Written by Stephen Leahy · Last updated 30 September 2026
Quick answer: a GDPR compliant cookie banner asks for consent before any non-essential cookies are set, explains what each category does, makes rejecting as easy as accepting, and lets visitors change their mind later. You can test the basics in about five minutes using nothing but your browser.
A cookie banner that looks right is not the same as one that works right. Plenty of sites show a banner while analytics and advertising cookies quietly load in the background. That creates legal risk, and it also distorts your data, as we covered in how much of your website traffic your analytics actually sees. This checklist shows you how to find out where your own site stands.
This is general information, not legal advice. If you’re unsure, ask a qualified adviser.
Disclosure: this post contains an affiliate link to Cookiebot (Usercentrics). If you buy through it, I may earn a commission at no extra cost to you. See my affiliate disclosure.
What makes a GDPR compliant cookie banner?
Under GDPR and the ePrivacy rules, consent for non-essential cookies has to be freely given, specific, informed, and unambiguous. In practice, regulators expect a banner to do the following:
- Wait for consent. Analytics, advertising, and other non-essential cookies must not be set until the visitor agrees.
- Explain clearly. Visitors should be told what each category of cookie is for, in plain language.
- Offer a real choice. “Reject all” should be as prominent and as easy to use as “Accept all”.
- Avoid pre-ticked boxes. Consent needs a clear, affirmative action. Silence or scrolling is not consent.
- Allow withdrawal. Visitors should be able to change their choice as easily as they made it.
- Keep a record. You should be able to show when and how consent was given.
Ireland’s Data Protection Commission takes a similar line in its cookie guidance: analytics cookies require consent, and wording such as “by continuing to use this site you agree” is not enough.
The 5-minute cookie banner test
You don’t need special software. Open your site in a private browser window and open your browser’s developer tools (usually F12), then look for the Application or Storage tab and its list of cookies.
| Check | How to test it | What a pass looks like |
|---|---|---|
| 1. Nothing fires early | Load the page and look at cookies before touching the banner. | Only strictly necessary cookies appear. |
| 2. Reject works | Click “reject all”, reload, and check cookies again. | No analytics or advertising cookies appear. |
| 3. Accept is proportionate | Look at the banner layout. | Reject is as visible and as easy as accept. |
| 4. Choices are granular | Open the settings panel. | Categories are listed, with nothing pre-ticked. |
| 5. Choice can be changed | Look for a settings link in the footer. | You can reopen the banner and withdraw consent. |
If all five pass, you’re in good shape on the basics. If any fail, fix them before worrying about anything else.
The most common cookie banner failures
- Tracking before consent. Tags are set to fire on page load rather than waiting for the banner’s signal.
- A hidden or awkward reject option. “Accept” is a bright button while “reject” is buried in a settings menu.
- Pre-ticked categories. Marketing or analytics toggles that start switched on.
- Consent ignored. A visitor rejects, but cookies are still set because the banner isn’t connected to your tags.
- No way back. There’s no link to reopen the banner and change a decision.
- Out-of-date cookie list. New plugins or scripts add cookies that the banner doesn’t mention.
How do you fix a non-compliant cookie banner?
For most WordPress sites, the simplest route is a consent management plugin that can block scripts until consent is given, such as Complianz or Cookiebot. Whichever tool you choose, three steps matter more than the brand:
- Scan your site to list the cookies and scripts that are actually running.
- Connect consent to your tags so analytics and advertising only load after the visitor agrees.
- Retest with the five checks above, including after any site update or new plugin.
Why compliance also improves your data
Consent platforms such as OneTrust can show how many times your server is hit compared with how many visitors accepted or changed their cookie choices. That lets you tell leadership something honest, for example: ‘we can see about half of our visitors because they opt in, and we have no visibility of the rest.’
A compliant setup feels like it should reduce your data, and it does cut the number of visitors you can measure. But it also makes the data you do collect trustworthy, and it lets you report honestly on how much of your audience you can see. That honesty is worth more than an inflated number you can’t defend.
Cookie banner FAQ
Does my website need a cookie banner?
Generally yes, if you set non-essential cookies such as analytics or advertising cookies and your audience is in the EU or UK. Cookies that are strictly necessary for the site to work are treated differently. Check your obligations with a qualified adviser.
Can I just say ‘by using this site you accept cookies’?
No. Regulators, including Ireland’s Data Protection Commission, say implied consent of this kind isn’t enough. Consent needs a clear, affirmative action.
How often should I test my cookie banner?
Test it after every site update, new plugin, or new marketing tag, and review it at least a few times a year. Changes often add cookies the banner doesn’t cover.
Is a consent plugin enough on its own?
Not by itself. The plugin has to be configured so your analytics and advertising tags actually wait for consent. Always run the five-minute test afterwards to confirm.
About the author: Stephen Leahy is a multi-award-winning digital marketing specialist with more than a decade of experience in SEO, GEO, and web analytics. Read his full profile.
