GDPR Consent and Cookie Compliance: ePrivacy, Banners and Records

Consent vs other grounds

Strictly necessary cookies may not need consent in many implementations; advertising and most analytics usually do. Document the legal basis per category and avoid pre-ticked boxes.

Banner and CMP hygiene

• Prior blocking of non-essential tags
• Granular categories and vendor lists
• Accessible refuse/accept paths
• Signal propagation to tag managers

Records that survive scrutiny

CMP logs, DSARs that include preference state, and change tickets when marketing adds pixels. Map vendors into your processor/transfer register.

How CyberSilo Helps

• Evidence mapping in CyberSilo CSA
• Detection and logging proof with ThreatHawk SIEM
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

Is a cookie wall allowed?

Often restricted; service access conditioned on non-essential tracking consent is high-risk — get counsel review.

Do server-side tags change obligations?

They change implementation, not the need for a lawful basis and transparency.

How often should we re-audit tags?

Whenever the marketing stack changes — at least on a fixed recurring cadence.

Related Resources

• GDPR hub
• Consent management