GDPR Consent and Cookie Compliance: ePrivacy, Banners and Records

Cookie banners fail when they are UX theatre. Lawful consent must be freely given, specific, informed, and unambiguous — with equally easy refusal where consent is the basis.

Coordinate GDPR grounds with ePrivacy rules for storing/accessing information on user devices, and keep a tag inventory that matches what the banner claims.

Evidence tip: Store consent receipts, script blocking proofs, and CMP configuration versions — screenshots alone age poorly.

Consent vs other grounds

Strictly necessary cookies may not need consent in many implementations; advertising and most analytics usually do. Document the legal basis per category and avoid pre-ticked boxes.

Prior blocking of non-essential tags
Granular categories and vendor lists
Accessible refuse/accept paths
Signal propagation to tag managers

Records that survive scrutiny

CMP logs, DSARs that include preference state, and change tickets when marketing adds pixels. Map vendors into your processor/transfer register.

How CyberSilo Helps

Evidence mapping in CyberSilo CSA
Detection and logging proof with ThreatHawk SIEM
Advisory scoping — contact CyberSilo

Talk to CyberSilo

Map evidence and operations with CyberSilo CSA and ThreatHawk.

Talk to CyberSilo GDPR hub

Frequently Asked Questions

Is a cookie wall allowed?

Often restricted; service access conditioned on non-essential tracking consent is high-risk — get counsel review.

Do server-side tags change obligations?

They change implementation, not the need for a lawful basis and transparency.

How often should we re-audit tags?

Whenever the marketing stack changes — at least on a fixed recurring cadence.

GDPR Consent and Cookie Compliance: ePrivacy, Banners and Records

Consent vs other grounds

Banner and CMP hygiene

Records that survive scrutiny