Skip to content

Cookie banner

| Article: 4 min read | Privacy and law

A cookie banner is a window on a site where the visitor accepts or declines cookies and similar technologies that are not strictly necessary. For visitors from the EU this choice has to be offered before the site starts setting analytics and advertising cookies, and it has to be a real choice, not a nudge toward the "Accept all" button.

This is not legal advice: below is what the sources say, with links. EU rules may change, see the section on the Digital Omnibus.

When a banner is needed

  • If you work with visitors from the EU. Article 5(3) of Directive 2002/58/EC allows storing information on a user's device and accessing it only with their consent, after clear and complete information about the purposes. The exceptions are technical storage for transmitting a message and what is strictly necessary for a service the person explicitly asked for (Directive 2002/58/EC). The directive is implemented by each country's national law, so the details depend on the EU country you sell to.
  • If cookies are needed only for the site to work (cart, login), consent is not required, but it is worth describing them in the privacy policy.
  • If you are in Ukraine only: the current law has no separate requirement like the EU one, but general requirements on legal grounds and notice apply to the processing of personal data, see personal data in Ukraine. For a final answer you need a lawyer.

Under GDPR (Art. 4(11)), consent is a freely given, specific, informed and unambiguous indication of wishes, by a statement or a clear affirmative action (GDPR). A short summary from the EDPB (April 2026): consent is free only if the person can refuse without harm; specific, meaning per separate purpose; informed; unambiguous: silence, pre-ticked boxes or inactivity are not consent (EDPB, Consent under GDPR, 2026).

Withdrawing consent must be as easy as giving it (Art. 7(3) GDPR). The company must be able to demonstrate that consent was given (Art. 7(1)).

How to do it honestly

  1. Set nothing before consent. Analytics, the ad pixel and third-party widgets do not start until the person agrees. This is easy to check: open the site in a clean browser, click nothing, and see which cookies have already appeared.
  2. A "Reject" button on the first screen, equal to the "Accept" button. According to the EDPB Cookie Banner Taskforce report (2023), most supervisory authorities considered that the absence of a refuse button on any layer of the banner does not meet the requirements for valid consent (EDPB, 2023).
  3. No pre-ticked boxes on the second layer.
  4. Separate purposes. "Improving the experience" is too vague a wording; separate analytics, advertising and personalization (EDPB, 2026).
  5. Plain text: who collects, why, for how long, who it is shared with.
  6. The decision can be changed at any time. The Taskforce recommends a permanently visible icon or a link in a prominent place (but does not impose a specific form).
  7. Pass the decision on to analytics and advertising: Google Consent Mode passes the person's choice to Google tags, but does not collect consent itself.

Common violations

Per EDPB guidance and the Taskforce report:

  • Cookie wall: content is blocked until you click "Accept". In Guidelines 05/2020 the EDPB considers such consent not free (para. 40, EDPB, 2026).
  • Scrolling as consent. Scrolling the page is not a clear affirmative action (para. 86, same source).
  • Refusal as a small link in the text or outside the banner, with no visual emphasis (Taskforce, para. 14).
  • A refuse button whose text is barely visible. The Taskforce stresses there is no single standard for color or contrast and it is assessed case by case, but an unreadable button clearly misleads (paras. 17–18).
  • "Legitimate interest" on the second layer for advertising and profiling, so the person has to refuse twice. The Taskforce also noted that legitimate interest cannot be the basis for storing or reading cookies (paras. 22–24).
  • Analytics or advertising recorded as "necessary". The Taskforce records this practice as a violation (para. 26).

We do not name fines in this article: the amount depends on the country and the case. The GDPR maximums are described in the GDPR article.

What the Digital Omnibus does about this

In November 2025 the European Commission proposed moving the cookie rules into the GDPR, allowing refusal in one click and remembering the choice for at least six months, allowing consent settings in the browser, and dropping the consent requirement for a number of low-risk cases, such as counting visits (European Commission, Digital Package FAQ). The EDPB and EDPS in joint opinion 2/2026 (February 10, 2026) supported the aim but warned of legal uncertainty from splitting the rules between two acts (EDPB-EDPS, 2026).

As of the end of October 2026 this is only a proposal. According to a legal review, Coreper approved the Council's mandate on October 21, 2026 (the Council kept the cookie rules in Art. 5(3) of the ePrivacy Directive), and the European Parliament has not yet adopted its position (Legal247). In other words, the current rules apply unchanged.

FAQ

Is a cookie banner mandatory for an online store? For visitors from the EU, if you set cookies that are not strictly necessary, yes: their consent is required. Strictly necessary cookies need no consent.

Can I show a banner without a "Reject" button? Most supervisory authorities in the 2023 Taskforce considered that this does not meet the requirements for valid consent.

Can I block the site if the person did not agree? The EDPB considers a cookie wall to be one that does not give free consent.

How long should I keep the visitor's choice? The current sources name no single period. Six months is the period from the European Commission's proposal, which is not yet law.

Do I need a banner if I only use Google Analytics? Yes, if it uses cookies or a similar technology on the device of an EU visitor: analytics is not "strictly necessary".

Sources

Share

Related

  • Selling abroad from Ukraine: logistics, duties, payments

    | Article: 4 min read

    Cross-border e-commerce is selling goods to buyers in another country through your own site or a marketplace. For a Ukrainian store this means three separate tasks: getting the goods across the border, handling the duties and taxes of the buyer's country…

  • Personal data in Ukraine

    | Article: 4 min read

    Personal data in Ukrainian law is information or a set of information about an individual who is identified or can be specifically identified. Its processing is regulated by the Law of Ukraine "On Personal Data Protection" of June 1, 2010, No. 2297-VI. A new…

  • Returning goods to an online store

    | Article: 5 min read

    A product return is the process in which a shopper gives a purchased item back to the seller and receives money or an exchange. In Ukraine, the shopper's rights are defined by the Law "On Consumer Rights Protection," and the rules for returning an online…

  • PRRO and fiscalization for an online store

    | Article: 4 min read

    A PRRO (software cash register, "програмний реєстратор розрахункових операцій") is a program registered on the tax authority's fiscal server, through which the seller carries out a payment and creates a settlement document (a fiscal receipt) (Law No.…