Cookie consent law is about what loads, not what the banner says. Watch what fires before a choice.
In the EU and the UK, a website has to ask before it stores or reads anything on a visitor's device that it doesn't strictly need — advertising cookies, third-party analytics, tracking pixels. Here is what cookie consent law asks of a website, what counts as valid consent, how it's enforced — and where monitoring fits. A banner can look right and still let a tracker through; what matters is what actually loads before a choice, and after a Reject.
The consent rules in six points
Summarised from the ePrivacy Directive, the GDPR, EU case law and regulators' guidance. Each country applies them through its own law, so details vary — this isn't legal advice.
Ask before storing or reading
Article 5(3) of the ePrivacy Directive (2002/58/EC, as amended in 2009) allows storing information on a visitor's device, or reading it, only with their consent, given after clear and comprehensive information. The exception is what's strictly necessary to provide a service the visitor explicitly asked for — a shopping cart, a login, remembering the consent choice itself.
Not only cookies
The rule is about any information on the device, whatever the technique. The directive's recitals already name web bugs and hidden identifiers, and the EDPB's Guidelines 2/2023, adopted in final form on 7 October 2024, confirm it can apply to tracking pixels, tracking links and similar techniques — so an advertising pixel that loads before consent is covered too.
Consent means the GDPR standard
Consent has the GDPR's meaning (Articles 4(11) and 7): freely given, specific, informed and an unambiguous, active indication of the visitor's wishes. It must be as easy to withdraw as to give, and the site has to be able to show that it was given.
Pre-ticked boxes aren't consent
In Planet49 (C-673/17, 1 October 2019) the EU Court of Justice ruled that a pre-ticked checkbox the user has to untick is not valid consent to cookies — whether or not the information stored is personal data. Visitors also have to be told how long the cookies last and whether third parties can access them.
Refusing as easy as accepting
The EDPB's cookie banner taskforce (report adopted 17 January 2023) found that most EU authorities treat a banner with an Accept button but no reject option on the same layer as an infringement. France's CNIL asks for a “Refuse all” button at the same level and in the same format as “Accept all”, or another way to refuse that is just as easy.
Germany, France and the UK
Germany writes the rule into § 25 TDDDG (called the TTDSG until 14 May 2024); France applies it through Article 82 of its data protection act and the CNIL's 2020 guidelines. In the UK, PECR regulation 6 applies, and since 5 February 2026 the Data (Use and Access) Act lets some low-risk uses go without consent — security and fraud prevention, and statistics or display preferences visitors are told about and can object to. Advertising cookies still need consent.
Test your cookie banner now — free
Enter a page: Relvato visits it from Europe and shows what loads before a choice and after Reject. Relvato cookie consent checker →
How it's enforced
Cookie rules are enforced by national authorities — the CNIL in France, the state data protection authorities in Germany, the ICO in the UK — and the fines have grown. Three examples:
Shein: €150 million
On 1 September 2025 the CNIL fined Infinite Styles Services, Shein's Irish subsidiary, €150 million. Advertising cookies were placed as soon as visitors arrived on shein.com, before any choice, and new cookies were still placed after visitors clicked “Refuse all” or withdrew their consent.
Google: €325 million
The same day the CNIL fined Google LLC and Google Ireland €325 million in total — for ads shown between emails in Gmail without consent, and for advertising cookies placed at Google account creation without valid consent, where users weren't clearly told that accepting them was a condition of using the service.
UK: up to £17.5 million or 4%
Since 5 February 2026 the ICO can fine a serious PECR breach — cookies included — up to £17.5 million or 4% of global annual turnover, instead of the previous £500,000 cap. The new maximum applies to breaches from that date.
A banner is set up once. What loads behind it changes with every update.
A new marketing plugin, a theme switch or a consent-tool update can put a tracker in front of the banner without anyone noticing. Relvato's Cookie consent monitor watches for that:
Visit as a new EU visitor
A fresh browser in Europe, no cookies, nothing clicked — on your home page, plus a product page on a shop. It records every cookie set and every request to advertising and analytics services before any choice.
Find the banner
It recognises common consent tools — Cookiebot, OneTrust, Complianz, CookieYes, Borlabs, Usercentrics and others — and checks whether a “Reject” or “Only necessary” option is on the first layer.
Click Reject, record again
In a second fresh browser it clicks Reject and records what still loads. Strictly necessary cookies and your own first-party analytics aren't flagged.
Re-tested after every update
Weekly, and after WordPress, theme, plugin and WooCommerce updates. Trackers before a choice, without a banner or after Reject are reported as issues and alert you; no Reject on the first layer is a warning.
What a monitor can't tell you
No tool can certify that your consent is valid. Relvato sees what loads in a browser before a choice and after a Reject; it can't judge whether your banner explains the purposes well enough, whether your cookie categories are right, which legal basis applies or what your vendors do with the data. It doesn't flag your own first-party analytics, and it doesn't decide whether yours needs consent where you operate. It visits from Europe, so it sees the EU version of a geo-targeted banner, and it tests the pages it visits, not every page. Use it to keep a setup a person has reviewed from quietly coming undone.
Questions about cookie consent law
Do I need consent if I only use analytics?
In the EU, usually yes for third-party analytics such as Google Analytics: it isn't strictly necessary, so it waits for consent. Some authorities exempt narrowly configured audience measurement — France's CNIL does, under conditions — and in the UK, since 5 February 2026, analytics used only to produce statistics about your own site no longer needs consent if visitors are told and can object. Check the rules where your visitors are.
Is a cookie wall allowed?
In principle, no. The EDPB's consent guidelines say access to a site shouldn't depend on accepting cookies, so a banner that blocks the content until you accept doesn't produce freely given consent. Some authorities, the CNIL among them, assess “accept or pay” alternatives case by case, and that area is still moving.
Does the same law apply outside the EU and UK?
Similar rules exist elsewhere. Brazil's data protection authority (ANPD) published cookie guidance under the LGPD in October 2022; Quebec's Law 25 has required since 22 September 2023 that functions able to identify, locate or profile a person be off by default; Switzerland mainly requires information and a way to refuse. The United States works the other way round — tracking is allowed until the visitor opts out — which we cover separately.
Can Relvato make my site compliant?
No tool can, and we don't claim to. Valid consent depends on your banner's wording, your vendors, your legal basis and your records, and a person has to review that. Relvato's part is narrower and continuous: after updates, it tests whether trackers load before a choice or after a Reject, so a regression doesn't sit unnoticed until a visitor or an authority finds it.
What does it cost?
The Cookie consent monitor is on every plan, Free included. On Free you run it yourself or weekly; Pro also re-runs it after updates.
Sources
This page summarises the law for website owners; it isn't legal advice. National laws and regulators' guidance differ in detail, so check the rules that apply where your visitors are.
- Directive 2002/58/EC — the ePrivacy Directive, consolidated, Article 5(3) (EUR-Lex)
- Regulation (EU) 2016/679 — the GDPR, Articles 4(11) and 7 (EUR-Lex)
- Court of Justice of the EU — Planet49 (C-673/17), press release, 1 October 2019
- EDPB — Report of the work undertaken by the Cookie Banner Taskforce (2023)
- Germany — § 25 TDDDG, privacy of terminal equipment (gesetze-im-internet.de)
- CNIL — fines on SHEIN and GOOGLE over cookies (September 2025)
- ICO — Guidance on storage and access technologies: what are the exceptions?
- ICO — Statement on the commencement of the Data (Use and Access) Act
See what your site loads before a choice
Add your site and run the Cookie consent monitor. On every plan, Free included.