Website owners should be aware of and have a plan to align with the different cookie consent requirements outlined by privacy laws and expected by your consumers.
Specifically, laws like the GDPR and the CCPA obligate businesses to obtain adequate consent from users for data processing, present them with transparent details about what data you want to collect from them and why, and keep records of user consent.
Below, I talk more about the different cookie consent requirements for website owners, which laws apply, and what steps you need to take to meet today’s obligations.
Key Takeaways
- Many different cookie consent requirement impact website owners,
- Laws like the GDPR and others set rules for collecting and managing consent,
- You must obtain adequate cookie consent for non-essential cookies.
- A compliant setup also includes having a cookie banner, preference center, consent logs, and opt-out support.
What Are The Most Common Cookie Consent Requirements for Website Owners?
Below are some of the most common cookie consent requirements that impact website owners.
Websites Should Present Users With a Cookie Banner
One of the most important requirements impacting website owners is showing a cookie banner to users soon as soon as they land on your site.
This helps you obtain adequate, legal consent from website visitors for data collection, which includes the use of internet cookies or other trackers.
Your cookie consent banner should:
- Explain that your site uses cookies,
- Link to a policy that outlines their purpose, and
- Allow users to accept or reject them.
Consent banner configuration settings vary depending on what law applies, so use a solution like Termly, which offers regional consent settings.
For example, under laws like the GDPR, you need to obtain user consent before any non-essential cookies are set.
Websites Should Give Users Access to a Cookie Preference Center
In addition to your cookie consent banner, you should offer users access to a cookie preference center.
This is a dedicated interface where they can review and change their cookie choices anytime.
A cookie preference center helps ensure that you:
- Maintain ongoing user control over tracking technologie
- Support legal requirements for consent withdrawal
- Improve transparency and user trust as a result
Your preference center should be easy to find, like linked to your site’s footer or settings menu.
Websites Should Maintain Consent Logs and Track User Consent
It’s not enough to collect consent; you also must prove you obtained it in a legally sound way.
That’s where consent logs come in.
Consent logs show when and how a user gave (or withdrew) consent and what they agreed to at the time, including:
- The exact timestamp of consent
- Cookie categories explicitly accepted or declined
- User location or IP (where legally permitted)
- The consent mechanism used (e.g. banner, preference center etc.)
- The version of the banner or preference tool shown
- Evidence of the consent withdrawal, if applicable
Storing this information helps demonstrate compliance if a supervisory authority audits your website or your company.
Use tools like our Consent Management Platform to help automate this process for you.
Websites Must Consider Cookie Use and Universal Opt-Out Mechanisms
Some privacy laws, particularly in the U.S., now require businesses to honor universal opt-out mechanisms.
UOOMs are browser-based signals users can send from their browser to opt out of tracking automatically across multiple sites when they arrive on it.
One example is the Global Privacy Control (GPC), which works with supported browsers to communicate a user’s privacy preference.
Incorporating support for universal opt-outs shows your users that you take privacy seriously and aligns your website with requirements outlined by laws like the CCPA.
By honoring browser-based signals like GPC, you’re giving users a seamless, proactive way to exercise their rights without forcing them to dig through settings or banners each time they arrive on a new website.
What is Cookie Consent?
Cookie consent is the permission websites ask from visitors before placing non-essential cookies on their devices.
These cookies might track user behavior and preferences, collect data for analytics, or deliver targeted ads.
While cookies can help improve the user experience and marketing efforts, they also raise privacy concerns; this is where consent becomes vital.
Cookie consent ensures that users have control over whether and how their data is collected through cookies and typically includes the following:
- A pop-up cookie consent banner,
- A link to an accurate and transparent cookie policy,
- Buttons for the user to click to accept or deny cookies or part of it,
- A link to a preference center where users can change their minds at any time.
As a website owner, you’re responsible for informing all visitors of your website about what cookies you use and why you use them.
But you must also explain how they can manage their cookie consent and withdraw or opt out of them, irrespective whether they are registered users or anonymous website visitors.
What Laws Require Consent for Website Cookies?
It’s vital for you to understand which laws apply to your website and your users so you can collect data responsibly and avoid potential penalties.
Below I summarize some major regulations affecting cookie consent.
General Data Protection Regulation (GDPR)
The GDPR is a sweeping privacy law that applies across the European Union (EU) and European Economic Area (EEA) and to any businesses around the world that target and collect data from EU/EEA users, even if you’re registered elsewhere.
Here’s what GDPR cookie consent compliance looks like on a website:
- You have a cookie banner that appears before setting non-essential cookies.
- You obtain active, opt-in consent with no pre-checked boxes.
- You use granular controls so users can choose cookie categories.
- You provide a link to a cookie policy explaining each cookie’s purpose and duration.
- You provide an easy way for users to withdraw consent, like a preference center or footer link.
If your website reaches individuals located in the EU, you’ll need to follow these GDPR standards to ensure your cookie consent practices are legally sound.
ePrivacy Directive (EU Cookie Law)
The ePrivacy Directive, often called the “EU Cookie Law,” is a regulation that specifically targets electronic communications and the use of technologies like cookies.
While it works in tandem with the GDPR, as lex specialis, it focuses more narrowly on how information can be stored and accessed on users’ devices.
Like GDPR, it requires active user consent for non-essential cookies and emphasizes transparency, user choice, and the ability to withdraw consent.
Here’s what ePrivacy Directive consent compliance looks like for website owners:
- A cookie banner on first visit that explains cookie use and requests consent.
- No non-essential cookies set without prior, explicit consent.
- Clear, affirmative action required, no implied consent or pre-checked boxes.
- A link to a detailed cookie policy outlining cookie types, purposes, and third parties with whom you may share this data.
- An accessible method to change or withdraw consent, like a preference center.
If you use cookies to track EU users, this directive, with the GDPR, helps shape what you can do and how you must inform your users.
UK GDPR & Privacy and Electronic Communications Regulations (PECR)
After Brexit, the UK retained its own version of the GDPR and continues to enforce cookie rules through PECR.
These laws mirror the EU’s approach and apply to websites collecting data from UK users.
Here’s what PECR consent compliance looks like for websites:
- A cookie banner shown on first visit explaining cookie use
- Asking explicitly for consent.
- No non-essential cookies set until the user provides active consent.
- No pre-checked boxes or implied consent (users must take clear action).
- A link to a cookie policy explaining what cookies are used and why.
- An easy way to withdraw or change consent (e.g., through a preference center).
If your audience includes UK users, you’ll need to meet both PECR and UK GDPR expectations.
California Consumer Privacy Act (CCPA)
The CCPA and its expansion, the CPRA, give California residents greater control over how their personal data is collected and shared, especially for advertising purposes.
Unlike the GDPR, the CCPA does not require prior explicit consent before setting any cookies.
However, the CCPA does require transparency through a clear notice at or before data collection and gives users the right to opt out of the sale or sharing their personal information with any third parties.
Here’s what CCPA/CPRA consent compliance looks like for website:
- Notice at or before collection that informs users about the categories of personal information collected.
- A “Do Not Sell or Share My Personal Information” link if applicable.
- Support for opt-out signals, such as the Global Privacy Control (GPC).
- A clear privacy policy outlining data uses, rights, and how to exercise them.
- No need for prior consent, but users must be able to opt out easily.
If your website targets or collects data from California residents, you’ll need to build cookie practices that support transparency and respect user opt-out rights.
Other state-level privacy laws, like the Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), and Connecticut Data Privacy Act (CTDPA), include similar requirements around transparency and opt-out rights.
Personal Information Protection and Electronic Documents Act (PIPEDA)
PIPEDA, one of Canada’s fundamental privacy laws, requires organizations to obtain meaningful consent before collecting personal data, including through cookies.
Organizations must clearly explain cookie usage, provide easily accessible opt-out methods, and maintain transparent cookie or privacy policies.
Here’s what PIPEDA consent compliance looks like for website:
- A clear explanation of what data cookies collect and why.
- Consent mechanisms tailored to the sensitivity of the data, implied consent may be acceptable for low-risk cookies.
- An easy-to-use opt-out option for users who don’t want to be tracked.
- A link to a privacy or cookie policy describing tracking practices and user rights.
If you have Canadian users, make sure your cookie consent practices are transparent and easy to manage.
What Cookies Require Consent from Website Visitors?
As a general rule, you must obtain informed consent from your users before placing any cookies on their browsers that are not strictly necessary for your website to function.
Essential Cookies (No Consent Required)
Essential cookies, also known as strictly necessary cookies, help your website function properly and help with basic features, like:
- Keeping users logged in
- Enabling secure authentication
- Remembering items in a shopping cart
- Navigating between pages or sessions.
Because these cookies don’t typically involve the collection or processing of personal data, you don’t typically need to request consent to use them.
However, you must still disclose your use of them in your cookie policy.
Non-Essential Cookies (Consent Required)
Non-essential cookies aren’t required for your site to operate but are often used to improve performance or support business goals.
These cookies typically process personal information and include:
- Analytics cookies that track user behavior to help improve site or services functionality.
- Advertising cookies that power personalized ads based on browsing activity.
- Some functional cookies that store preferences and enhance usability but are not required for core operations.
- Social media cookies that enable sharing features or third-party embedded content.
Before placing these types of cookies, you’ll need to inform users and get their consent before placing them, especially if your site is subject to laws like the GDPR.
What are the Penalties for Not Complying with Cookie Consent Requirements?
Failing to comply with cookie consent regulations can result in financial penalties and reputational damage.
Under the GDPR, organizations can face fines of up to €20 million or 4% of their annual global turnover, whichever is higher, for serious violations.
For example, in 2023 the French Data Protection Authority fined TikTok €5 million for violating GDPR standards.
The platform made it difficult for its users to refuse cookies, requiring them to make several targeted clicks to refuse all cookies, ultimately leading to them accepting all.
Under CCPA and CPRA, fines for unintentional violations can be up to $2,500 per incident, and up to $7,500 for each severe or intentional incident.
In March 2025, the California Privacy Protection Agency (CPPA) fined American Honda Motor Co. $632,500 for multiple violations of the CCPA, including:
- Collecting excessive personal information.
- Designing consent banners that made opting out more difficult than opting in.
- Sharing personal data without proper contracts.
Other jurisdictions have similar enforcement powers.
- In the UK, the Information Commissioner’s Office (ICO) can issue fines up to £17.5 million or 4% of global turnover under the UK GDPR and up to £500,000 for PECR violations.
- In Canada, organizations may face penalties of up to CAD 100,000 per violation under PIPEDA.
These enforcement actions underscore a growing global focus on user privacy.
But beyond the financial consequences, failing to meet cookie consent standards can erode trust and harm your reputation.
Transparent, user-friendly practices are more than a legal requirement, they’re a key part of building a privacy-conscious.
Want to simplify cookie compliance? Termly’s Consent Management Platform makes it easier to meet legal requirements and build user trust.
Hanna De La Garza is a privacy writer at Termly with a Bachelor’s Degree in Journalism from the University of Florida. She creates engaging resources on data privacy, consent management, regulatory updates, and more.
Read all posts by Hanna De La Garza
Reviewed by Teodor Stanciu, CIPP/E, CIPM
Teodor Stanciu is a Legal Coordinator & DPO with a Bachelor’s Degree in Law from the University of Bucharest and a Master of Laws in EU and International Business Law from Radboud University.
Read all posts reviewed by Teodor Stanciu, CIPP/E, CIPM
FREE Cookie Consent Solution for Websites
