How to Verify Your Website's Cookie Compliance

What cookie compliance means#

A cookie is a small piece of data a website asks your browser to store, often used to remember a login or to recognise you on a later visit. If you want the broader picture of what cookies reveal about you and who can read them, our guide to what cookie privacy is covers it. Cookie compliance means handling those cookies the way privacy law requires. In Europe two laws set the rules together, and understanding what each one asks for is the whole foundation of verifying your site.

The General Data Protection Regulation, usually shortened to GDPR, is the European Union privacy law that governs how you collect and use personal data, and it treats a cookie identifier as personal data whenever that identifier can single out a visitor. Under GDPR, consent has to be freely given, specific, informed, and unambiguous, which rules out permission that is assumed, ticked in advance, or bundled with something else.

The ePrivacy Directive is an older European rule that deals specifically with electronic communications and with cookies in particular. Its Article 5(3) is the clause that matters here. It requires a website to get consent before storing or reading any information on a visitor's device, unless that storage is strictly necessary to deliver a service the visitor has actively asked for. GDPR defines what valid consent looks like, and the ePrivacy Directive says when you have to ask for it.

One point causes needless confusion, so it is worth stating plainly. The ePrivacy Directive is still the law in force. A proposed ePrivacy Regulation that would have replaced it was withdrawn by the European Commission on 5 February 2025, and that withdrawal was confirmed in the EU Official Journal on 6 October 2025, so the Directive continues to govern cookies with no successor in place. In November 2025 the Commission's Digital Omnibus package proposed folding the rules on cookie consent into the GDPR itself, through new Articles 88a and 88b, but that remains a proposal under negotiation rather than adopted law. Nothing in the checklist below depends on it.

That last exception is where cookies split into two groups. Strictly necessary cookies, also called essential cookies, are exempt from consent because the site cannot function without them. Everything else needs permission before it loads.

• Strictly necessary cookies, such as the one that keeps you logged in or holds the contents of a shopping cart, which a site may set without asking because the service breaks without them.
• Analytics cookies, which measure how many people visit and which pages they read, and which need consent because measuring behaviour is not essential to serving the page.
• Marketing and third-party cookies, which follow a visitor across sites to build an advertising profile, and which always need consent before they load.

Why verification matters#

Enforcement is not theoretical. European regulators have moved well past writing rules and now issue real penalties over how cookie banners are built and what loads behind them. Verifying your own site matters because the fines land on the design details, not on whether a banner exists at all.

The scale of the gap is well documented. A study of the top 10,000 websites across dozens of countries found that while roughly 67 percent display some form of cookie banner, only around 15 percent meet basic compliance requirements. Having a banner is common, but having one that actually holds up is rare, which is exactly why checking your own site is worth the few minutes it takes.

France's data protection authority, the CNIL, has been the most active. It fined Google and Amazon in 2020 for placing advertising cookies on visitors' devices without consent, and it has kept up the pressure since. In 2024 alone the CNIL issued 331 corrective measures, and in December 2024 it sent formal notices to sites over banners built with dark patterns, meaning interface tricks that push a visitor toward accepting. In the United Kingdom the Information Commissioner's Office, or ICO, enforces the local implementation of the ePrivacy Directive and has repeatedly pressed sites over banners that do not comply.

The European Data Protection Board, or EDPB, the EU body whose guidance binds national regulators, has stated in its binding guidelines that consent is not freely given when the interface steers visitors toward acceptance. National courts now apply that directly. In the Austrian ORF case, ruled in October 2024 and later confirmed, the court held that a Reject option shown in a less conspicuous colour is not enough, and that Accept and Reject must carry equal prominence on the banner's first layer. In Germany, the Hanover Administrative Court ruled on 19 March 2025 that a site must offer a clear "reject all" button and that manipulative designs are not allowed. A banner that technically offers a choice but nudges hard toward one answer is now routinely treated as no valid choice at all.

The compliance checklist#

Verification comes down to a concrete set of checks you can work through against your own site. They fall into two groups. The first is about how consent behaves, and the second is about transparency and keeping things tidy over time.

How consent behaves

• No non-essential cookies before consent. Analytics and marketing cookies must not appear in the browser until the visitor has actively agreed. If they load on page open, the site is already non-compliant no matter how good the banner looks.
• A reject option as easy as accept. The banner needs a clear way to decline that is as visible and takes as few clicks as accepting, since regulators treat a hidden or buried refusal as no real choice at all.
• A real consent mechanism. A framework such as Google Consent Mode v2, which adjusts how Google tags fire based on the visitor's choice, or the IAB Transparency and Consent Framework (TCF), an industry standard for recording advertising consent, shows that choices are actually enforced rather than decorative.

Transparency and hygiene

• A clear cookie policy that is linked. The banner should link to a page that lists what cookies you set, who receives the data, and how long each one lasts, so a visitor can actually read what they are agreeing to.
• Cookies categorized by purpose. Grouping cookies into necessary, analytics, and marketing lets a visitor accept some and refuse others, which is what specific consent means in practice.
• Reasonable lifetimes and asking again. Consent does not last forever. The CNIL recommends refreshing consent roughly every six months, judged case by case and commonly cited as somewhere between six and thirteen months, rather than treating one click as permanent, and each cookie's expiry date should match its stated purpose.

If you want the full legal reasoning behind these points rather than the short version, our companion guide on GDPR cookie consent requirements walks through what each rule demands and why.

How to check it yourself#

You can verify most of this by hand in about ten minutes using your browser's developer tools, the inspection panel every major browser opens with F12 or by right clicking a page and choosing Inspect. The trick is to look at cookies twice, once before you interact with the banner and once after.

1. 1Open the site in a fresh private window so no old cookies remain.
2. 2Before you touch the banner, open the Application tab in Chrome or Edge, or the Storage tab in Firefox, and expand Cookies. Anything listed there was set before you consented. A session cookie is fine, but an analytics cookie whose name starts with _ga, or a third-party marketing cookie, means the site sets non-essential cookies too early.
3. 3Click Accept and watch the list grow. The new entries are the cookies that correctly waited for permission, and the contrast between the two lists is the most revealing test you can run.
4. 4Reload and look at the banner itself. A Reject or Refuse control should be as prominent as Accept, not a faint link.
5. 5Follow the cookie policy link and confirm it actually describes the cookies you just watched appear.

// Paste this in the DevTools Console to list the cookies this page can read.
document.cookie.split(';').map(c => c.trim())

// This only lists cookies that are NOT marked HttpOnly.
// To see every cookie, open the Application tab (Chrome, Edge) or the
// Storage tab (Firefox), then Cookies, where each cookie's domain,
// expiry, and SameSite value are shown in full.

One caveat with the console command. It only reports cookies that are not marked HttpOnly, a flag that hides a cookie from JavaScript so that scripts cannot read it. The Application or Storage tab shows every cookie including those, which is why it stays the more complete view. While you are there, it is worth confirming that any login cookies carry the right protective flags, a topic covered in how to secure cookies.

How to verify it automatically#

Manual checks are useful, but they capture one page in one browser on one day. Automated verification does the same before and after comparison consistently, and it does not forget to check a page you rarely visit. That consistency is what turns an occasional audit into ongoing confidence.

A scanner can open the page in a real browser, record every cookie set before any interaction, simulate a visitor accepting consent, record the cookies again, work out which consent framework is present, and flag any third-party cookie that appeared before consent was given. Because it runs the same way every time, it catches a regression the moment a new tag or plugin starts loading trackers early, long before a regulator or a customer would notice.

SiteSecurityScore's Cookie Consent & Privacy check does exactly this in a single pass. It loads your site, watches what happens before and after consent, and reports the cookies and trackers it finds along with whether a recognised consent framework is in place. You can run it against any page with a free scan.

If you want to check the security of the cookies themselves rather than the consent flow, the Cookie Security Checker focuses on the protective flags. For the wider legal picture, our GDPR compliance overview goes beyond cookies into the rest of what the regulation asks for.

Common compliance mistakes#

Even sites that mean well tend to trip over the same handful of problems, and most of them come from focusing on the banner while ignoring what the page actually loads. The one below is the trap worth naming first, because it makes every other control meaningless.

The rest of the list tends to show up together, since they usually come from the same rushed setup or a banner left untouched for a year.

• Analytics or advertising tags placed in the page head so they fire before the banner appears, which is the reject that changes nothing described above.
• An Accept all button styled in a bright colour while Reject is a faint text link or hidden behind an extra Manage preferences step, which regulators treat as a nudge rather than a free choice.
• Treating continued scrolling or further browsing as agreement, which the EDPB has said does not count as valid consent.
• No way to withdraw consent later, even though the law requires that changing your mind be as easy as giving permission in the first place.
• A cookie policy that still lists cookies the site no longer uses, or leaves out new ones, so the disclosure no longer matches what actually loads.

One newer trap is worth naming. Some sites now offer only a choice between consenting to tracking or paying a fee, an approach known as consent-or-pay, and in its Opinion 08/2024 the EDPB found that for large online platforms this generally does not yield valid, freely given consent unless the site also offers an equivalent free alternative, such as a version funded by contextual advertising that shows ads based on the page rather than a tracked profile, judged case by case.

FAQ#