--- title: "Cookies and Consent | Pitch" description: "When a cookie banner is required, what valid consent looks like and how the ePrivacy rules and the GDPR work together." url: https://www.pitch.law/academy/cookie-compliance-and-consent-management --- [pitch](https://www.pitch.law/) [Academy](https://www.pitch.law/academy) [Privacy & Data Protection](https://www.pitch.law/academy/topics/privacy) # Cookies and Consent When a cookie banner is required, what valid consent looks like and how the ePrivacy rules and the GDPR work together. - By By Bart Lieben, Attorney-at-Law - Published 25 February 2026 ## The legal framework Two sets of rules apply to cookies. The ePrivacy Directive 2002/58/EC (Article 5(3)) governs storing information on, or gaining access to information stored on, a user's device. Each member state implements it in its own law, so details and enforcement differ per country. The GDPR governs the processing of personal data that follows. The rules apply to cookies, pixels, local storage, software development kits in apps and similar technologies. The ePrivacy rule is that prior consent is required, with one exception: cookies strictly necessary to provide a service the user has explicitly requested, or for the sole purpose of transmitting a communication. Examples are a session cookie for a shopping basket, a login cookie or a load-balancing cookie. Analytics, advertising, social-media plug-ins, A/B testing and personalisation generally need consent. The "strictly necessary" exception is read narrowly. ### What consent means The GDPR definition applies (Articles 4(11) and 7): freely given, specific, informed and unambiguous, given by a clear affirmative act. The Court of Justice held in _Planet49_ (Case C-673/17) that pre-ticked boxes do not produce valid consent. Consequences: - no non-essential cookie before the user has chosen; - no consent by scrolling, continued browsing or silence; - accepting and refusing must be equally easy, which in practice means both options at the first layer of the banner; - consent per purpose, with a way to give or refuse separately; - no access to the site made conditional on accepting tracking ("cookie wall") where that deprives the user of a free choice; - withdrawal as easy as giving consent, typically through a permanent link to the settings; - the user must be told who the third parties are and what each purpose is. National authorities publish guidance in this spirit, and the European Data Protection Board has issued guidelines on consent. Several of them have cookie checklists for website operators. These create no new obligations, but they show what an authority expects, including the reject option on the first layer. Check the current guidance of the country you target before you rely on it. ### Information and records Cookies that collect personal data also trigger the information duties in Articles 13 and 14. You should be able to show what the user agreed to and when, so keep consent records. Children's consent is a special case: under Article 8 GDPR the default age for consent to information society services is 16, and member states may set it lower, but not below 13. Check the age in each country you target. ## In practice A furniture retailer has a banner with a large "Accept all" button and a small grey link "Manage preferences". Analytics and advertising scripts fire as soon as the page loads, before any click. A scan shows 23 cookies, of which only six are strictly necessary. Under the rules above, the retailer has two problems: the non-essential cookies are placed without consent, and refusing takes several clicks while accepting takes one. The fix is technical as much as legal. Tags must be blocked until consent is given, the banner needs an equal "Reject all" button, categories must be accurate, and the retailer needs a settings link in the footer. The privacy notice should list the cookies and their retention. After the changes, the retailer checks again, since a new marketing tool added by the agency can undo the work in a week. [Website technology audits](https://www.pitch.law/academy/website-technology-audits-and-gdpr) describe how this verification works. ### Beyond the banner Analytics that uses a cross-site identifier, advertising networks and session replay tools involve joint controllership, transfers and sometimes a DPIA. Use the [record of processing](https://www.pitch.law/technologies/privacy-register) to list each tool, its purpose and its legal basis. ## Frequently asked questions ### Do we need a banner if we only use analytics? If the analytics tool stores or reads information on the device, yes, prior consent is required, unless the tool falls within the narrow exception. A server-side measurement that does not touch the device is assessed under the GDPR only. ### Is "legitimate interest" an alternative to consent for cookies? Not for the storing and reading of information on the device. That step needs consent under the ePrivacy rules unless the cookie is strictly necessary. ### How long does a cookie choice last? There is no fixed legal period. Choose a reasonable one, ask again when your cookies or purposes change, and keep the choice available for withdrawal at any time. ### Who is responsible if a third-party script sets cookies? The website operator is responsible for what its website does, and may be a joint controller with the third party for the data the script collects. ## How this connects Cookie compliance is a standing item in [DPO as a Service](https://www.pitch.law/solutions/dpo-as-a-service). The [register](https://www.pitch.law/technologies/privacy-register) records the tools involved, and a [DPIA](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) is needed when tracking is extensive. The [client portal](https://www.pitch.law/technologies/client-portal) is where your team and the DPO work through these items. ## In short - Prior consent for non-essential cookies - Accept and reject equally easy - ePrivacy Directive plus national rules ## Related solutions - [Solutions](https://www.pitch.law/solutions/dpo-as-a-service) ### [DPO as a Service](https://www.pitch.law/solutions/dpo-as-a-service) [An external Data Protection Officer who advises, monitors and documents your GDPR compliance, with a register, calendar and portal behind the advice.](https://www.pitch.law/solutions/dpo-as-a-service) ## Technology we use - [Technology](https://www.pitch.law/technologies/privacy-register) ### [Records of Processing and Compliance Registers](https://www.pitch.law/technologies/privacy-register) [One register engine for the GDPR record of processing activities and for the AI Act, NIS2 and DORA registers, with article references, evidence and attorney or DPO approval.](https://www.pitch.law/technologies/privacy-register) - [Technology](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) ### [DPIA](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) [Guided data protection impact assessments, kept as working records that you and your attorney complete together in the client portal.](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) - [Technology](https://www.pitch.law/technologies/client-portal) ### [Client Portal](https://www.pitch.law/technologies/client-portal) [A secure place where you follow your matters, instruct us on deadlines, work on registers with us and see your IP portfolio, in the same environment as our work.](https://www.pitch.law/technologies/client-portal) ## More in Privacy & Data Protection - ### [Data Breaches: the 72-Hour Rule](https://www.pitch.law/academy/data-breach-response-the-72-hour-countdown) [When a personal data breach must be notified to the data protection authority and to individuals, how the 72 hours are counted and what to document.](https://www.pitch.law/academy/data-breach-response-the-72-hour-countdown) - ### [How Long May You Keep Personal Data?](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data) [The storage limitation principle in Article 5(1)(e) GDPR, how to set retention periods and how to delete in practice.](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data) - ### [Data Subject Access Requests](https://www.pitch.law/academy/data-subject-access-requests-dsars-practical-guide) [How the right of access works under Article 15 GDPR, how to handle the deadline, what you may refuse and what a good response contains.](https://www.pitch.law/academy/data-subject-access-requests-dsars-practical-guide) - ### [Records of Processing Activities (RoPA)](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know) [What Article 30 GDPR requires you to record, who must keep a register, and how to keep it useful.](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know) - ### [International Data Transfers](https://www.pitch.law/academy/international-data-transfers-post-schrems-ii) [How Chapter V GDPR works after Schrems II: adequacy decisions, the EU-US Data Privacy Framework, standard contractual clauses and the assessment that goes with them.](https://www.pitch.law/academy/international-data-transfers-post-schrems-ii) - ### [Website Technology Audits and the GDPR](https://www.pitch.law/academy/website-technology-audits-and-gdpr) [What a website technology audit examines, why privacy notices and actual data flows drift apart, and which legal duties it checks.](https://www.pitch.law/academy/website-technology-audits-and-gdpr) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://www.pitch.law/schedule)