Cookies and GDPR: Practical Compliance Guide
How to properly implement a GDPR and ePrivacy compliant cookie banner? Which cookies require consent and how to collect it.
Cookies and similar tracking technologies are a permanent element of most websites. However, their use is subject to strict GDPR and ePrivacy Directive requirements. Improper cookie banner implementation is one of the most common violations - and cause of many fines.
What regulations govern cookies?
Cookies are regulated by both GDPR and ePrivacy Directive (2002/58/EC). GDPR concerns personal data processing collected through cookies. ePrivacy regulates storing/reading files on device itself. Both requirements must be met together.
Which cookies require consent?
Consent is required for: analytical cookies (Google Analytics, Hotjar), marketing cookies (remarketing, conversion tracking), social cookies (share buttons). Without consent, only these cookies can be used: necessary for website functioning (session, cart, login), preference cookies (language, theme settings). Classification of each cookie is key.
How to implement a proper cookie banner?
Proper banner: displays before loading cookies requiring consent, offers equivalent "Accept" and "Reject" options, enables granular category choices, doesnt use dark patterns (e.g., small reject button), links to full cookie policy, remembers user choice. Consent must be as easy to withdraw as to give.
What fines apply for improper cookies?
Supervisory authorities impose fines for cookie violations. Google and Amazon received €150 million combined in France. Fines in Poland are smaller, but DPA actively monitors websites. Typical violations: no banner, pre-loaded cookies, no reject option, cookie walls. Cookie audit should be regular.
Wizards.io solutions support cookie regulation compliance. **Revelio** identifies personal data collected through tracking technologies. Personal data audit should also cover cookies and data collected on websites.
Cookies are an area of intensive supervisory authority control. Proper banner and documentation are essential. Regular audits detect non-compliance before the supervisory authority does.