You land on a news site and a banner covers half the screen. It asks you to accept cookies, and you tap the biggest button so you can read the article. Did you just give meaningful permission? Under European cookie consent rules, the honest answer is often no, and regulators have spent years explaining why.
What the cookie consent rules say consent means
The General Data Protection Regulation sets a high bar for consent. It must be freely given, specific, informed and unambiguous, and it requires a clear affirmative act. That means the user has to actively do something that signals agreement. Silence, pre-ticked boxes and inactivity do not count.
Applied to the web, the cookie consent rules are straightforward. If a banner says that continuing to browse or scrolling means you accept, the site is treating inaction as agreement. A user scrolling to find the close button, or simply reading, has not made a decision about tracking.
The cookie wall problem
A cookie wall blocks access to the content unless you accept tracking. The objection is that consent obtained under a take-it-or-leave-it condition may not be freely given. If you can’t read the page without agreeing, the choice is hardly a choice. Regulators generally look at whether the user has a genuine alternative and whether refusing leads to detriment.
Some publishers argue that tracking-funded ads pay for free journalism, so a wall is fair. Others offer a paid ad-free option, an approach regulators have examined case by case. The principle is that the user should be able to understand the trade and refuse without being locked out, or at least be offered an equivalent alternative on fair terms.
A familiar example: a news site shows a banner reading “By continuing to use this site you agree to our use of cookies.” You never clicked anything, yet the site claims your agreement. Under the cookie consent rules in Europe, that wording does not create valid consent, because consent needs a deliberate act. Regulators in several countries have said so in guidance and, in some cases, have fined operators who ignored it.
What good design looks like
- Equal prominence: accept and reject buttons that are the same size, color and position.
- No pre-selected options: every non-essential purpose starts switched off.
- Plain language: a description of what each purpose does, not a legal maze.
- Easy withdrawal: changing your mind should be as simple as saying yes was.
- No loading before consent: advertising and analytics scripts that need permission should not fire until it is given.
Dark patterns are the opposite: a bright accept button next to a pale grey link buried in settings, or a reject option hidden three screens deep. Regulators have flagged these tactics as undermining the validity of consent.
Strictly necessary cookies are different
Not everything needs a banner. Cookies that are strictly needed to deliver the service you asked for, like keeping items in a shopping cart or remembering a login session, can be set without consent. Analytics, advertising and cross-site tracking generally cannot, with some exceptions depending on country and how data is handled. Many sites lump everything under the consent request to be safe, which only adds to the clutter.
What you can do as a user
You are not stuck clicking whatever the banner suggests. Use the reject option when it is visible. Check settings pages for granular toggles. Browser features and extensions can block trackers and sometimes auto-handle banners. Privacy settings in your operating system add another layer. Persistent identifiers matter too, so clear cookies periodically if you want to reset what sites know about you.
The same logic applies far beyond Europe, as other countries adopt similar ideas. If you want to see how these rules reach other parts of the digital world, our look at what to do in the first day after a breach and the guide to machine identities and security show how privacy duties and security tools overlap. The regulation itself is summarised in the article on the General Data Protection Regulation.
Publishers face a real tension here, because advertising pays for much of the web. Still, the cookie consent rules do not forbid advertising. They require that the user can say no without penalty and that a yes is a real choice. Some sites now meet the cookie consent rules with contextual ads that need no tracking, and some give a plain ad-free subscription. Both approaches keep the revenue while respecting the rules, and users tend to trust sites that make the choice easy.
What site owners should do under the cookie consent rules
If you run a website, audit what scripts load and what each one does. Remove tools you no longer use. Choose a consent management tool that supports a real reject option and blocks scripts until a choice is made. Record consent so you can show it later. And write the banner as if a regulator and your least technical customer would both read it, because eventually they might.
The broader point is simple. Consent is meant to give people control. A banner that makes the easy path the invasive one defeats that purpose, and the rules are increasingly clear about it.
If you want to check a site yourself, open the developer tools in your browser, look at the network tab before touching the banner, and see which third-party requests already fire. Anything advertising-related that loads before you click is a sign that the banner is decoration rather than a real gate. It takes two minutes and is surprisingly revealing.
Image: Tizio / Wikimedia Commons, CC BY-SA 3.0.
