EU and UK

GDPR cookie banner for WordPress

In the EU and UK, a site needs consent before it sets cookies that aren’t strictly necessary. A cookie banner is how most sites ask, and regulators have said clearly what a fair one looks like.

Get GoConsent free Audit your site free

At a glance

  • Ask first: non-essential cookies wait for a yes
  • Reject as easy as Accept, on the first layer
  • No pre-ticked boxes, and easy to change your mind

Where the rule comes from

The ePrivacy Directive (and the UK’s PECR) require consent before storing or reading information on a visitor’s device, unless it is strictly necessary for the service they asked for. The GDPR defines what consent means: freely given, specific, informed and unambiguous, and as easy to withdraw as to give. Under the GDPR you must also be able to show that consent was given.

What regulators expect from the banner

In January 2023 the European Data Protection Board published the report of its cookie banner taskforce, the shared view of EU data protection authorities. Among its positions:

  • A banner with an Accept button but no way to refuse on the same layer is not valid consent for most authorities.
  • Pre-ticked boxes do not give valid consent.
  • The design must not suggest that visitors have to consent to use the site.
  • Legitimate interest is not a basis for setting cookies that need consent.
  • Withdrawing consent should be easy at any time, for example through a persistent icon.

Pre-ticked boxes: the Planet49 ruling

On 1 October 2019 the Court of Justice of the EU ruled in Planet49 (C-673/17) that consent to cookies is not validly given through a pre-checked box that the user has to untick to refuse.

What “before consent” means in practice

Analytics, advertising pixels, session recorders and embedded maps or videos from other companies all set or read cookies, so they wait until the visitor agrees. Necessary cookies, such as the one that remembers the visitor’s consent choice or a shopping cart, can run without it.

How GoConsent handles it

  • Equal Accept All and Reject All buttons on the first layer, with category switches
  • Real blocking: analytics, advertising tags and embeds wait for a yes, including tags other scripts add later
  • Click-to-load Google Maps, YouTube and Vimeo, so a first visit contacts none of them
  • Stricter defaults for EU, EEA, UK and Swiss visitors, detected without sending anything anywhere
  • A privacy button on every page to change or withdraw consent
  • Proof of every choice (Consent ID, time, policy version, anonymized IP), kept 24 months on your server and downloadable as CSV
  • A cookie list from the daily scan, by category, in Your Privacy Choices and on your Cookie Policy

See every GoConsent feature

A plain-English guide, last reviewed October 26, 2026. It isn’t legal advice. Read the sources below and talk to a lawyer about your situation.

FAQ

Questions, answered

Do I need a cookie banner if my site only uses necessary cookies?

Strictly necessary cookies don’t need consent, but you still need to tell visitors about them, usually in a cookie policy. As soon as you add analytics, ads or embeds from other companies, you need consent from EU and UK visitors.

Can I use a “cookie wall” that blocks the site until visitors accept?

Regulators have said the design must not make visitors believe they have to consent to use the site. GoConsent never blocks the page.

Does GoConsent support IAB TCF?

No. TCF matters to publishers selling personalized ads to EU and UK visitors. GoConsent covers consent, blocking, Consent Mode v2 and proof without it.

Sources

Set up privacy the right way today

Install GoConsent free from WordPress.org. No account, no visit limits, and nothing about your visitors leaves your site.

Get GoConsent free See Pro plans