Cookies and consent: when should visitors have a real choice?
Archived article with editorially revised content
The earlier article presented a 2017 regulatory proposal as though cookie obligations had already disappeared. That conclusion is not a suitable current guide. Assess how the website actually works rather than simply adding a warning box.
Necessary functions and optional services
Storage strictly necessary for the requested service should be distinguished from optional tracking. Services requiring consent should not start before a decision; rejection and later withdrawal must be possible. Requirements depend on the technology and applicable rules. Scrolling or merely using a page does not automatically constitute valid consent.
The interface and the technology should agree
Inventory analytics, videos, maps and other external content. In a fresh session, after rejection and after withdrawal, check which network requests actually occur. Cookie settings on this website can be reopened from the footer. Privacy information should describe real processing. Generic wording or a browser default cannot replace a website that behaves correctly.
- Decision: Clear controls describe real services rather than assuming misleading or preselected permission.
- Loading: Components requiring consent start after the appropriate decision, so their technical behaviour must be tested.
- Changes: Accessible settings and withdrawal tests confirm that control remains available beyond the initial display.
Inventory the services first
List external and optional components before designing the consent interface. Videos, maps, analytics tools and chat widgets may send requests to another provider before visitors actively use them. Storage other than cookies may also matter, so the inventory should not contain cookie names alone. Record each purpose, loading behaviour and the person responsible for its settings. This creates an interface for the actual website. A copied list that does not match the implementation helps neither visitors nor the people who will maintain the site and add future content.
Make the choice change the behaviour
Rejecting should do more than close the box. A component requiring consent should remain blocked until the appropriate permission exists. An external video can use a local placeholder explaining that it loads only after permission. Necessary and optional behaviour should be clearly distinguished. Do not rely on preselected, concealed or misleading options to obtain a decision. Meaningful choice depends on wording and technical behaviour together, not just the banner’s appearance. Check whether the visible controls do precisely what their labels promise instead of treating the interface and the loading code as separate features.
Test withdrawal too
Inspect network requests in a fresh session before making a decision. Then test rejection, acceptance and changed settings. Examine what happens to an existing external embed when permission is withdrawn. Another page load should not arbitrarily reactivate the service. Settings must remain available later, for example in the footer. Retain the test results: a new plugin or script may bypass a previously correct gate. A complete check therefore covers navigation, reloads and changes to stored choices, not only the first button press when the consent banner initially appears.
Test how the consent interface works.
- Before a decision: Check which requests are made.
- After rejection: Content requiring consent must not load.
- After withdrawal: Check the behaviour after loading the page again.
Keep the information accurate
Privacy and cookie copy should describe the real services, purposes and processing. Do not invent controller information, retention periods or providers. The precise requirements may need a professional review of the implementation and relevant jurisdiction. Language versions should explain the same choices rather than change their meaning. If another video or measurement service is introduced later, review its loading rules and the accompanying information together. This provides real control rather than a merely visible promise. Maintaining that relationship is part of running the website, just as updating its images or text is.