The visible interface that presents visitors with information about the cookies used on the website and allows them to accept, reject or customise their cookie preferences by category — combined with the underlying technical system that respects and enforces those preferences across all third-party scripts and tracking tools.
Clear information about what cookies are used and why, genuinely equal options to accept or decline (no dark patterns making rejection difficult), category-level granular control (analytics, marketing, functionality), a link to the full cookie policy and a mechanism for visitors to change their preferences at any time.
A design technique that makes accepting all cookies easier or more prominent than rejecting them — for example, a large green ‘Accept all’ button alongside a small, grey ‘Manage preferences’ link with no reject option visible at the first layer. The ICO has explicitly identified dark patterns as non-compliant.
A CMP is a specialist software system for managing cookie consent — examples include Cookiebot, OneTrust and TrustArc. It handles cookie scanning, banner presentation, consent recording and script blocking until consent is given. For any site using multiple third-party tracking tools, a properly configured CMP is the most reliable compliance approach.
Through a tag management system (Google Tag Manager) configured to fire analytics and marketing tags only after the visitor has consented to the relevant cookie category. Without this technical integration, the banner collects consent declarations but the scripts run regardless — making the consent meaningless in practice.
The visitor’s consent choice should be stored in a first-party cookie (itself a strictly necessary cookie for compliance purposes) and used to configure tracking scripts on all subsequent visits. The consent should be renewed periodically (typically annually) or whenever the cookie inventory materially changes.
A Google framework that allows Google Analytics and Google Ads to adjust their behaviour based on the visitor’s consent status — operating in limited, cookieless modelling mode when consent is withheld, rather than either tracking fully or not at all. It reduces data loss from non-consenting visitors while maintaining compliance.
No. Under UK GDPR and PECR, consent must be a freely given, specific, informed and unambiguous indication of agreement — pre-ticked boxes do not meet this standard. All non-essential cookie categories must be off by default, with the visitor actively opting in.
Cease processing their data through the withdrawn cookie categories immediately, delete any previously set non-essential cookies in their browser and ensure the preference change is reflected across all tracking tools. A technically sound CMP handles this automatically when correctly configured.
A geo-targeted consent configuration can serve different banner behaviours based on the visitor’s location — UK and EU visitors receive PECR/GDPR-compliant banners; US visitors may receive a different disclosure depending on applicable state laws (e.g., CCPA for California). Most enterprise CMPs support geo-targeted rule sets.