Cookie banners are the first thing most visitors see in your store, and they are also one of the topics European data protection authorities check most. A banner that looks fine can still be invalid if scripts load before the visitor answers or if rejecting takes more clicks than accepting.
What the law says
Two texts work together:
- Article 5(3) of the ePrivacy Directive 2002/58/EC says that storing or reading information on the visitor’s device requires prior consent, except for what is strictly necessary to provide the service (the cart, the login session, security).
- The GDPR defines what valid consent is: freely given, specific, informed and unambiguous, given by a clear affirmative action, and as easy to withdraw as to give (article 7).
In the Planet49 ruling (C-673/17), the Court of Justice of the EU confirmed that pre-ticked boxes are not valid consent. In 2023, the EDPB cookie banner taskforce agreed on the practices most authorities consider unlawful, and national guidelines such as those of the CNIL in France and the AEPD in Spain follow the same line.
The mistakes that get stores fined
- Scripts that run before consent: analytics, advertising pixels or chat widgets that set cookies as soon as the page loads.
- No “Reject all” on the first layer, or a reject option hidden behind a “Settings” link.
- Deceptive design: a big coloured “Accept” button next to a grey text link to refuse.
- Pre-ticked categories for statistics or marketing.
- No way to change your mind once the banner has been closed.
Authorities have imposed large fines for these practices, and in many countries consumer associations and competitors can also file complaints.
Google Consent Mode v2
Since March 2024, Google requires Consent Mode v2 for traffic from the European Economic Area if you want to keep using advertising features such as remarketing and conversion measurement. Your banner has to tell Google tags the visitor’s choice through four signals: ad_storage, analytics_storage, ad_user_data and ad_personalization. The default state (denied) must be set before any Google tag loads.
Checklist for your store
- Block every non-essential script until its category is accepted, including tags added by the theme, other modules or pasted into content pages.
- Offer Accept all, Reject all and Choose on the first layer, with the same visual weight.
- Leave optional categories unticked by default.
- Link to your cookie policy from the banner.
- Let visitors change their choice at any time from a permanent link or button.
- Be able to demonstrate consent (GDPR article 7(1)) and ask again after a reasonable period or when you add new services.
- Send the choice to Google with Consent Mode v2, defaults first.
How our addon helps
Cookie Consent & Consent Mode v2 covers the whole checklist without an external service:
- Blocks known trackers (Google Analytics, Tag Manager, Google Ads, Meta Pixel, TikTok, Microsoft Clarity, Hotjar and more) wherever they come from in the page, and lets you add your own.
- Balanced first screen with Reject all, Choose and Accept all looking identical, and optional categories unticked.
- Consent Mode v2 defaults written at the very top of the page, before any other script.
- Permanent settings button to reopen the choices, deleting the cookies of services the visitor drops.
- Ask again option to show the banner to everyone after adding a new service.
Available for PrestaShop, WooCommerce and Drupal Commerce, with banner texts in English, Spanish and French, new versions for life and 6 months of support.
This article is general information, not legal advice. Check your national authority’s guidelines.