France’s CNIL fined Google €325 million on September 1, 2025. Accepting cookies took one click; refusing took several. Google, with one of the world’s largest legal teams, still shipped a banner ruled illegal.
That gap is the real subject of this guide. GDPR cookie consent isn’t about installing a banner. It’s a narrow set of technical rules, and our website development team sees the same handful of gaps break otherwise well-built sites.
Below is the checklist GVM actually runs during a build or audit, not a summary borrowed from a compliance vendor’s sales page.
Quick Answer: A website needs valid GDPR cookie consent whenever it sets a cookie, pixel, or script that isn’t strictly required for the service a visitor requested, and that visitor could be in the EU or UK.
Valid consent must be freely given, specific per purpose, informed, and confirmed through a clear affirmative action. No pre-checked boxes, no “by browsing you agree” language.
Reject has to be exactly as easy as accept. Nothing non-essential can load before the visitor chooses.
Key Takeaways
- The ePrivacy Directive, not GDPR, is the law that mandates cookie banners. GDPR only defines what counts as valid consent.
- Google’s 2025 consent screen got fined €325 million for the single most common flaw in small business banners: accept easier to click than reject.
- A dynamic IP address counts as personal data under the CJEU’s Breyer v Germany ruling, even if your site sets zero cookies.
- Loading Google Fonts, YouTube, or Google Maps from Google’s servers leaks a visitor’s IP before anyone clicks, the exact issue a German court penalized in 2022.
- Meta’s €390 million DPC fine in 2023 wasn’t about cookies. Regulators reject any forced-consent mechanism, not just banners.
- The EU’s proposed Digital Omnibus would fold cookie rules into GDPR, but its timeline has already slipped past mid-2026. Nothing here is safe to build around yet.
GDPR vs. the ePrivacy Directive
Site owners ask why “GDPR” forces cookie banners. It doesn’t, not directly. Two laws share the job.
What the ePrivacy Directive Covers
Article 5(3) of the ePrivacy Directive, the actual “cookie law,” requires consent before accessing anything stored on a visitor’s device:
- LocalStorage and sessionStorage
- Device fingerprinting scripts
- SDK identifiers in mobile apps
Each EU country implemented it into national law. The UK’s version is PECR. The rule cares only whether you touched the device, not whether the data is personal.
What GDPR Adds
Article 4(11) and Article 7 define what valid consent looks like: freely given, specific, informed, unambiguous.
GDPR also governs what happens after the cookie is set. A cookie-free, server-side setup can dodge ePrivacy entirely and still trigger GDPR the moment it logs an IP, per Breyer v Germany (2016).
In short: ePrivacy makes you ask. GDPR decides whether your asking counted.
Does Your Website Need a Cookie Banner?
Run these four checks in order.
1. Visitor Location, Not Business Address
The test is where the visitor sits, not where your company is registered. Run EU-targeted ads, or take organic EU traffic without geo-blocking, and the exemption disappears.
2. Non-Essential Scripts Trigger It
Session cookies, carts, and CSRF tokens are exempt. Analytics, ad pixels, A/B testing, and chat widgets usually aren’t.
3. Third-Party Embeds Count Too
Google Fonts, a YouTube video, a Maps iframe, a “Sign in with Google” button: each can send a visitor’s IP to a third party on render, before any click.
4. Forms and Logs Fall Under GDPR Regardless
A contact form or server log can identify a person even when no banner is needed. A cookie-free brochure site still needs a privacy notice for form data.
The Five-Minute Network Trace
Most “compliant” banners were never actually tested.
How to Run It
Open your site in a fresh browser, no ad blocker, nothing logged in. Open DevTools, click Network, reload before touching anything.
What Failing Looks Like
Watch for these firing before you click the banner:
google-analytics.comgoogletagmanager.comfacebook.com/trfonts.googleapis.com
If any fire pre-click, the banner is decoration. It’s the same test a proper QA process should already run, and the exact gap behind CNIL’s 2025 fines.
Strictly Necessary vs. Non-Essential Cookies
This line decides whether a cookie needs consent at all.
| Category | Consent needed? | Examples |
|---|---|---|
| Session / login | No | Cart contents, CSRF token |
| Load balancing / security | No | Routing cookie, rate-limit token |
| Visitor’s own preference | No | The banner’s stored choice |
| Analytics | Yes | Google Analytics, Hotjar, Clarity |
| Advertising | Yes | Meta Pixel, Google Ads tags |
| Third-party embeds | Yes, before load | YouTube, Maps, Google Fonts CDN |
The exemption comes from WP29/EDPB Opinion 04/2012. A cookie must be necessary for a service the visitor requested. “It helps us understand users” is a legitimate-interest argument, not an ePrivacy exemption.
What Valid Consent Actually Requires
A banner existing and a legally valid consent record are two different things.
What Planet49 Settled
The CJEU’s 2019 Planet49 ruling killed:
- Pre-checked boxes
- “By continuing to browse, you accept”
- Silence counting as consent
The visitor has to actively click, tick, or toggle something on.
What Regulators Check on the Banner
| Element | Expected | Common failure |
|---|---|---|
| Accept / Reject | Equal prominence | Bright accept, buried reject |
| Purposes | Listed separately | One blanket toggle |
| Withdrawal | As easy as consent | Buried in settings, or missing |
Article 7(3) makes withdrawal a real requirement. If accepting takes one click and revoking takes an email to support, that’s non-compliant on its own.
Pay-or-consent walls sit in risky territory. The EDPB’s 2024 opinion found this model generally fails “freely given” for large, dominant platforms.
Where Your Site Quietly Leaks Consent Triggers
Most compliance guides skip this. It’s an architecture problem, not a banner-configuration one.
| Source | Why it triggers consent | Fix |
|---|---|---|
| Google Fonts CDN | Sends visitor IP on render; a German court penalized this in 2022 (LG München I) | Self-host font files, including on WordPress builds |
| Video and Maps embeds | Loads tracking cookies before playback starts | Click-to-load placeholder |
| Chat widgets and social login | Sets identifying cookies on page load | Gate behind consent |
| Google Analytics, IP anonymized | France, Italy, and Austria still ruled default GA4 non-compliant in 2022, over data transfer | EU-based processing, server-side tagging |
| Consent Mode v2 signals | ad_storage, analytics_storage, ad_user_data, ad_personalization gate Ads and GA4 in the EU/UK since March 2024 |
Configure all four correctly |
Your host logs visitor IPs too, usually by default. Ask your provider how long those logs live. A DevOps and hosting review answers that, not the banner’s settings panel.
Common Mistakes That Make a “Compliant” Banner Illegal
| Mistake | Why it’s a violation |
|---|---|
| Reject buried two clicks deep | Same flaw CNIL fined Google for in 2025 |
| Scripts fire before any choice | The banner displays over an already-loaded pixel |
| “Necessary” defined too broadly | Every cookie gets pre-checked exempt |
| No consent log exists | Article 5(2) requires proof, not trust |
| Embeds ignore banner state | Only first-party scripts got audited |
| DPA never signed with a vendor | Article 28 requirement, skipped as often as the banner |
Most of these trace back to a site built fast and never re-tested, the same failure mode behind AI-generated sites shipped without a review layer.
How GDPR Cookie Violations Actually Get Punished
| Case | Fine or exposure | What triggered it |
|---|---|---|
| Google, France (2025) | €325 million | Asymmetric accept/reject design |
| Shein, France (2025) | €150 million | Cookie and consent dark patterns |
| Meta, Ireland (2023) | €390 million | Forced consent via a “contract” workaround |
| Germany, ongoing | Private civil claims, not a DPA fine | Individuals suing over Google Fonts IP leaks |
GDPR’s ceiling sits at €20 million or 4% of global turnover. Most small businesses land far below that, but Germany proves a fine isn’t the only exposure: a single missed font link can trigger a lawsuit with no regulator involved at all.
Free vs. Paid Cookie Consent Tools
| Tier | Examples | Breaks down when |
|---|---|---|
| Free / open-source | Complianz, Klaro! | No automatic script-blocking; one missed embed exposes you |
| Cookieless analytics | Plausible, Fathom | Doesn’t solve embeds, ads, or chat widgets |
| Mid-tier SaaS | CookieYes, Cookiebot | Pricing scales with pageviews |
| Enterprise CMP | Usercentrics, OneTrust | Overkill for a single-market small business site |
A free tier works fine until nobody checks, quarterly, whether a new widget got wired into the blocking rules. That drift causes most real violations, not the tool tier.
A Compliant Banner Also Converts Better
A banner that loads everything first and asks second produces garbage analytics. Visitors reflexively click either button without reading it.
Minimizing what actually needs consent keeps conversion data usable, instead of polluted by a banner nobody trusted enough to answer honestly.
What GVM Checks During a Build or Audit
This is the pass our QA team runs, the same fresh-browser method behind our pre-launch security checklist:
- Fresh-browser network trace, before and after consent
- Google Fonts and CDN assets audited and self-hosted
- Every embed converted to click-to-load
- Consent Mode v2 verified for Ads and GA4
- DPAs confirmed signed, not assumed
- Consent logging tested across a page reload
The fix that matters is rarely the flashy one. It’s the boring detail nobody checked.
The 2026 Shift: The EU’s Digital Omnibus
The European Commission’s November 2025 memo called cookie-banner fatigue a problem “whose regulatory solution is long overdue.”
What Articles 88a and 88b Would Do
The proposed Digital Omnibus would fold cookie consent into GDPR itself:
- Article 88a restructures device-access consent
- Article 88b would make browser-level “reject” signals legally binding
Why the Timeline Keeps Slipping
As of mid-2026, single-click rejection was pulled from the Council’s working text over member-state disagreement. Final adoption isn’t expected before late 2026.
Privacy advocates, including noyb and the EDPB itself, warn other parts of the package could narrow GDPR’s definition of personal data. Keep meeting today’s standard until a final text exists.
A Founder’s GDPR Cookie Consent Checklist
Score one point per “yes”:
- Have you run a fresh-browser network trace?
- Is “Reject All” as visually prominent as “Accept All”?
- Are Google Fonts self-hosted, not linked from Google’s CDN?
- Do embeds load only after consent?
- Is consent stored in a verifiable log?
- Can a visitor withdraw consent as easily as they gave it?
- Have you signed a DPA with every vendor touching visitor data?
- Is Consent Mode v2 correctly configured?
- Does your privacy policy name every processor specifically?
- Has anyone tested this in the last 90 days?
7-10: Solid. Re-run this quarterly. 4-6: Fixable in a day; prioritize items 1, 2, and 4. 0-3: Treat it like a failed pre-launch security check and pause new ad spend until it’s closed.
FAQs
1. Do I need a cookie banner if I don’t use Google Analytics?
Possibly not, but check embeds. YouTube, Maps, and Google Fonts can each trigger consent with zero analytics running.
2. Is my business exempt from GDPR if it’s not EU-based?
No. GDPR’s territorial scope depends on your visitors and marketing, not your company’s registration.
3. Is an IP address actually personal data?
Yes. The CJEU’s Breyer v Germany ruling (2016) confirms a dynamic IP counts whenever it can realistically be linked to a person.
4. Does anonymizing IPs in Google Analytics remove the consent requirement?
Usually not. France, Italy, and Austria found default GA setups non-compliant in 2022 over data transfer, not anonymization.
5. What’s the difference between a privacy policy and a cookie policy?
A privacy policy covers all personal data processing. A cookie policy lists specifically which cookies and trackers a visitor receives.
6. Can I require payment instead of a real reject option?
Legally risky. The EDPB’s 2024 opinion found pay-or-consent generally fails “freely given” for large platforms.
7. What actually happens if I ignore this?
Fines can reach €20 million or 4% of turnover, though most small businesses land far below that. The quieter cost is lost ad-platform accuracy and reputational risk.
8. How often should I re-check my consent setup?
Quarterly, and immediately after adding any new script, widget, or embed.
9. Does a cookie consent plugin alone make my site compliant?
No. It handles the banner mechanics, not your privacy policy, DPAs, or a font link buried in a theme file.
Conclusion
Run the five-minute network trace on your own site before anything else here. If Google Analytics or a font file is already loading before a click, that’s the same gap that turned one company’s banner into a €325 million enforcement case.
Most fixes, self-hosting a font, adding a click-to-load wrapper, correcting a button’s weight, take hours, not months.
Get a Cookie Consent and Privacy Audit Built Into Your Site
A banner is easy to install. One that blocks the right scripts, logs consent correctly, and survives real regulator scrutiny takes the load-order-level review most agencies skip.
GVM Technologies has built and audited production websites since 2012, from Miami and Surat, under ISO 27001:2022, 20000-1:2018, and 9001:2015 certified processes.
Our SEO and website development teams run this exact pass on every client build.
Talk to GVM About a Cookie Consent and Privacy Audit and find out exactly what’s loading on your site before a visitor, or a regulator, does.
Call us : +1 (786) 947-6105
