Cookie Consent Best Practices for Modern Websites

/The Consent Gate

Under the ePrivacy Directive and GDPR, you must obtain explicit consent before storing or accessing non-essential cookies on a user's device. This means no third-party analytics, marketing pixels, or tracking scripts should load before the user has given clear, informed consent.

/Implementation Requirements

• Block all non-essential cookies until explicit consent is given
• Provide granular controls (analytical, marketing, necessary categories)
• Make rejection as easy as acceptance (no dark patterns)
• Display consent banner on first visit, not after a delay
• Store consent preferences and respect them on return visits
• Provide a persistent link to modify consent settings

/Google Analytics Compliance

Using Google Analytics requires special attention. Set default consent to "denied" using gtag consent mode, only activate analytics storage after user opt-in, and implement server-side anonymization of IP addresses.

// Correct: Set default consent BEFORE loading GA
gtag('consent', 'default', {
  'analytics_storage': 'denied',
  'ad_storage': 'denied',
  'ad_user_data': 'denied',
  'ad_personalization': 'denied'
});

// Only update after explicit user consent
function onConsentGranted() {
  gtag('consent', 'update', {
    'analytics_storage': 'granted'
  });
}

Our scanner checks your website for cookie consent compliance including pre-consent loading, banner visibility, opt-out mechanisms, and consent storage. Run a free scan to identify gaps.