Types of Cookie Consent Banners

Navigating the digital landscape, cookie consent banners have become an integral part of our online experience, shaped up by privacy regulations such as GDPR and CCPA and shifting user expectations. In this blog, We’re going to explore different types of cookie consent banners and see how well they follow GDPR requirements, and how they are adopted globally.

We have listed out here the three main cookie consent models which can be used directly or by creating a hybrid of one or more models. To ensure compliance and a smooth user experience, many organizations leverage cookie consent managers, which simplify the complex process of collecting and managing user consent for cookies.

Notice-only cookie banners inform people that you use cookies but don’t give them the opportunity to accept or reject them. This banner tells the users that the cookies are in use and dropped by your website in their browsers. They have the option to either accept the fact or navigate away from the website. This kind of banners generally has single button such as “Ok”, “Got it”, “Continue to website”, etc.

Is Implied Consent Banner GDPR valid?
This is not GDPR-compliant as users are not able to choose how cookies are used. Under GDPR compliance, users must be enabled with the option to interact with the banner and choose explicitly to accept or reject the cookies.

Some of the main concerns over these kinds of cookie banners are:

• Users are not enabled with the options to accept or reject cookies i.e., explicit consent is not taken from users before dropping the cookies.
• Users do not have the option to reject the cookies, which is contrary to EU privacy law.

Opting for non-compliant cookie banners creates legal risks and erodes user trust. Instead, EU cookie banners empower users with control over their data, fostering transparency and building trust that benefits both users and organizations.  

Use of Notice Only cookie banners and its Global validity
This is the simplest and the widely accepted cookie banner provided by the websites. It takes the least amount of technology, time, and efforts to build these kinds of banners. With the increasing regulations and clarifications on cookies around the globe, this kind of banner is phasing out slowly.

Despite being the simplest type of cookie banner, it is very likely to go wrong. A notice-only cookie banner, serving as a sub for a cookie consent management solution, can leave a wrong impression on users. They might perceive it as an attempt to hide information, lack awareness of legal obligations, or not provide adequate rights regarding their privacy, potentially leading to objections or concerns.

Implementing a sub for a cookie banner can offer a creative and effective way to inform users about data collection practices while enhancing website aesthetics.

In an implied consent model, it assumes the user has consented to cookies from their individual actions, rather than verbally or in writing. With Implied Consent, the data subject grants consent by actions such as continuous use of the website, particularly by scrolling or refreshing the page.

This is also known as a deemed-consent cookie banner. It discloses to website visitors that the website deploys cookies and asserts that the visitors’ continued use of the website constitutes deemed, or implied, consent for that use.

Notice only cookie consent banner is different from implied consent banner because in the latter one cookie are blocked at first when the user visits the website, and consent is implicit if the user performs an action.

Is Implied Consent Banner GDPR valid?
As per EDPB guidelines 05/2020 on consent, based on Recital 32 of GDPR, actions such as scrolling or swiping through a webpage or similar user activity will not under any circumstances satisfy the requirement of clear and affirmative action. The French, U.K., and German authorities highlight that a user continuing to browse a website does not amount to that user’s consent.

Global validity and its use
Implied consent is invalid under most of the regions around the world. An exception to implied consent banner is that if a user clicks on a link to find out more about cookies, this cannot be considered as consent. In this case, the cookie notice page should not set cookies until a second action is taken by the user. While this model can be challenging to implement, it is considered the minimum compliance level by some regulators, including the CNIL in France.

Explicit consent means that the data subject must give a clear agreement that cookies will be stored on their device and until they agree with it, they cannot proceed to use the website.

This kind of banner gives notice to users about the cookies that the website would like to deploy to their browsers and asks for their explicit consent. This model entails blocking cookies until a specific action is performed that indicates user acceptance of cookies. This action should only show that acceptance has occurred. In essence, this means they must check a box, click a button, or follow a link that states that they accept cookies, or something very similar.

Global Validity
People tend to ignore notices that aren’t essentially shoved in their faces, which is a problem with this model. It can be difficult to get them to click the “I accept cookies” button without disrupting their whole web experience. Companies in the Netherlands erected “Cookie Walls” to prevent users from ignoring this type of notice. Visitors had to accept the cookie before they were taken to the main website.

Consider the following points in your cookie banner for GDPR compliance, ensuring effective cookie consent management:

• Include in clear language the cookie details including the cookie type and their purpose in your banner itself or cookie notice.
• Allow the users to have equal opportunity to accept or reject cookies.
• It is preferable to provide them with a granular consent option to make an informed choice.
• Do not drop cookie in their browser until they explicitly accept the cookies.

While rules and regulations vary from one nation to another, the underlying purpose remains consistent. The aim is to provide transparency of personal data collected and respect the privacy preferences of individuals, encompassing consumers, website users, business partners, employees, and others, ensuring their control over their own data.  Prioritize user privacy and legal compliance by implementing consent banner compliant solutions.

There isn’t a one-size-fits-all or universally perfect cookie consent banner. To draw a conclusion, it’s essential to take into account the specific regulations that apply to your situation, the expectations of regulators, and the transparency to your customers. By considering these factors, you can craft a compliant cookie consent banner for your website, which may align with one of the aforementioned types or emerge as a hybrid incorporating elements from two or more types.