Cookie Consent Terms: 12 Essential Concepts Made Clear
Cookie consent comes with a vocabulary that sounds interchangeable and is not. Strictly necessary, prior consent, opt in and dark pattern each describe a different part of a compliant banner, and mixing them up is how sites end up with a banner that looks right and fails in practice.
This guide defines twelve cookie consent terms, then shows how they fit together in tables you can use as a reference. It also explains how the Cookie Consent Generator turns each concept into working code. It is general information, not legal advice.
What this guide covers
- The twelve cookie consent terms in one place
- Cookie categories and what each one needs
- How the legal terms fit together
- In practice: blocking scripts
- How the generator turns each concept into code
- A worked example for a small blog
- Banner styles: how much choice is enough?
- Dark patterns and why regulators care
- Putting the terms to work
The twelve cookie consent terms in one place
- Cookie
- A small piece of data a website asks the browser to store, used to remember a session, a setting or a visitor.
- First party cookie
- A cookie set by the site the visitor is on. It is usually used for logins, carts and language.
- Third party cookie
- A cookie set by another domain whose content is embedded in the page, such as an advertising or analytics provider.
- Strictly necessary cookie
- A cookie without which the service the visitor asked for cannot work, such as a session cookie or a security token. It needs no consent.
- Consent
- Under GDPR Article 4(11), any freely given, specific, informed and unambiguous indication of wishes, by a statement or a clear affirmative action.
- Prior consent
- Consent obtained before the cookie is stored. A script that sets a cookie while the banner is still open has already broken this rule.
- Opt in
- A model where nothing optional happens until the visitor agrees. This is what European law expects for analytics and marketing cookies.
- Opt out
- A model where tracking runs by default and the visitor must switch it off. It does not give valid consent in the EU.
- Cookie category
- A group of cookies with one purpose, such as necessary, functional, analytics or marketing, so visitors can choose by purpose.
- Dark pattern
- A design that steers a visitor toward accepting, for example a bright Accept button beside a faint link to manage preferences.
- Consent record
- Proof of the visitor choice. Article 7(1) requires the controller to be able to demonstrate that consent was given.
- Withdrawal
- The visitor right to change their mind. Article 7(3) says it must be as easy to withdraw consent as to give it.
Cookie categories and what each one needs
Cookie consent attaches to the purpose of a cookie, not to its name. That is why banners are organised by category. Here is how the four usual categories behave.
| Category | Typical examples | Consent needed before it runs? | Can the visitor switch it off? |
|---|---|---|---|
| Strictly necessary | Session ID, login state, security token, saved consent choice | No | No, and it should not be offered as a choice |
| Functional | Language, region, saved display preferences | Yes in the generated banner | Yes |
| Analytics | Aggregate visit counts, page views, scroll depth | Yes | Yes |
| Marketing | Advertising, retargeting, cross site profiles | Yes | Yes |
The exception for strictly necessary cookies comes from Article 5(3) of the ePrivacy Directive. It lets a site store information that is essential to deliver a service the visitor asked for. A cookie that merely helps you measure traffic does not qualify, however useful it is to you.
How the legal terms fit together
| Rule | Source | What it means for a banner |
|---|---|---|
| Storing or reading data on a device needs consent, with an exception for what is strictly necessary | ePrivacy Directive, Article 5(3) | Analytics and marketing cookies wait for a yes |
| Consent must be freely given, specific, informed and unambiguous | GDPR, Article 4(11) | No bundling of purposes, no vague wording |
| The controller must be able to prove consent | GDPR, Article 7(1) | Store the choice and keep a record |
| Withdrawing must be as easy as giving consent | GDPR, Article 7(3) | A visible way to reopen the banner |
| Pre ticked boxes and silence are not consent | GDPR Recital 32, CJEU Planet49 ruling of 1 October 2019 | Optional categories start switched off |
The Planet49 case is the one to remember. The Court of Justice of the EU ruled that a pre ticked checkbox cannot produce valid consent to cookies, because consent requires active behaviour from the user. The point extends to any banner that treats scrolling or closing the window as agreement.
In practice: blocking scripts
Prior consent is where cookie consent banners most often fail. The banner appears, but the analytics script already ran in the page head, and the cookie exists before anyone clicked. The cure is to hold such scripts back until the category is granted.
The generated code does this with a plain marker. A script tagged as text/plain with a category name does not execute. The banner script releases it only after the matching choice is saved.
A script held back until analytics is allowed
<script type="text/plain" data-cookie-category="analytics">
// your analytics loader goes here
</script>Prior consent means cookies are set only after the choice is made. If the script runs while the banner is still open, the cookie exists before any agreement.
How the generator turns each concept into code
| Concept | What the generated banner does |
|---|---|
| Consent record | Saves the decision in localStorage under the key cc_consent_v1 |
| Prior consent | Checks for a stored decision on page load and shows the banner only if none exists |
| Strictly necessary | Always included and cannot be switched off |
| Reject as easy as accept | Accept All and Reject All are the same size in the Standard and Full styles |
| Category choice | The Full style adds Customize with separate boxes for Analytics, Marketing and Preferences |
| Withdrawal | Exposes window.cookieConsent with get and reset, so a footer link can reopen the banner |
| Telling other scripts | Fires a cookieConsentUpdated event that your tags can listen for |
Set your colours, text and cookie consent categories, preview the banner, and copy ready to paste code that stores the choice and holds scripts back.
Open the Cookie Consent GeneratorA worked example for a small blog
Take a blog that sets four things: a login session, a saved language, an analytics script and an ad network tag. Sorting them shows how cookie consent works in practice, and which items the banner must hold back.
| Item | Category | Runs before a choice? | After Reject All |
|---|---|---|---|
| Login session | Strictly necessary | Yes | Still runs |
| Saved language | Functional | No | Stays off, and the site falls back to the default |
| Analytics script | Analytics | No | Stays off |
| Ad network tag | Marketing | No | Stays off |
One of four items runs before the visitor chooses. Three wait. If your own audit finds that all four run on page load, your cookie consent setup is only decoration, and the fix is to mark the three optional scripts so they stay inactive until their category is granted.
Banner styles: how much choice is enough?
| Style | Buttons | Granularity | When it fits |
|---|---|---|---|
| Simple | Accept All only | None | Only a site that uses strictly necessary cookies |
| Standard | Accept All, Reject All | Binary | A site with one tracking purpose |
| Full | Accept All, Reject All, Customize, Save Preferences | Analytics, Marketing and Preferences | Most sites that run analytics and ads |
A banner with Accept and no equal way to refuse does not meet the requirement that consent be freely given. Use it only when the site sets nothing beyond strictly necessary cookies.
Dark patterns and why regulators care
A dark pattern is a design choice that nudges people away from the answer they would otherwise give. The classic example is a large Accept button and a small grey Manage link. In January 2022 the French regulator CNIL fined Google 150 million euros in total and Facebook 60 million euros, partly because refusing cookies took more steps than accepting them.
Patterns regulators object to
- Accept is prominent, refusal is hidden
- Refusal takes several clicks
- Pre ticked optional categories
- Banner returns on every page after a choice
- Closing the window counts as agreement
Patterns that hold up better
- Equal size Accept and Reject buttons
- Optional categories start off
- The choice is stored and respected
- A footer link to change the choice
- Plain wording about each purpose
Infringements of the cookie consent conditions can reach fines of up to 20 million euros or 4 percent of worldwide annual turnover under Article 83(5) of the GDPR, whichever is higher. Most small sites will never see a number like that, but the rules are the same for everyone.
Putting the terms to work
To audit cookie consent, see which cookies your site is actually setting by opening your browser developer tools. Server responses also show cookies in their headers, which the HTTP header checker can display for any address.
Cookie consent questions
Do all cookies need cookie consent?
No. Strictly necessary cookies, such as session and security cookies, need none. Analytics, marketing and most preference cookies need consent before they are set.
What is the difference between opt in and opt out?
Opt in means nothing optional happens until the visitor agrees. Opt out means tracking starts by default, which does not count as valid consent in the EU.
Is a Reject All button required for cookie consent?
Refusing must be as easy as accepting. A Reject All button next to Accept All is the simplest way to meet that.
Where is the cookie consent choice stored?
The generated banner stores it in the browser localStorage under the key cc_consent_v1, and checks it on each page load.
Can I show the banner again later?
Yes. The generated code exposes a reset function, so a Cookie Settings link in the footer can clear the saved choice and reopen the banner.
Does a cookie banner make my site compliant on its own?
No. It only handles consent. You also need a privacy policy, a record of what each script does, and scripts that actually wait for consent.
Sources: GDPR Article 7, Conditions for consent · Planet49 case, Wikipedia