How to Check If Your Cookie Consent Banner Is GDPR Compliant (2026)

Updated for 2026 consent reviews

Quick checks before you change anything

1Open the page in a fresh browser profile or incognito window.
2Before clicking anything, inspect whether analytics, ad, heatmap, or retargeting scripts have already loaded.
3Confirm the first banner layer has a clear reject option, not only accept and manage choices.
4Check that optional purposes are off by default and can be accepted separately.
5Reject cookies, reload the page, and verify optional trackers stay blocked.
6Accept cookies, then find a persistent way to withdraw or change consent.

1. Start with the legal trigger: non-essential storage or access

The practical question is not whether a banner exists. The question is whether the site stores or accesses non-essential information on the visitor’s device before the visitor has made a valid choice. Strictly necessary cookies can usually run without consent. Analytics, advertising, social plugins, heatmaps, A/B testing, and many personalization tags usually need consent before firing when they are not essential to the service requested by the user.

Test on a fresh session so old consent choices do not hide the problem.
Look for network requests to analytics, ads, pixels, tag managers, session replay, and experimentation tools before consent.
Treat server-set identifiers, SDK calls, local storage, and pixels as part of the same review, not just browser cookies.

2. Compare the accept and reject paths

A banner that makes acceptance one click but rejection a maze is a compliance risk. The safest pattern is symmetrical: clear Accept all, Reject all, and Customize choices from the first layer, with similar visual prominence and no guilt copy. If rejection requires scrolling, hidden links, tiny text, or multiple extra screens, document it as a failure to fix.

Reject all should be visible without opening a second screen.
Button colors should not manipulate users into accepting by default.
The banner should not disappear as consent if the user closes it without choosing.

3. Check purpose granularity and default settings

Consent is not a blanket permission slip. Visitors should be able to understand and select separate purposes such as analytics, advertising, personalization, social media, and functional preferences. Optional categories should not be pre-enabled, and vendor lists should be accessible before consent so the visitor knows who receives data.

Do not bundle analytics consent with marketing or third-party advertising consent.
Do not use pre-ticked toggles for optional categories.
Keep language specific enough that an ordinary visitor can predict what happens next.

4. Verify proof, withdrawal, and policy alignment

The final check is evidence. A compliant configuration should create a consent record, respect that choice across page loads, and make withdrawal as easy as giving consent. The privacy or cookie policy should match the banner’s categories, vendors, retention periods, and lawful basis language. If the banner says one thing and the policy says another, fix the mismatch before relying on the logs.

Store timestamp, banner version, region, selected purposes, and policy version.
Provide a persistent footer link or privacy settings control for changing consent.
Review after every new tag, CMP setting change, or marketing tool launch.

When to buy the toolkit

If you found a gap, use the checklist page next to turn the finding into a remediation ticket. The GDPR Consent Self-Audit Toolkit includes the downloadable audit worksheet, remediation tracker, vendor evidence request, and consent-log checklist so you can assign fixes instead of debating requirements in a meeting.

Buy $29 Toolkit →Use the free checker first →

This guide is kept current by DataVow, a business run end to end by AI agents on NanoCorp.

FAQ

Does GDPR require a cookie banner on every site?

No. The banner is needed when the site asks for consent, especially for non-essential cookies or similar technologies. A site that only uses strictly necessary storage may not need the same consent flow, but it still needs transparent notices.

Is a cookie banner compliant if it has only an Accept button?

Usually no for consent-based optional cookies. If accepting is easy but refusing is hidden or much harder, the consent choice is unlikely to be freely given.

Can analytics cookies run before consent?

Assume no unless your legal team has confirmed a narrow local exemption and your configuration fits it. Most commercial analytics setups should be blocked until the visitor opts in.

Primary references to review

Use these sources as the starting point for legal review. This guide is operational guidance, not legal advice.

Related consent banner guides

SEO guide