Cookie Consent Examples — Good, Bad, and Non-Compliant
Cookie consent banners are the most visible part of privacy compliance — and the area where most websites get it wrong. Regulators like CNIL have issued millions in fines specifically for banner design.
This guide shows real patterns we see when scanning websites, explains what's compliant and what isn't, and gives you clear rules to follow.
What GDPR Requires From a Consent Banner
Before the examples, the rules:
- No cookies before consent — non-essential cookies must not fire until the user makes a choice
- Equal prominence — accepting and rejecting must be equally easy
- No pre-checked boxes — cookie categories must be unchecked by default
- Granular control — users must be able to choose by category (analytics, advertising, etc.)
- Withdrawable — users must be able to change their preferences later
- No cookie walls — you can't block content until the user consents
- Clear language — no legal jargon or confusing wording
Good Examples
The Two-Button Banner
We use cookies to improve your experience and analyze site traffic.
[Accept All] [Reject All] [Customize]
Why it works:
- Accept and Reject are equally prominent (same size, same row)
- Customize option for granular control
- Clear, plain language
- No manipulation
This is the pattern CNIL explicitly approves. Both buttons same size, same visual weight.
The Category-First Banner
We use cookies for:
☐ Analytics (Google Analytics — understand how visitors use our site)
☐ Advertising (Meta Pixel, Google Ads — personalized ads)
☐ Functional (chat widget, language preferences)
✓ Strictly necessary (always active — login, security, cart)
[Save preferences] [Accept All] [Reject All]
Why it works:
- Categories are unchecked by default (except strictly necessary)
- Each category explains what it does and names specific tools
- Three clear actions
- Transparent about exactly what each cookie does
The Minimal Notice (for cookie-free sites)
This website only uses strictly necessary cookies. No tracking, no analytics.
[OK]
Why it works:
- If you genuinely don't use non-essential cookies, you don't need consent
- A simple notice is sufficient (and builds trust)
- Can be verified with a free scan
Bad Examples (Non-Compliant)
The "Accept Only" Banner
We use cookies to enhance your experience.
[Accept Cookies]
Why it fails:
- No way to reject — consent isn't freely given
- No information about what cookies are used
- CNIL fined Google 150M euros for this pattern
- Fix: Add an equally prominent "Reject All" button
The Hidden Reject
We use cookies to improve your experience.
[ACCEPT ALL] Manage preferences →
Why it fails:
- "Accept All" is a large, colored button
- "Manage preferences" is a small text link — reject is hidden behind a second screen
- This is the most common violation we see when scanning websites
- CNIL's position: rejecting must be as easy as accepting — same number of clicks
- Fix: Add a "Reject All" button next to "Accept All" with equal visual weight
The Pre-Checked Banner
Cookie preferences:
✓ Strictly necessary
✓ Analytics
✓ Advertising
✓ Social media
[Save preferences]
Why it fails:
- All categories are pre-selected — user must actively untick each one
- GDPR explicitly prohibits pre-checked consent boxes (recital 32)
- Silence or inactivity does not constitute consent
- Fix: Only strictly necessary should be checked. All others unchecked by default
The Cookie Wall
┌──────────────────────────────┐
│ Accept cookies to continue │
│ │
│ You must accept cookies to │
│ access this website. │
│ │
│ [Accept All Cookies] │
└──────────────────────────────┘
Why it fails:
- Consent isn't freely given if the alternative is losing access
- EDPB guidelines state that cookie walls generally make consent invalid
- Some DPAs allow "pay or consent" walls for media sites, but this is contested
- Fix: Allow access regardless of cookie choice
The Confusing Wording
By continuing to browse this site, you agree to our use of cookies.
Why it fails:
- Implied consent (scrolling/browsing = consent) is not valid under GDPR
- No active, affirmative action by the user
- No option to refuse
- Fix: Require an explicit click and provide accept/reject options
Dark Patterns to Avoid
Regulators specifically target these manipulation techniques:
Asymmetric Design
Making "Accept" visually dominant — larger, colored, prominent — while "Reject" is smaller, gray, or text-only. CNIL's rule: both buttons must have equal visual weight.
Extra Clicks to Reject
Accepting takes one click ("Accept All"), but rejecting requires clicking "Manage preferences" → unchecking categories → clicking "Save." CNIL's rule: rejecting must take the same number of clicks as accepting.
Misleading Language
"We care about your privacy" followed only by an accept button. Or "Essential cookies only" as a reject option when you're actually still setting analytics cookies. Say what happens plainly.
Repeated Prompts
Asking again after the user rejected. Once a user makes a choice, respect it. Don't re-prompt on every page or after a timer.
Confirm-Shaming
"No thanks, I don't care about my experience" as the reject option. This is a dark pattern. Use neutral language like "Reject All" or "Decline."
What Regulators Look For
Based on enforcement actions from CNIL, ICO, AEPD, and the Italian Garante:
- Is reject as easy as accept? Same number of clicks, same visual prominence
- Do cookies actually stop after rejection? Having a banner is not enough — scan your site to verify
- Are categories pre-checked? They shouldn't be
- Can users change their mind? A persistent "Cookie Settings" link must be available
- Is the language clear? No legal jargon, no manipulation
- Does the banner match reality? If the banner says "no cookies without consent" but tracking fires anyway, that's worse than no banner at all
How to Test Your Cookie Banner
- Scan your site with Tag Leak — checks if cookies fire before consent and after rejection
- Click "Reject All" on your own site and check DevTools > Application > Cookies — are third-party cookies still there?
- Clear cookies and revisit — does the banner reappear? It should
- Check your footer — is there a "Cookie Settings" or "Privacy Preferences" link?
- Compare button sizes — are Accept and Reject equally prominent?
- Check mobile — does the banner work and remain accessible on mobile screens?
Cookie Banner Requirements by Regulation
| Requirement | GDPR | UK GDPR | CCPA | LGPD | |---|---|---|---|---| | Banner before cookies | Yes | Yes | No | Yes | | Accept/Reject equal | Yes | Yes | N/A | Yes | | Pre-checked boxes allowed | No | No | N/A | No | | Granular categories | Yes | Yes | No | Yes | | Cookie wall allowed | Generally no | Generally no | N/A | Generally no | | Consent logging | Yes | Yes | No | Yes | | Withdraw mechanism | Yes | Yes | Opt-out link | Yes |
Related Reading
- What Is Cookie Compliance? — the fundamentals
- GDPR News Today — latest enforcement actions
- Best Consent Management Platforms — CMP comparison
- Best Cookie Audit Tools — verify your banner works
- Compliance Index — see how websites across industries handle consent