What to account for
Consent before non-exempt storage
The EDPB taskforce says cookies requiring consent must wait for an affirmative choice. Preselected opt-in boxes do not create valid consent.
Withdrawal and an understandable explanation
GDPR Article 7 requires withdrawal to be as easy as giving consent. Article 13 covers information including purposes, recipients, retention and rights.
Classify purpose, not just the name
CNIL describes conditional exemptions for audience measurement. “Analytics” is not a universal exemption: check configuration and the rules of the relevant jurisdiction.
Common mistakes to check
Accept is obvious; reject is hidden
The EDPB report records broad regulatory opposition to consent layers without a rejection option. It also documents differences between authorities; avoid claiming a single universal button design.
Treating scrolling as consent
CNIL rejects scrolling or swiping as consent and requires operators to demonstrate consent. A disappearing banner is not evidence of an affirmative decision.
Your review checklist
Our suggested review process. The linked requirements above explain the platform or legal basis.
Record what loads
Scan the site and review cookies separately from scripts and requests. Confirm vendor purposes; leave unknown uses unresolved rather than guessing.
Connect choices to loading
Configure categories and the consent snippet. Wire each non-essential integration to the choice; merely installing the snippet does not retroactively stop scripts already running.
Test four states
Inspect network and storage before any choice, after rejection, after selective acceptance and after withdrawal. Repeat for important regions and logged-in areas outside the public scan.
Example
Fictional site: Harbor Journal
Assume a preference cookie and an advertising pixel. The owner confirms their purposes. The proposed setup starts with advertising off and offers accept, reject and purpose settings.
The test that matters
In a fresh browser, the reviewer sees the ad request only after acceptance. After withdrawal, a reload must respect the new choice. Record failures as implementation work, not as a policy wording fix.
Questions before publishing
Is every cookie subject to consent?
No. Exemptions exist, including narrowly conditioned audience measurement in CNIL guidance. Establish the actual purpose and applicable rules before marking a cookie exempt.
Can visitors change their mind?
Yes. GDPR consent can be withdrawn at any time. Explain this before consent and provide a withdrawal method as easy as the original choice.
What should I test before publishing?
Review vendor purposes, regional behavior and private flows. Check that the installed controls honor each choice and that the policy matches those results.
Source review and changes
First edition: platform requirements, implementation checks and fictional worked example. Sources reviewed on the date above; verify changes before relying on them.