Cookie Consent Management for Global Enterprises

Cookie consent is a visitor’s permission for a site to store or read cookies and similar tracking on their device. Cookie consent management is the system around it: capturing the answer, enforcing it before non-essential tags load, storing a record that stands up to audit, and applying any change the visitor makes afterwards. Capture on its own isn’t management.

In the EU, yes, for anything non-essential. The ePrivacy Directive requires prior consent before non-essential cookies are set. In the UK the answer changed on 5 February 2026, when the Data (Use and Access) Act 2025 exempted three narrow categories from consent: statistics used to improve the service, remembering viewing preferences, and location for emergency assistance. You still have to tell people and give them a free way to object, so you still need a notice layer. You may need to ask for less than you did last year. See UK cookie law explained.

Cookies are usually grouped into strictly necessary, performance, functional and targeting. The categories matter because they’re the unit of enforcement. Whatever a visitor rejects has to map to a set of scripts that then don’t load, which is why an unmapped tag added through a tag manager is the most common way a compliant setup quietly stops being compliant.

Visible, readable, and offering accept, reject and customize with equal weight. Non-essential cookies stay blocked until valid consent exists. The EDPB’s Cookie Banner Taskforce report of 17 January 2023 named the patterns authorities treat as non-compliant: pre-ticked boxes, including on the second layer, and a refuse option hidden as a text link inside a paragraph. France’s CNIL fined Google 150 million euros and Facebook Ireland 60 million euros in January 2022 over exactly this, because accepting took one click and refusing took several. More on symmetry in cookie banners.

Prior consent requires users to actively opt in before cookies are set, as required under GDPR cookie consent rules. Implied consent assumes agreement through user actions such as continued browsing, and it’s no longer compliant in most regions for non-essential cookies.

Preferences have to be as easy to change as they were to give. The EDPB has been explicit that withdrawal must be as accessible as consent was, and suggested a persistent hovering icon or a standardized visible link. A link at the bottom of the privacy policy doesn’t meet that. Whatever the visitor changes then has to reach the systems holding their data, not just the cookie table.

The EU rule, often called the cookie law, that governs cookies and similar technologies and works alongside GDPR. It may not govern them for much longer. The Commission’s Digital Omnibus proposal of 19 November 2025 would move consent for terminal equipment into the GDPR itself under a new Article 88a. The Council kept 88a in its compromise text of 18 June 2026 and deleted the companion Article 88b, which would have required sites to honor browser signals. Parliament hasn’t voted, so nothing is final.

Yes. Regulations require that rejecting cookies is as easy as accepting them. A compliant banner gives clear options to refuse non-essential cookies without friction, at the same level of prominence as accept.

There’s no single figure, and the anchors that exist point different ways. France’s CNIL tells sites to limit tracker lifetime to 13 months. The EU’s draft Article 88a would stop you re-prompting a visitor who refused for six months. Refresh sooner than either if your cookie usage materially changes. The practical answer is that the renewal period has to be configurable per jurisdiction rather than set once globally.

Enforcement is active and expensive. France’s CNIL issued 150 million euros against Google and 60 million against Facebook Ireland in January 2022 over how hard refusal was made. In August 2022 the California Attorney General settled with Sephora for 1.2 million dollars, in part for failing to process opt-out requests sent through Global Privacy Control. The EDPB’s January 2023 taskforce report sets out the design practices authorities across the EU treat as non-compliant.

In the twelve US states that require recognition of universal opt-out mechanisms as of 1 January 2026, yes. The signal has to be read and acted on before advertising and analytics tags fire, and California expects the site to show the visitor that the request was processed. The California Attorney General’s 1.2 million dollar settlement with Sephora in August 2022 turned on this point.

It should. A visitor who consents on one property in your group shouldn’t be asked again on another, and consent given on a subdomain should carry to the parent where the same identity applies. That needs cross-domain consent handling and a shared record. A lot of banner tools have neither.

Yes. The Data (Use and Access) Act 2025 added three exemptions to PECR, in force from 5 February 2026: statistics collected solely to improve the service, remembering viewing preferences, and location solely for emergency assistance. The first two apply to website-based services. All three require clear information and a simple free way to object, none can be shared with third parties for their own purposes, and all three turn on the word solely. UK banners built before February 2026 are asking for consent the law no longer requires.

Very likely, though not yet. The Commission proposed on 19 November 2025 to move terminal equipment consent into the GDPR under Article 88a, with one-click refusal and a six month pause before you can ask a refusing visitor again. Article 88b would have required sites to honor machine-readable browser signals. The Council deleted 88b on 18 June 2026 and kept 88a. It still has to clear Parliament and trilogues.