What Is Consent?

Consent is the prior approval a user gives, through an active action, for a website to set cookies or similar non-essential technologies in their browser. Article 5.3 of the ePrivacy Directive (2002/58/EC, amended by Directive 2009/136/EC) requires it, the rule that specifically governs access to and storage of information on a user's terminal equipment.

When those cookies also allow identifying a person, for instance through an identifier tied to their browsing behavior, the GDPR kicks in as the general data protection framework. The relationship between the two laws is straightforward: the ePrivacy Directive decides whether the cookie can be placed on the device at all, and the GDPR governs what happens afterward with the personal data that cookie generates.

Not every cookie needs consent. Cookies strictly necessary to deliver the service the user requested, such as a shopping cart or an active login, are exempt under Article 5.3 itself. Consent is only mandatory for analytics, personalization, or advertising cookies.

In the European Union, the only valid model for any non-essential cookie is opt-in: nothing gets set until the user grants authorization with a clear gesture, such as clicking "Accept." A pre-ticked box, or a banner that only offers "learn more" without an equally visible reject button, doesn't meet that requirement.

Technically, consent is managed through a consent management platform (CMP). Before the user decides, the CMP blocks any non-essential script from loading: triggers for tracking pixels, analytics tools, or advertising tags stay paused until there's an explicit decision. The CMP usually integrates with the site's tag manager, so each script gets tied to a category (necessary, preferences, statistics, marketing) and only fires once that specific category gets a green light.

When the user accepts, rejects, or customizes their choice by category, the CMP stores that decision with an identifier and a timestamp, and only then releases the corresponding scripts. That log serves as proof to a data protection authority that the site asked for consent before acting, not after. If the user changes their mind later, that same CMP has to let them review and change their choice with the same ease it took to give it.

A common implementation mistake is confusing "visually hiding the banner" with "blocking the script." If a cookie has already been set in the background while the banner is still on screen, consent hasn't been respected, even if the user hasn't clicked anything yet. This technical error shows up in banners poorly wired into the site's tag manager, and turns a configuration problem into a legal violation.

Consent serves a concrete legal function: it separates a website that respects the user from one that installs tracking without permission. To be valid, it has to meet several conditions at once: freely given, informed, specific, unambiguous, granular, and revocable with the same ease it took to grant it, something both the ePrivacy Directive and the GDPR require once personal data is involved.

Granular means, in practice, being able to accept analytics while rejecting advertising or the use of demographic data separately, instead of a single switch that lumps every purpose together. The most debated point is "cookie walls," banners that block access to a site unless the user agrees. Guidelines 05/2020 from the European Data Protection Board hold that this practice, without a genuine alternative, fails to meet the requirement that consent be freely given.

Opinion 08/2024 from the same board, focused on "consent or pay" models used by large platforms, nuances that position: it concludes that in most cases, offering only payment or accepting advertising as the two options isn't enough either, and that an equivalent free alternative is needed for consent to be valid. That gets assessed case by case, depending on the platform's market power.

• Block all non-essential scripts by default through the CMP, and release only the ones tied to the category the user accepted.
• Design the banner so the "reject" button is just as visible and reachable as "accept," with no colors or sizing that nudge the user toward one choice.
• Offer granular consent by category (necessary, preferences, statistics, marketing), not a single all-or-nothing toggle.
• Log every decision with an identifier, the accepted category, and a timestamp, so it can be proven to a supervisory authority.
• Make it just as easy to withdraw consent at any time through a visible link, with the same number of clicks it took to give it.
• Write the banner's information in plain language, instead of pushing everything into a twenty-page privacy policy to explain what each cookie does.

• Visually hiding the banner without actually blocking the cookie or tracking pixel script, so tracking starts before the user decides.
• Using a pre-ticked box on "accept all," or highlighting that button while "reject" stays buried in a submenu.
• Lumping every purpose into a single toggle, without letting users accept analytics and reject advertising separately.
• Treating a lack of response, or simply continuing to browse, as implied acceptance.
• Skipping a check, during a technical SEO audit, of which scripts load before consent, a mistake that hurts both legal compliance and page speed.