What is GDPR cookie consent?

GDPR cookie consent generally refers to obtaining consent for cookies and similar technologies when consent is required under applicable EU privacy rules. The ePrivacy Directive governs the storage of and access to information on a user’s device, while the GDPR defines the requirements for valid consent.

Valid consent must be freely given, specific, informed, and unambiguous. It requires a clear affirmative action, so pre-ticked boxes, inactivity, or simply continuing to browse do not constitute valid consent.

Websites should therefore:

• Block technologies that require consent until a valid choice is made.

• Clearly explain the purposes of different cookie categories.

• Give users a genuine choice to accept or reject non-essential cookies.

• Allow users to withdraw consent or update their cookie preferences at any time.

The European Data Protection Board’s Guidelines on Consent provide further guidance on valid consent.