What makes a cookie banner compliant?

Article 5(3) of the ePrivacy Directive (2002/58/EC) allows a website to store or read information on a visitor’s device only with consent, unless the cookie is strictly necessary for the service the visitor asked for. Session cookies, a shopping cart, load balancing and security cookies are typical necessary cookies. Analytics, advertising and most third-party cookies need consent.

The ePrivacy Directive borrows its idea of consent from the GDPR. Article 4(11) GDPR requires consent to be freely given, specific, informed and unambiguous, given by a clear affirmative action. Article 7(3) adds that withdrawing consent must be as easy as giving it.

Courts and authorities have turned those principles into concrete tests for banners:

• No pre-ticked boxes. The Court of Justice ruled in Planet49 (C-673/17, 2019) that a pre-ticked checkbox is not valid consent.
• No consent by scrolling or by carrying on browsing. The EDPB Guidelines 05/2020 on consent say these are not a clear affirmative action.
• A way to refuse on the first layer. Most authorities in the EDPB cookie banner taskforce consider a layer with an accept button but no way to refuse on it to be non-compliant.
• No deceptive design. Hiding the refusal option in a link, or making it far less visible than Accept all, steers the visitor and undermines consent.
• One purpose per choice. Visitors choose per category, such as statistics or marketing, and the banner explains each before they decide.
• Nothing optional fires first. Tags and trackers must wait for the choice, so a banner that loads analytics before the visitor clicks is not compliant, however good it looks.
• Withdrawal stays within reach. A persistent link or button lets the visitor reopen the settings and change the choice.

Switzerland has no ePrivacy Directive. Article 45c of the Telecommunications Act allows processing data on a visitor’s device when visitors are informed about the processing and its purpose and told that they can refuse it. The revised Federal Act on Data Protection (FADP), in force since 1 September 2023, adds its general principles, such as good faith and transparency in Article 6. In practice, a Swiss site that also has visitors from the EU usually applies the EU standard. See the Swiss FADP guide for the wider law.

Cookie Manager, part of Data Privacy in Acuna GRC, puts a banner on your websites with Accept all, Reject all and Customize. On each page the banner checks that Reject all is visible and as prominent as Accept all, and falls back to its built-in style for both buttons if your stylesheet hides or shrinks it. Optional scripts you tag by category run only once the visitor grants that category, and a settings link stays on every page so the visitor can change or withdraw the choice. Every choice becomes a consent record. See Cookie Manager.