Cookies and the privacy policy on a company website in the EU: what the law requires

A company website in the EU may store on the visitor's device only what the site needs to work, until the visitor agrees to more. Analytics, the Meta pixel and advertising tags wait for consent. Refusing has to be as easy as accepting, and the privacy policy has to say who you are, what data you collect, which tools receive it and how long you keep it. Below we explain where these rules come from and where sites break them most often.

Which rules apply across the EU

The cookie rule comes from art. 5(3) of the ePrivacy Directive, which every EU country has written into its own law. It speaks of information stored on the user's device rather than of cookies, so localStorage entries and pixel identifiers are covered too. A site may store them after informing the user clearly and getting their consent. Without consent it may store only what is strictly necessary for a service the user asked for, such as a shopping cart or the record of the choice made in the banner. The consent itself has to meet the GDPR standard: freely given, specific, informed and expressed by a clear action.

Each country enforces these rules through its own authorities, so the regulator and the size of fines differ from state to state. Where the stored data identifies a person, the national data protection authority can also act under the GDPR, whose fines go up to 20 million euros or 4% of worldwide turnover. One of the largest recent cases comes from France: on 1 September 2025 the CNIL fined Shein 150 million euros for trackers placed without consent.

The banner: Reject on the first screen, as visible as Accept

European data protection authorities described the most common banner problems in an EDPB report from 2023. Most of them consider a banner an infringement when the layer with the consent button offers no way to refuse. These are the rules we follow on every site:

• three buttons on the first screen, Accept all, Reject and Settings, in the same style;
• nothing ticked in advance: since the Planet49 judgment of the EU Court of Justice (2019), a pre-ticked box is not consent;
• no "legitimate interest" for analytics or advertising cookies, because the EDPB says it cannot be the basis for storing them;
• the name of the company responsible for the data on the first screen, and in the settings a full list of cookies with the provider, purpose and lifetime of each;
• a small button that reopens the settings at any time, because withdrawing consent must be as easy as giving it (GDPR art. 7(3)).

The same CSS does not guarantee the same size on screen. On one of our projects, identically styled Accept and Reject buttons differed in area by 42% on a 390-pixel-wide phone, because the width of each button followed the length of its label. Since then we check the pair on a phone as well as on a desktop.

Google Consent Mode v2 does not block other tags

Consent Mode passes the visitor's decision to Google tags. Version 2, introduced at the end of 2023, added two signals, ad_user_data and ad_personalization, and Google requires them from advertisers in the EEA who want ad personalisation and measurement. In Basic mode the tags do not load until the visitor chooses. In Advanced mode they load with every category denied, store no cookies and send Google cookieless pings, which Google uses to model the conversions it cannot see. Those pings still carry technical data such as the IP address and browser details, and the EDPB's Guidelines 2/2023 treat tracking requests of this kind as covered by the same consent rule.

Consent Mode only governs Google tags. A Meta pixel or Microsoft Clarity added to Google Tag Manager as custom HTML fires whatever the visitor chooses, unless it gets its own consent condition. We measured this on our own site on 13 August 2026: the Meta pixel set the _fbp cookie before the visitor had clicked anything. We moved the pixel out of Tag Manager into code that loads it only after marketing consent.

Basic mode has a measurable cost. On our site, in the 30 days before 21 September 2026, Google Ads recorded 122 clicks while GA4 showed 36 sessions from paid search, so most paid visits could not be tied to the ads that brought them. That is why many advertisers choose Advanced mode. Because of the EDPB guidelines it is a legal decision as much as a business one: describe the mode in the privacy policy and decide it together with whoever is responsible for data protection in your company.

What the privacy policy has to say

GDPR art. 13 lists what a person must be told when you collect their data. Even a simple business-card site with a contact form collects data, if only in server logs. In practice the policy should contain:

• the controller as a legal entity, with the full company name, registration number and address, not just the brand;
• what data you collect, for what purpose and on what legal basis;
• who receives it, including the hosting provider, Google, Meta and Microsoft, and on what basis data goes to the US (the EU-US Data Privacy Framework or standard contractual clauses);
• how long you keep each type of data;
• the visitor's rights, how to withdraw consent, and the right to complain to a data protection authority;
• the list of cookies and other stored items with their real lifetimes.

Measure those lifetimes on your own site instead of copying them from vendor documentation. Google gives the _ga cookie two years, but Chrome caps every cookie at 400 days, and Safari keeps cookies written by scripts for 7. Link the policy from the footer of every page, from the banner and from every form with a consent checkbox. When someone adds a tool, say a heatmap or a chat, the policy and the cookie list have to change with it. A policy copied from another company describes that company's data flows.

After withdrawal the cookies must go

When a visitor withdraws consent, the site should delete the analytics and advertising cookies and reload. On one site we tested, _ga and _fbp survived "withdrawal" with identical values, because the deletion did not cover the domain they had been set on. The Meta pixel also writes lastExternalReferrer and lastExternalReferrerTime to localStorage, and on one live site both entries stayed after withdrawal. Cookies set on Meta's or Microsoft's own domains cannot be deleted by your site at all, and the policy should say so plainly.

Check your own site in five minutes

1. Open the site in a private window and leave the banner alone.
2. Open the developer tools (F12), go to the Application tab and look at Cookies and Local Storage. Before consent you should see only what the site needs, such as the record of the visitor's choice.
3. Click Reject and refresh the page. _ga, _fbp, _clck and similar entries should not appear.
4. Click Accept, then withdraw consent with the settings button and check that the cookies are gone.
5. Compare what you see with the list in your privacy policy.

If something appears before consent, look for a tag that ignores the banner: a custom tag in Tag Manager without its own consent condition, a WordPress plugin, a chat widget, or code left by a previous contractor. We set up the banner, Consent Mode and the privacy policy on every website we build, and we can check an existing site too. Send us the address through the contact page.