The GDPR cookie banner checklist
Cookie banners are one of the most enforced parts of EU privacy law. This checklist condenses the GDPR, the ePrivacy Directive, the EDPB cookie banner taskforce report and common national guidance (CNIL, AP, BfDI) into 14 checks you can verify yourself. Tick them off as you go — your progress stays in this browser.
Updated 1 October 2026
Before consent
The banner
After consent
Proof & upkeep
Why cookie banners get fined
Most enforcement isn't about exotic edge cases. Authorities keep finding the same issues: trackers that fire before consent, banners without a reject option, and 'legitimate interest' used for advertising cookies. Each of those is easy to test from the outside, which is exactly why regulators — and privacy activists — check them first.
Does this apply to me?
If your site is aimed at people in the EU/EEA, the ePrivacy rules on storing information on devices apply regardless of where your company is based. The UK and Switzerland have very similar rules. California's CCPA/CPRA is opt-out based, but a banner that lets visitors refuse 'sale or sharing' covers the main requirement there.
Cookieless analytics like Plausible, Fathom or Simple Analytics generally don't need consent — but check your national authority's view.
How PrivacyPill covers the list
PrivacyPill's customizer shows live compliance hints for the checks you can configure (equal buttons, contrast, Consent Mode, reopen button, policy link). The runtime handles the rest automatically: denied defaults, prior blocking, remembered choices with expiry, re-consent on version bumps and a proof-of-consent log.
Frequently asked questions
Try it on your own site
Design your banner, preview it live, and paste one line. Free for one domain.