgets should rely on redirects, CHIPS or FedCM rather than cross-site cookies.
What the rules require
European and UK law regulates access to the user's device (opt-in); US state privacy law regulates the sale and sharing of personal information (opt-out). One CMP usually has to handle both.
| Regime | What triggers it | Model | Key requirements |
|---|---|---|---|
| EU ePrivacy Directive Art. 5(3) with GDPR | Storing or accessing information on terminal equipment | Prior opt-in consent, GDPR standard | Exceptions only for transmission of a communication or where strictly necessary for a service the user explicitly requested; GDPR Art. 7 requires the controller to demonstrate consent and makes withdrawal as easy as giving it |
| UK PECR reg. 6 as amended by the Data (Use and Access) Act 2025 | Storage and access technologies | Opt-in, with new opt-out style exceptions | ICO lists five exceptions: communication, strictly necessary, statistical purposes, appearance, emergency assistance; the statistical and appearance exceptions need clear information and a free, simple way to object |
| California CCPA regulations (11 CCR 7004, 7025) | Selling or sharing personal information, including cross-context behavioural advertising | Opt-out, with opt-out preference signals | Symmetrical choices, no dark patterns, GPC honoured as a valid opt-out of sale/sharing |
| California Invasion of Privacy Act, Penal Code 631 | Reading or learning the contents of a communication in transit without the consent of all parties | All-party consent | Used in litigation over pixels and session replay; several 2025 decisions dismissed claims on interception or standing grounds, but the theories remain in active litigation |
The GDPR recital 32 position that "Silence, pre-ticked boxes or inactivity should not therefore constitute consent" carries into cookie consent, and the ICO says consent "must be more than simply continuing to use the website".
Cookie categories, the strictly necessary test and the audit
Category labels such as "functional" or "performance" have no legal meaning on their own. What matters is the purpose of each storage or access and whether an exception covers it. The ICO assesses strictly necessary from the user's perspective, not the provider's, and states that advertising is never strictly necessary.
| Typical category | Examples | EU (Art. 5(3)) | UK (PECR after DUAA) |
|---|---|---|---|
| Strictly necessary | Session authentication, shopping basket, load balancing, CSRF and fraud-prevention tokens for a requested action, the cookie storing the consent choice itself | Exempt | Exempt |
| Preferences and appearance | Language, dark mode, layout chosen by the user | Consent unless strictly necessary for the requested service | Exempt under the appearance exception if the user is told and can object; not for interest-based personalisation |
| Analytics (first-party, aggregated) | Page view totals, A/B tests, load times | Consent | Exempt under the statistical purposes exception only if aggregated, used solely to improve the service, with a free objection route, and any provider acts only for you |
| Analytics linked to advertising | Conversion linking to ad partners, individual-level tracking | Consent | Consent |
| Advertising and social media | Pixels, retargeting, social plug-ins, cross-site identifiers | Consent | Consent |
| Session recording | Replay scripts capturing clicks, keystrokes and form contents | Consent | Consent in practice; it records individuals, so it does not fit the aggregated statistics exception |
The EDPB taskforce expects website owners to maintain cookie lists and demonstrate why anything labelled essential is essential.
Running a cookie audit
- Crawl with a clean profile: scan key journeys (home, product, checkout, login, account) with no stored consent, recording every cookie, localStorage key, pixel request and third-party host contacted before any interaction.
- Repeat after "Reject all" and after "Accept all": the reject run should look like the pre-consent run. Anything new after reject is a defect.
- Repeat with GPC on: send
Sec-GPC: 1and confirm that sale/sharing tags for US visitors are suppressed. - Map each item to a purpose, owner and vendor: unknown cookies usually come from tags added by marketing outside change control.
- Classify against the exceptions, record the reasoning for every strictly necessary item, and publish the list in the cookie notice.
- Re-scan on every release and at least monthly: tags change without code deployments when they live in a tag manager.
Designing the banner and CMP
What regulators reject
- No reject on the first layer: the EDPB taskforce's vast majority view is that a banner with accept but no reject or refuse option on the same layer does not produce valid consent.
- Reject as a text link: a refusal option shown only as a link without sufficient visual support does not produce valid consent.
- Pre-ticked purposes: invalid under both the GDPR and Art. 5(3).
- Legitimate interest toggles: legitimate interest cannot be the legal basis for placing or reading cookies under Art. 5(3).
- Unreadable alternatives: colour and contrast are judged case by case, but a reject option that is virtually unreadable is "manifestly misleading".
- Asymmetric paths in California: 11 CCR 7004 says choosing the more privacy-protective option must not take more steps than the less protective one, and "Any agreement obtained through the use of dark patterns shall not constitute consumer consent."
What good looks like
- Layered notice: a first layer with Accept all, Reject all and Manage choices at equal weight, the number of third parties, and purposes in plain language; a second layer with per-purpose toggles and a vendor list.
- Just-in-time notices: ask for consent for an embedded video, map or chat widget when the user tries to load it.
- Persistent withdrawal: the taskforce suggests a small, permanently visible icon or a link in a standard place; the ICO states "It must be as easy for people to withdraw consent as it is for them to give it."
- Do not nag: the ICO's online tracking work warns against repeatedly asking users to change their choice after a refusal.
Cookie walls and consent or pay
Making access conditional on accepting tracking undermines "freely given". EDPB Opinion 08/2024 concluded that, in most cases, large online platforms cannot obtain valid consent with a binary choice between behavioural advertising and a fee. It asks controllers to consider a free "equivalent alternative" with less intrusive advertising, such as contextual ads, and says any fee "should not be inappropriately high". The opinion addresses large platforms, but the freely given test applies to everyone.
Opt-out preference signals: GPC and the US privacy string
Global Privacy Control is a browser-level signal. The W3C specification defines three parts:
- HTTP header:
Sec-GPC: 1on every request when the user has enabled it. Servers must ignore any value other than exactly1. - JavaScript:
navigator.globalPrivacyControlreturns a boolean in page and worker contexts, fixed at page load. - Site declaration: an optional
/.well-known/gpc.jsonwithgpcandlastUpdatefields, stating awareness of the signal.
The specification says at least four US states identify GPC as a valid opt-out. Under 11 CCR 7025, a California business that sells or shares personal information must treat the signal as an opt-out for that browser and any profile associated with it. If it conflicts with a setting the user chose on your site, you may notify the user and ask for consent, but must still process the signal, and frictionless processing means no fee and no interstitial pop-ups in response. You may show a message such as "Opt-Out Preference Signal Honored".
For ad-tech signalling, the IAB deprecated the US Privacy String in January 2024 in favour of the Global Privacy Platform (GPP), and Google Ad Manager supports GPP National v2 from September 2025. New implementations should emit GPP strings, mapping GPC into the US sections.
Google Consent Mode v2 and the IAB TCF
Consent Mode
Consent Mode passes the user's choice to Google tags. A gtag('consent', 'default', ...) command must run on every page before any measurement command, followed by gtag('consent', 'update', ...) when the CMP records a choice. Version 2, introduced in November 2023, added two parameters to the original two:
| Parameter | Controls |
|---|---|
ad_storage | Storage such as cookies for advertising |
analytics_storage | Storage for analytics |
ad_user_data | Sending user data to Google for advertising (v2) |
ad_personalization | Personalised advertising such as remarketing (v2) |
- Basic implementation: Google tags are blocked until the user interacts with the banner; if they decline, no data is sent, not even the consent state.
- Advanced implementation: tags load with default states and, while consent is denied, send cookieless pings (consent state, timestamp, user agent, referrer and similar) that Google uses for modelling. Decide with counsel whether those pings are acceptable in your jurisdictions before choosing advanced.
- Useful options:
regionwith ISO 3166-2 codes to set stricter defaults for the EEA and UK;wait_for_update(milliseconds) so tags wait for an asynchronous CMP;ads_data_redactionto further redact ad data whenad_storageis denied;url_passthroughto pass click and session identifiers in URLs instead of cookies. - Policy requirement: Google's EU user consent policy (EEA, UK, Switzerland) requires valid consent, consent records and clear revocation instructions.
IAB Europe TCF
The TCF standardises how a registered CMP records choices in a TC String and shares them with vendors on the Global Vendor List. Version 2.2 (launched 16 May 2023, mandatory from 20 November 2023 per IAB Europe's FAQ) allowed only consent, not legitimate interest, for purposes 3 to 6 (personalised advertising and content profiles), required CMPs to show the total number of vendors on the first layer, added per-purpose data categories and retention periods, required easy re-access to the CMP to withdraw, and deprecated the getTCData command in favour of event listeners. Version 2.3 launched in April 2025 to resolve remaining legitimate interest ambiguity, and IAB Europe gave participants until 28 February 2026 to adopt it. Use the TCF only if you work with programmatic advertising vendors that read TC Strings.
Enforcing choices and keeping evidence
- Gate every tag: attach a consent condition to every non-essential tag, including hard-coded scripts outside the tag manager, the usual leak.
- Server-side tagging: running a tag server on your own domain gives you "full control over how that data is shaped, and where it is routed", but it does not remove the need for consent. Pass the consent state to the server container and filter vendor requests there, otherwise server-side tagging becomes a way to hide tracking from browser-based audits.
- Session recording and chat: load replay scripts only after consent, mask form fields at capture (not after), and exclude login, payment and health pages. CIPA section 631 claims target exactly this category, and although some 2025 decisions favoured defendants, courts are still deciding these cases, so treat the risk as live.
- First-party identifiers: moving an advertising identifier into a first-party cookie or CNAME subdomain does not change its purpose. Safari's tracking prevention caps cookies set via CNAME or IP cloaking at 7 days, and script-set cookies on pages reached through link decoration at 24 hours.
Consent logging
GDPR Art. 7(1) requires the controller to be able to demonstrate consent, and Google's policy requires records of consent. A consent log should let you answer "what did this browser agree to, when, and on which banner?" for any disputed case.
- Record: a pseudonymous consent ID stored in the consent cookie, timestamp, banner and policy version, choices per purpose, how the choice was made (accept all, reject all, granular), jurisdiction rule applied, GPC flag, and the TC or GPP string where used.
- Do not record: full IP addresses or account identifiers unless consent must be linked to a logged-in user.
- Re-consent triggers: new purposes, new vendors or a changed banner version should invalidate older records.
- Protect the log: it is personal data and evidence, so use append-only storage, restricted access and a defined retention period.
Where identity fits: third-party cookies and federated login
Whether third-party cookie deprecation should change an identity provider strategy is clearer than it was in 2024. On 22 April 2025 Google said it would keep its current approach to third-party cookie choice in Chrome and not roll out a standalone prompt, and in October 2025 it retired most Privacy Sandbox APIs while keeping CHIPS and FedCM. Safari already blocks all third-party cookies by default. Identity flows must still work without cross-site cookies, but no Chrome deadline forces a migration.
- Redirect-based SSO (OIDC and SAML with top-level redirects) is unaffected, because the IdP cookie is first-party during the redirect.
- Silent renewal in hidden iframes and third-party session checks break in browsers that block third-party cookies. Use refresh tokens with rotation or top-level redirects. See the OAuth 2.0 and OpenID Connect Guide.
- Embedded widgets (support chat, payment iframes) can use CHIPS: a cookie set with the
Partitionedattribute (andSecure) is keyed to the top-level site, so it works in the embed without enabling cross-site tracking. - FedCM offers browser-mediated federated sign-in without third-party cookies, but is not supported in every browser, so keep a redirect fallback.
- Authentication cookies are strictly necessary; marketing identifiers set at login are not, even when the CIAM platform sets them. See the Identity Data Privacy and Consent Guide.
How to implement
- Baseline (weeks 1-3): run the audit above on production, record every pre-consent and post-reject leak, and agree the purpose taxonomy with legal.
- Choose the CMP model: a simple first-party CMP for sites without programmatic advertising; a TCF-registered CMP with GPP support where you work with ad-tech vendors. Confirm it supports Consent Mode v2, GPC, regional rules and an exportable consent log.
- Build in staging with defaults denied: set Consent Mode and tag manager defaults to denied for EEA and UK regions, map each tag to a purpose, and wire the CMP's update events.
- Test in a pilot: release to one site, locale or traffic percentage. Re-run the clean-profile, reject, accept and GPC scans and compare network traffic, not just cookies.
- Roll out by region, monitoring consent rate and conversion reporting. Fewer measured conversions are expected.
- Roll back safely: keep the previous CMP configuration versioned. If the new banner breaks checkout or login, revert the configuration, not the defaults: never roll back to tags firing before consent.
- Operate: add consent checks to the release pipeline and require a purpose and owner before any new tag goes live.
Detection and measurement
| Metric | Target | How to measure |
|---|---|---|
| Non-essential requests before consent | Zero | Automated clean-profile crawl of key journeys |
| Non-essential requests after "Reject all" | Zero | Crawl after rejection, compared with pre-consent baseline |
| GPC honour rate for in-scope visitors | 100% | Crawl with Sec-GPC: 1; check sale/sharing tags and GPP output |
| Consent rate by region and choice type | Stable, not suspiciously high | CMP analytics: accept all, reject all, granular |
| Tags without an assigned purpose and owner | Zero | Tag manager export against the cookie register |
| Time from new tag to classification | Before go-live | Change control records |
A consent rate far above peer sites usually signals a design problem, not success. A content security policy in report-only mode reveals scripts added outside the tag manager.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| EU law | ePrivacy Directive Art. 5(3); GDPR Art. 4(11), Art. 7, recital 32 | Device access consent; conditions for valid, demonstrable, withdrawable consent |
| UK law | PECR reg. 6 as amended by the Data (Use and Access) Act 2025 | Storage and access exceptions; ICO guidance |
| California | 11 CCR 7004, 11 CCR 7025; Penal Code 631 | Symmetry and dark patterns; opt-out preference signals; wiretap risk |
| EDPB | Cookie Banner Taskforce report (2023); Opinion 08/2024 | Banner practices; consent or pay |
| NIST SP 800-53 Rev. 5 | PT-4 Consent; PT-5 Privacy Notice | Consent mechanisms and notice controls |
| NIST CSF 2.0 | GV.OC-03 | Legal and regulatory requirements, including privacy, understood and managed |
| ISO/IEC 27001:2022 Annex A | 5.34 Privacy and protection of PII | Meeting privacy obligations in the ISMS |
Common failure patterns
- Tags fire before the CMP loads: analytics or pixels hard-coded in page templates run before the banner script, so the default-denied state never applies.
- "Reject all" only hides the banner: the choice is stored but tags are not wired to it, which a reject-run crawl detects in minutes.
- Everything labelled strictly necessary: tag manager, A/B testing and analytics cookies placed in the essential group to avoid the banner.
- GPC ignored or answered with a pop-up: the signal is read but not applied to the US sale/sharing stack, or the site asks the user to confirm, which 11 CCR 7025 forbids for frictionless processing.
- Server-side tagging used to bypass choices: data is forwarded from the tag server to vendors regardless of consent state.
- No usable evidence: the CMP log holds counts but not per-record banner version or choice, so a complaint cannot be answered.
Practitioner checklist
- Run clean-profile, reject-all, accept-all and GPC crawls on key journeys and fix every pre-consent request.
- Maintain a cookie and tag register with purpose, owner, vendor and the exception relied on for each item.
- Put Accept all, Reject all and Manage choices on the first layer with equal prominence.
- Provide a persistent, easy withdrawal link or icon on every page.
- Set Consent Mode v2 and tag manager defaults to denied for EEA and UK visitors, with
wait_for_updatetuned to your CMP. - Honour
Sec-GPC: 1as an opt-out of sale and sharing without interstitials, and emit GPP rather than the US Privacy String. - Use a TCF v2.3 registered CMP only where programmatic advertising vendors require it.
- Log consent per record with banner version, choices, jurisdiction and GPC flag, in append-only storage.
- Gate session recording behind consent, mask inputs at capture and exclude login and payment pages.
- Remove dependence on third-party cookies from login flows using redirects, refresh token rotation, CHIPS or FedCM.
Standards and references
- EUR-Lex: Directive 2002/58/EC (ePrivacy Directive), consolidated text
- ICO: Guidance on the use of storage and access technologies, What are the exceptions?
- EDPB: Report of the work undertaken by the Cookie Banner Taskforce
- EDPB: Opinion 08/2024 on valid consent in the context of consent or pay models
- California Code of Regulations: 11 CCR 7025 Opt-Out Preference Signals
- W3C: Global Privacy Control (GPC) specification
- Google for Developers: Set up consent mode on websites
- IAB Europe: Transparency and Consent Framework
Related NHI Mgmt Group resources: Identity Data Privacy and Consent Guide · Customer IAM (CIAM) Guide · OAuth 2.0 and OpenID Connect Guide · Token and Session Security Guide. This guide summarises EU, UK and California consent rules and industry frameworks as they stood in October 2026 and is not legal advice.