What is assessed
A cookie banner falls under several sets of rules. Storing or reading cookies is governed by the national law transposing Directive 2002/58/EC (ePrivacy); in Romania, Law No 506/2004. The subsequent processing of data, for example for statistics or advertising, falls under the GDPR. The GDPR's conditions for valid consent are used to establish whether the ePrivacy law has been complied with.
Two documents from the European Data Protection Board (EDPB) explain how these rules apply to a banner. Guidelines 05/2020 on consent (version 1.1, adopted on 4 May 2020) are the general document. The Cookie Banner Taskforce report, adopted on 17 January 2023, brings together the common positions of national authorities in response to complaints from the organisation NOYB about cookie banners.
The report states that its positions reflect a minimum threshold, that they are not stand-alone recommendations and that they do not amount to findings by which an authority would approve a particular banner. National requirements and guidance continue to apply, and each banner is assessed case by case.
The option to refuse must exist and be visible
The report describes banners whose first layer contains an accept button and a button leading to other options, but no button to refuse. A vast majority of authorities considered that the absence of a refuse option on any layer containing a consent button does not meet the requirements for valid consent and constitutes an infringement. A few authorities considered that they could not establish an infringement, because Article 5(3) of the ePrivacy Directive does not explicitly mention a reject option.
The form of the option matters too. According to the report, valid consent does not result where the only alternative to accepting is a link worded “refuse” or “continue without accepting” that is embedded in a paragraph of text or placed outside the banner, without sufficient visual support to draw an average user's attention.
Furthermore, the banner must make clear what it is about, the purpose of the consent requested and how it is given. A store must not give the impression that access to content depends on accepting, nor clearly push the visitor towards accepting. The report mentions, as a possibility, continuing to browse without cookies from the first layer.
Pre-ticked boxes, silence and scrolling
Pre-ticked boxes in the preferences layer do not lead to valid consent, either under the GDPR or under Article 5(3) of the ePrivacy Directive. The report refers to Recital 32 GDPR, under which silence, pre-ticked boxes or inactivity do not constitute consent. Consent must be expressed through an affirmative action by the visitor, and without it cookies that require consent must not be set by default.
Guidelines 05/2020 add two points. Merely continuing to use a website is not conduct from which a visitor's agreement can be inferred. And actions such as scrolling or swiping through a page will not under any circumstances satisfy the requirement of a clear affirmative action, because they may be difficult to distinguish from other interactions.
Button colours and contrast
The report also looked at banners in which the accept button is highlighted through colour or contrast compared with the other options. Its conclusion is nuanced: the authorities agreed that no general standard of colour or contrast can be imposed, and that the assessment is made case by case, to establish whether design choices mislead the visitor and result in unintended consent.
The report does, however, give an example regarded as manifestly misleading: the button offering the alternative to accepting has such low contrast between text and background that the text is practically unreadable for any user.
Separate consent for each purpose
According to Guidelines 05/2020, where processing serves several purposes, people must be able to choose which purposes they accept, rather than consenting to a bundle. The solution indicated is to separate the purposes and obtain consent for each. For a banner, this translates into separate categories, such as statistics and advertising, that can be accepted or refused independently.
The report adds that the controller's legitimate interest cannot be the basis for storing or reading cookies under Article 5(3). It also observes that relying on legitimate interest in the deeper layers of a banner can create confusion: visitors may think they have to refuse twice to prevent their data being processed.
Access to content cannot depend on accepting
Guidelines 05/2020 state that access to services and functionalities cannot be made conditional on the visitor's consent to the storing of information, or to access to information already stored, on their device, a practice known as a “cookie wall”. The example in the guidelines is a script that blocks the page content until the visitor clicks “Accept cookies”: there is no genuine choice, so consent is not freely given.
What “strictly necessary” means
Strictly necessary cookies can be set without consent, but the report observes that some controllers classify as such cookies and processing that are not strictly necessary within the meaning of Article 5(3) or in the ordinary sense of the term. The authorities discussed the responsibility of website owners to draw up and keep up to date a list of the cookies used, to provide it on request and to demonstrate the essential nature of the cookies listed.
Existing tools can list the cookies set but cannot establish their nature; they serve as a basis for requesting documentation about purposes. The report also recalls Article 29 Working Party Opinion 04/2012, under which cookies that remember preferences expressed by the user in relation to a service are considered essential.
Withdrawing consent
Article 7(3) GDPR requires that withdrawing consent be as easy as giving it and possible at any time. Guidelines 05/2020 state that the rule does not require the same action for both, but that where consent is given with a single click, withdrawal must be just as easy in practice. Where consent was obtained through a service's interface, such as a website, it must be possible to withdraw it through the same interface. The visitor must be informed of the right to withdraw before consenting.
The report indicates that website owners should offer easily accessible solutions, such as a small icon permanently visible on all pages or a link placed in a visible and standardised location. It also notes that no specific solution can be imposed, and that in each case it must be checked whether withdrawal is as easy as giving consent.
Review questions for your store's banner
On the basis of the documents above, a banner can be reviewed with the following questions. The list is a working tool, not a guarantee of compliance.
- Refusal: does the first layer offer a clear way to refuse, rather than just a discreet link?
- Boxes: do the categories in the preferences layer start unticked?
- Action: is consent expressed through a clear action, rather than by scrolling or simply browsing?
- Appearance: do colours and contrast allow all options to be read and understood?
- Purposes: can statistics and advertising be accepted separately?
- Access: does the store's content remain accessible without accepting?
- Essential cookies: can each cookie marked “strictly necessary” be justified?
- Withdrawal: can visitors change their choice at any time, as easily as they made it?
On Shopify
Consentia is a cookie consent app for Shopify stores. Further information is available on the Features page. A website can also be checked with our free cookie scanner.
Related articles
- Advertising pixels and consent: the store owner's responsibility
- Cookie fines in Romania: what Law No 506/2004 requires and what ANSPDCP has sanctioned
- Consent Mode v2 on Shopify: what data reaches Google and how to control it
- When a visitor rejects cookies: what Google Ads and GA4 still measure
Sources: EDPB, Guidelines 05/2020 on consent, version 1.1 · EDPB, Cookie Banner Taskforce report, 17 January 2023 · ANSPDCP, Law No 506/2004 (in Romanian). Photographs: Unsplash (Brooke Cagle; Vitaly Gariev).