Cookie consent

Strictly necessary storage is exempt: a session identifier for a logged-in user, the contents of a shopping basket, a load-balancing token, a record of the consent choice itself.

Analytics is not exempt under the rules as written, whatever the common practice. Some regulators accept narrowly configured first-party analytics; the position differs by country.

Advertising, cross-site tracking and personalisation are unambiguously not exempt.

The test is whether the storage is necessary for the service the visitor asked for, not whether it is useful to the site.

Given before the storage happens. Consent obtained after a tracker has already loaded is not consent to that load.

Specific, with separate choices per purpose rather than a single all-or-nothing switch.

Freely given, which regulators have consistently read as requiring refusal to be as easy as acceptance — one click, at the same level of prominence.

Withdrawable, through a mechanism that remains reachable after the banner is gone.

Recorded, so that the site can show what was agreed and when.

Scripts placed in the page load as the page loads. A banner rendered alongside them changes nothing about what has already run.

Tag managers configured to fire on page load rather than on a consent event have the same effect, and the configuration is outside the codebase where nobody reviews it.

Third-party embeds — a video player, a map, a social widget — set their own cookies the moment they are inserted, regardless of the banner.

The correct pattern is that non-essential scripts are not in the page at all until consent is recorded, and are injected afterwards.

This is directly observable: load the page, answer nothing, and list what has been stored.

Open the page in a clean profile, dismiss nothing, and inspect the cookies and storage. Anything beyond strictly necessary entries is the finding.

Check the network panel for requests to tracking and advertising origins before any interaction.

Check that a refusal is available at the first level of the banner, and that refusing actually prevents the storage rather than only recording a preference.

Check that the choice persists and that a withdrawal mechanism is reachable from the page.