Cookie banner checklist
Go through your cookie banner line by line against the EU consent rules (ePrivacy Art. 5(3), GDPR Art. 7 and the EDPB cookie banner taskforce report) and California’s opt-out rules: the link, Global Privacy Control and a fair choice. You get a count of the lines you meet and a dated record to print. It runs in your browser and never scans your site.
Check your banner
Pre-filled with a realistic example: a small shop with EU and California visitors whose banner offers “Accept all” and “Settings”. Change any answer; Reset clears it for your own site.
Lines met
9 of 18
7 not met and 2 not sure. A line you cannot answer yet is worth asking your banner vendor about.
EU consent rules6 of 11 met
California opt-out rules3 of 7 met
EU consent rules
No cookie or tag that needs consent is set or read before the visitor chooses.
Storing or reading anything on the device needs consent first, unless it is strictly necessary for the service the visitor asked for. ePrivacy Art. 5(3); EDPB report para 7
The first layer says, in plain words, what the cookies are for and how to agree or refuse.
Consent must be informed: clear and comprehensive information comes before the choice, not after it. ePrivacy Art. 5(3); GDPR Art. 4(11); EDPB para 12
A reject option sits on the same layer as the accept button.
A vast majority of EU authorities treat a banner with no reject option on any layer that has an accept button as an infringement. EDPB report para 8 (type A)
Reject is a real button you can read, not a link inside a paragraph or a faint label.
When the only way to refuse is a link buried in the banner text, consent is not valid; a reject button whose text can barely be read can be manifestly misleading. EDPB report paras 14, 18 (types C–E)
No box or toggle is switched on before the visitor touches it, on any layer.
Silence, pre-ticked boxes or inactivity are not consent. GDPR Recital 32; EDPB para 10 (type B)
The settings layer lets the visitor agree or refuse purpose by purpose (analytics, ads, and so on).
Consent must be freely given, specific, informed and unambiguous: specific to each purpose it covers. GDPR Art. 4(11)
No purpose in the banner is switched on by default as a “legitimate interest”.
EU authorities agreed that placing or reading cookies cannot rest on legitimate interests. EDPB report para 24 (type H)
Only strictly necessary cookies sit under “essential”, and you keep a list that explains each one.
Authorities expect site owners to keep the cookie list and to show why each “essential” cookie is essential. ePrivacy Art. 5(3); EDPB para 28 (type I)
A link or small icon on every page reopens the settings, and withdrawing takes no more effort than agreeing.
It shall be as easy to withdraw as to give consent. GDPR Art. 7(3); EDPB para 32 (type K)
Each choice is logged: what was agreed, when, and on which version of the banner.
Where you rely on consent, you must be able to show that the person consented. GDPR Art. 7(1)
A visitor who refuses can still read the site; the banner does not imply they must agree to get in.
A banner must not give the impression that consent is the price of the content, nor clearly push the visitor to agree. GDPR Art. 7(4); EDPB para 13
California opt-out rules
Saying no takes no more steps than saying yes, and the no button is as prominent as the yes.
“Accept All” beside only “Preferences” or “More Information” is not a symmetrical choice; “Accept All” and “Decline All” can be. CCPA regs § 7004(a)(2)
Closing the banner or scrolling away is never recorded as agreement.
Closing or navigating away from a pop-up without selecting the equivalent of “I accept” is not consent. CCPA regs § 7004(a)(3)(D)
The homepage carries a “Do Not Sell or Share My Personal Information” link, or one “Your Privacy Choices” link with the opt-out icon.
A business that sells or shares must post the link, unless it processes opt-out preference signals in the frictionless way the regulations describe. Civ. Code § 1798.135(a); regs § 7015(b)
A Global Privacy Control signal from the browser is treated as an opt-out of sale and sharing for that browser.
A business that sells or shares must process a qualifying opt-out preference signal as a valid opt-out request. CCPA regs § 7025(b)–(c)(1)
When the signal arrives, the site shows it was honoured, for example “Opt-Out Request Honored”.
The business must display on its website whether it processed the signal as an opt-out. CCPA regs § 7025(c)(6)
A cookie banner or cookie controls is not by itself an acceptable method for opting out of sale or sharing. CCPA regs § 7026(a)(4)
An opt-out stops sale and sharing as soon as feasibly possible, and no later than 15 business days.
The 15 business days run from the date the business receives the request. CCPA regs § 7026(f)(1)
Fix these first
- A reject option sits on the same layer as the accept button. EDPB report para 8 (type A)
- Reject is a real button you can read, not a link inside a paragraph or a faint label. EDPB report paras 14, 18 (types C–E)
- No box or toggle is switched on before the visitor touches it, on any layer. GDPR Recital 32; EDPB para 10 (type B)
- A link or small icon on every page reopens the settings, and withdrawing takes no more effort than agreeing. GDPR Art. 7(3); EDPB para 32 (type K)
- Saying no takes no more steps than saying yes, and the no button is as prominent as the yes. CCPA regs § 7004(a)(2)
- A Global Privacy Control signal from the browser is treated as an opt-out of sale and sharing for that browser. CCPA regs § 7025(b)–(c)(1)
- When the signal arrives, the site shows it was honoured, for example “Opt-Out Request Honored”. CCPA regs § 7025(c)(6)
Where each line comes from
- Consent before cookies (EU)
- ePrivacy Art. 5(3)
- Withdrawing consent
- as easy as giving it, GDPR Art. 7(3)
- Banner practices
- EDPB taskforce report, 17 Jan 2023
- Opt-out link (CA)
- “Do Not Sell or Share My Personal Information”
- Global Privacy Control
- an opt-out in CA (regs § 7025); required in CO since 1 Jul 2024
- Stop selling after an opt-out
- 15 business days
Rule texts read 22 Oct 2026.
What it works out
A cookie banner has two jobs that pull in different directions. For visitors in the EU it must collect consent before any non-essential cookie runs; for a business under the CCPA that sells or shares personal information it must give an easy way out. This checklist turns both jobs into 19 plain lines, each tied to the article, regulation or authority report it comes from, and counts how many your banner meets.
The score only counts the lines that reach you: untick the EU line and the consent checks drop away; untick the CCPA line and the opt-out checks do. It is a self-check against the rule texts, read 22 Oct 2026, not a scan and not a verdict. If you are still choosing a banner, our consent platform comparison measures the common ones against the same rules.
It never fetches your site. Every answer stays in this browser tab, nothing is sent to us or stored, and closing the tab clears it. Information, not legal advice.
How to use this checklist
- Open your site in a private window, so no earlier choice is remembered, and look at the banner as a new visitor sees it.
- Tick the scope lines that fit the business. Not sure whether the CCPA applies? The threshold link in the tool tests it.
- Before you click anything, open the browser’s developer tools and look at the cookies already set. That answers the first EU line.
- Walk the banner both ways: accept everything once, refuse everything once, and count the clicks each path takes.
- For the signal lines, visit with a browser that sends Global Privacy Control; our GPC checker confirms it is on.
- Print or copy the result and date it. A dated record of what you checked is worth keeping with your consent logs.
Worked example: the shop in the pre-filled answers
The tool opens on a small online shop with visitors in the EU and California, an analytics tag and an advertising pixel, and a banner that offers “Accept all” and “Settings”. It meets 9 of 18 lines. Five changes, most of them settings in the banner tool it already runs, take it to 16 of 18:
| Fix | Lines it clears | Rule |
|---|---|---|
| Put “Reject all” beside “Accept all”, same size, same weight |
| EDPB paras 8, 14, 18; regs § 7004(a)(2) |
| Switch every toggle in Settings to off until the visitor turns it on |
| GDPR Recital 32 |
| Add a “Cookie settings” link to the footer of every page |
| GDPR Art. 7(3); EDPB para 32 |
| Turn on the banner’s Global Privacy Control handling and test it |
| regs § 7025(b)–(c)(1) |
| Show “Opt-Out Request Honored” when the signal arrives |
| regs § 7025(c)(6) |
Example answers as pre-filled; the 2 “not sure” lines need the banner vendor’s answer. Rule texts read 22 Oct 2026. | ||
The first fix earns the most: one “Reject all” button answers the EU reject-option lines and California’s symmetry rule at the same time. For banner layouts that do this well and the ones regulators have objected to, see our cookie banner examples. Once the banner is settled, list what it controls in a cookie policy that matches it.
Jurisdiction notes
EU and EEA
Placing or reading the cookie is governed by each country’s law implementing the ePrivacy Directive; what happens to the data afterwards falls under the GDPR. The EDPB taskforce report records the common minimum the national authorities agreed, and says each authority’s own guidance still applies on top. Check the regulator of each country you target.
California
An opt-out model. The Attorney General says a user-enabled Global Privacy Control must be honoured by covered businesses as a valid request to stop selling or sharing.
Colorado, Oregon and New Jersey
Colorado’s Attorney General recognises GPC as the only valid universal opt-out mechanism, required since 1 July 2024; see our Colorado Privacy Act guide. Oregon’s privacy act has required businesses to honour opt-out signals since 1 January 2026 and names GPC as an example. New Jersey’s Division of Consumer Affairs says controllers must honour universal opt-out mechanisms such as GPC since 15 July 2025.
The other states
Several other state laws require honouring an “opt-out preference signal” without naming GPC, each from its own date, and some carry no such duty at all. Our US state privacy laws table lists who has the duty and since when.
Questions
Does a US-only site need a cookie banner?
Not in the EU sense. Under the California law most cookies can run until the visitor opts out, but a business that sells or shares personal information must honour the signal and offer the opt-out link (only frictionless processing of the signal lets it leave the link off, regs § 7025(e), (g)), and a banner alone does not count as that opt-out (regs § 7026(a)(4)). A banner is still the usual place to honour the signal and show its status.
Is “Accept all” plus “Settings” enough?
Not on either side. A vast majority of EU authorities in the EDPB taskforce treat a banner with no reject option on the layer that has the accept button as an infringement, and California’s regulations name “Accept All” with only “Preferences” or “More Information” as a choice that is not symmetrical (regs § 7004(a)(2)(C)).
Do I have to honour Global Privacy Control outside California?
In Colorado, yes: GPC is the only universal opt-out the Attorney General recognises, required since 1 July 2024. Oregon names GPC as an example of the signals businesses must honour from 1 January 2026, and New Jersey names it among the universal opt-out mechanisms controllers must honour from 15 July 2025. Several other states require honouring an opt-out preference signal without naming GPC; some have no such duty.
Does this checklist scan my website?
No. It never fetches a URL. You answer each line yourself, the answers stay in this browser tab, and nothing is sent or stored. Print or copy the result if you want to keep it.