Cookie banner examples

Every specimen on one sheet

These are patterns, not screenshots. Each banner on this page is our own wireframe of a practice a regulator or a regulation has named, graded line by line against the rule it meets or breaks. There are 14 specimens: 9 that regulators have objected to, 4 that meet the rules, and 1 whose verdict turns on how the site handles California’s opt-out signal. Select any one to jump to its grade sheet.

On the EU side the grades come from the report of the EDPB’s cookie banner taskforce, adopted 17 January 2023, when the national regulators agreed a common reading of a wave of complaints about banners. The report names the practices type A to type K, and those names are kept in the grade lines. It calls its positions a minimum threshold: each banner is still judged case by case, and each country’s own guidance applies on top.

On the California side the source is § 7004 of the CCPA regulations, which sets the rules for every method of asking for consent and names the website banner in its examples, and § 7025 on opt-out preference signals. A method that breaks § 7004 may be a dark pattern, and agreement obtained through a dark pattern does not count as consent (§ 7004(b)).

The first layer: one click each way

The first layer is the banner itself, before anyone opens the settings. Both rule books meet here. The EU authorities ask for a way to refuse on the layer that carries the accept button. California asks that the no path be no longer and no harder than the yes path, and that the no button be no less prominent.

The taskforce adds two points every first layer needs: it must say what the banner is about and how to choose (para 12), and it must not suggest that agreeing is the price of reading the page, nor clearly push the visitor to agree (para 13). A banner that does all of that in one row passes both sides at once.

The settings layer: off until switched on

The second layer is where consent becomes specific, purpose by purpose. It is also where three of the taskforce’s practice types sit: boxes ticked in advance (type B), purposes moved under a “legitimate interest” tab (type H), and cookies called essential that are not (type I).

Statistics is the group most often argued over. Under Art. 5(3), an analytics cookie is not strictly necessary for the page the visitor asked for, so by default it waits for consent. Some regulators carve out narrow audience measurement: France’s CNIL exempts it only under conditions that include a tracker lifetime of around 13 months, not extended on each visit, and data kept at most 25 months. If your analytics is the reason the banner exists, read whether Google Analytics is GDPR compliant and the analytics tools that need no cookie banner.

After the choice: a way back in

Banners are usually judged on the moment they appear. One rule applies after the banner has gone: a visitor who agreed must be able to change their mind, and changing it must cost no more than agreeing did.

The taskforce mentions a small, permanently visible icon on every page but does not require one: an icon or a link in a visible, standard place both qualify, and the test stays whether withdrawing is as easy as agreeing (paras 32, 35). The footer link is the cheapest way to pass; the corner tab is optional.

California visitors: the banner is not the opt-out

A site that sells or shares personal information, and sharing includes passing data to a third party for cross-context behavioral advertising whether or not money changes hands, owes Californians an opt-out of that sale or sharing. The regulations say plainly that a cookie banner does not do that job on its own:

So the opt-out has two parts the banner cannot replace: the browser’s opt-out preference signal, which must be honoured as a valid request for that browser, and at least one other method, usually the link. Which link a site needs, and when it needs none, is in our guide to the “Do Not Sell or Share” link.

Symmetry is not a theory. In March 2025 American Honda agreed to pay the California Privacy Protection Agency a $632,500 fine; one of the practices the agency alleged was an online privacy management tool that failed to offer Californians their privacy choices in a symmetrical or equal way. Honda also agreed to consult a user experience designer about its request methods.

Build one, watch the grade

The banner below starts with the faults this page has walked through. Change one choice at a time and the drawing and its grade follow, line by line, against the same rules as the specimens. It runs in this tab only; nothing is sent or stored.

Graded on what the drawing shows. Whether tags really wait for the click is a test on the live site. read 22 Oct 2026.

What a cookie scanner can tell you, and what it cannot decide

A cookie scanner loads your pages the way a browser does and lists what gets stored. Run once before any click and once after “Accept all”, it answers the question hardest to check by eye: what your banner actually holds back. It cannot answer the questions the rules turn on.

The EU regulators said so themselves. Discussing type I, cookies wrongly called essential, the taskforce noted that the available tools “do not allow to check the nature of the cookies but only to list the cookies placed”; authorities use the list to ask the site owner for documentation of each cookie’s purpose (para 29).

A scan by hand in ten minutes

1. Open a private window and the browser’s developer tools: Application, then Cookies, in Chrome or Edge; Storage in Firefox.
2. Load the home page and click nothing. Everything listed now was set before consent; anything not strictly necessary is a finding.
3. Choose “Reject all”, then open two more pages. The list should not grow with statistics or advertising cookies.
4. Clear the site data, choose “Accept all” and visit the same pages. That list is the full inventory for your cookie policy.
5. Repeat on the checkout, the log-in and any page with a chat or video embed, the places a crawler misses.

Questions