Answer in brief
A valid cookie consent banner asks before non-essential cookies are set, offers refusal as easily as acceptance, explains the purposes and lets people change their mind. Google Consent Mode v2 then passes the choice to Google tags so analytics and ads respect it. This is general information, not legal advice; check your own case with a lawyer.
What a cookie consent banner is for, and the rules behind it
A cookie consent banner is the box that asks a visitor whether a website may store or read information on their device. It exists because European privacy rules treat tracking technologies as something a visitor should agree to. In France the regulator CNIL points to article 82 of the French Data Protection Act. A banner that only informs, or that decorates a site which tracks anyway, does not do that job.
This story summarises what regulators and Google say in their own documents. It is not legal advice, and rules differ between countries and over time. The banner is also only the visible half. The other half is what your site does behind it, and that is where most failures are found.
Consent comes first: nothing non-essential before the click
The CNIL states that users generally must consent before any cookie or tracker is written to or read from their device, with some exceptions. Before they decide, they must be told the purposes of the trackers, the consequences of accepting or refusing, and the identity of every party using trackers that require consent. The organisation must also be able to prove, at any time, that valid consent was obtained.
The exceptions are narrow. CNIL lists trackers used for authentication, for keeping the contents of a shopping cart and, under conditions, for certain audience statistics. Everything else, which usually means advertising pixels, retargeting, social widgets and most analytics set-ups, waits for a yes. The practical test is simple: open your site in a clean browser, do not click the banner, and look at which cookies and requests already exist.
Refusing must be as easy as accepting
CNIL’s FAQ says a refusal option must be offered, either as a reject-all button on the first layer, at the same level and in the same form as the accept-all button, or as another option that makes refusing as easy as accepting. Refusal should not need extra steps such as a second settings screen, and the buttons must not mislead or make one choice look more prominent than the other.
Spain’s AEPD, in announcing the update of its cookie guide, says the same: accept and reject must be shown in a prominent place and format, at the same level, and refusing cannot be more complicated than accepting. The updated guide adds examples about the colour, size and location of the buttons. For a designer this is concrete: two buttons of the same size, the same weight and the same contrast, on the same screen.
Why scrolling, closing or carrying on are not a yes
CNIL is explicit that simply continuing to browse is no longer read as consent. Consent requires a clear positive action, such as clicking an accept button, and without it no non-essential tracker may be placed. Its FAQ goes further and says that continuing to browse is read as a refusal. A banner that disappears after ten seconds, or after a scroll, therefore proves nothing.
The CNIL also says that consent must be free, informed, specific and unambiguous, and that a refusal or consent should be stored so visitors are not asked on every page. It considers keeping the choice for about six months to be good practice. Treat that as a guide rather than a deadline, and write down the period you choose, so that the banner and the cookie policy say the same thing.
Purposes, choices and a way to change your mind
A banner that asks one yes for everything is hard to defend, because consent is meant to be specific. Group your cookies by purpose, for example measurement, advertising and functional, explain each in a sentence and let the visitor choose per group. Use plain words. The visitor should understand what accepting does before pressing the button.
Withdrawal matters as much as the first choice. CNIL says people can withdraw consent at any time and that withdrawing must be as simple as giving it. It recommends a persistent link with a clear name, such as manage my cookies, or a cookie icon on every page. It adds that withdrawal must be effective: for third-party cookies the publisher has to stop all reads and writes from its site, which can mean switching off requests to those domains.
Google Consent Mode v2: how the choice reaches your tags
Consent Mode lets Google tags change behaviour according to the visitor’s choice. Google’s setup guide describes two steps: set a default consent state before anything else, then send an update when the visitor responds. The parameters are ad_storage and analytics_storage, plus ad_user_data and ad_personalization, which were added in the November 2023 update known as v2. Consent Mode does not store the choice itself, so your site must save it and send it again on later pages.
Order is the classic trap. Google states that the default must run before the Google tag, and that if it runs after, the defaults will not apply. For regions, a default can be scoped by region code, and the more specific rule wins. Google also describes basic mode, where tags stay blocked until the visitor interacts with the banner, and advanced mode, where tags load with consent denied and send cookieless measurements. For EEA traffic Google’s policy asks advertisers to collect consent and pass the signals on, and warns that blocking tags until the banner is answered can lose data.
Analytics that respects the choice, and the mistakes that repeat
Analytics is where owners expect an exemption. CNIL allows one only under strict conditions: the publisher’s own audience measurement, anonymous statistics only, no tracking across sites or apps, no cross-matching and no sharing with third parties, and the publisher must be able to demonstrate compliance. CNIL also states that pseudonymisation does not meet its definition of anonymisation. Many standard set-ups fail one of these conditions, so assume you need consent unless an expert confirms otherwise.
The mistakes repeat. The Google tag loads before the default consent is set. The reject option hides on a second layer or looks like a footnote. The choice is not stored, so the banner returns on every page. Cookies keep being written after a refusal because a script was hard-coded in the template. There is no link to withdraw. Each is found in minutes with a browser, a clean profile and the developer tools.
Do it yourself or order the setup, and what to prepare
A careful owner can install a consent platform, fix the order of tags and test the result with a clean browser. The hard part is the inventory. Every script, pixel and embed on the site must be found, sorted by purpose and attached to the right choice, and that list must be kept up to date when someone adds a new widget. If the site has many tools, or you are unsure what loads, ordering the work saves time.
VITON13 Studio offers it as the cookie consent and privacy setup. It includes a GDPR-style cookie banner with real consent, set up with Consent Mode v2; a cookie list for your site; a privacy policy draft; and analytics that respect the visitor’s choice. You see the banner working on a staging copy of your site as a free draft before you pay. The price is a fixed $33 and the work takes two to four working days. The policy draft is a starting text, so have a lawyer confirm it for your case. Bring a list of the tools you use and access to your site.
Practical checklist
- Open the site in a clean browser without clicking the banner and note every cookie already set.
- Give accept and reject the same size, weight, colour contrast and screen.
- Group cookies by purpose and let visitors choose per group in plain words.
- Set the Consent Mode default before the Google tag, then send an update after the click.
- Add a permanent link or icon to change the choice, and test that withdrawal stops the trackers.
Questions and answers
Does continuing to browse count as consent to cookies?
Not according to CNIL. It says continuing to browse is now read as a refusal and that consent requires a clear positive action such as clicking an accept button. A banner that closes by itself therefore proves nothing.
Must the reject button look the same as the accept button?
CNIL requires a refusal option at the same level and in the same form as acceptance, or another option that is just as easy. The AEPD says both choices must sit at the same level. Equal size, weight and contrast is the safest design.
What changed with Google Consent Mode v2?
Google added two parameters, ad_user_data and ad_personalization, to the older ad_storage and analytics_storage. Advertisers who use personalisation or measurement for EEA users must collect consent and send the signals to Google.
Are analytics cookies exempt from consent?
Only under strict conditions set out by CNIL: the publisher’s own audience measurement, anonymous statistics, no cross-site tracking and no sharing with third parties. Pseudonymised data does not qualify, so most set-ups still need consent.
How long should a visitor’s cookie choice be kept?
CNIL considers about six months to be good practice for keeping a consent or refusal, so visitors are not asked on every page. It is a recommendation, and the exact period should be stated in your cookie policy.