What it means
A retailer might use a shopping-cart cookie and an advertising tracker. The cart may be needed for the service the visitor requested, while the advertising tracker serves a different purpose, so a single banner should not treat both as equally necessary.
Cookies are small pieces of data stored by a browser, but rules can also cover other storage and access technologies, so audit the actual technology and purpose. Map what loads on every page, including third-party tags, because marketing plugins, video embeds and analytics tools can set or read information before a visible banner appears.
Classify purposes, not just vendor labels, since a technology may support site operation, analytics and advertising at once. In the UK, the Information Commissioner's Office says prior consent is required for storage or access unless an exception applies, and its guidance treats exceptions as purpose-specific.
Give clear information about what each choice permits, including relevant third parties, so that people can understand the purpose without reading a technical inventory first. Use an active choice where consent is required, because ignoring a banner or continuing to browse does not automatically mean yes under the ICO's guidance.
Non-exempt technology should wait until the person has made a valid choice. Make refusal straightforward, since the ICO says a mechanism should make it as easy to refuse as to accept.
A prominent accept button next to a hidden, multi-step rejection flow pressures people rather than collecting a reliable decision. Allow purpose-level choices where appropriate, such as analytics separately from advertising, and do not assume accepting one category authorises an unrelated purpose.
Record the decision, the information shown and the relevant version of the choices, using a method proportionate to the site, and make withdrawal accessible. The ICO says people should be able to withdraw consent with the same ease they gave it, so provide a persistent settings route rather than requiring a support request to stop optional tracking.
Test what actually happens after each choice by visiting in a fresh browser, rejecting everything optional and inspecting whether analytics and advertising calls remain blocked. Recheck when vendors or purposes change, because consent to basic audience analytics may not cover a new cross-site advertising partner.
A consent-management platform can help present options and pass signals to tags, but the business remains responsible for configuring categories, testing scripts and understanding vendors. The European Data Protection Board's cookie-banner taskforce reviewed recurring complaint patterns, including refusal options and pre-ticked choices, though local law and the final assessment of a particular setup still matter.
In practice
Real-world examples.
Example
A UK online bookshop presents accept, reject and settings buttons with equally clear routes. A visitor who rejects advertising cookies still reaches the checkout, and the optional tags stay silent.
Example
A business software firm tests its site in a fresh browser, rejects every optional use and inspects the network calls. The advertising tag remains inactive, and the marketing manager records that evidence as proof the choice is honoured in the code.
Example
A visitor to a travel agency site later opens a persistent settings link in the footer and switches analytics off. The change takes effect without a support request, and the advertising choice made earlier is left untouched.
Formula
Calculation
Illustrative acceptance rate = visitors actively accepting optional uses / visitors shown the choice x 100. If 6,000 of 10,000 accept, the rate is 60%; do not count silence as consent. Do not confuse consent rate with site quality, and check what shown means so that people who never made a choice are not counted as acceptance.
Analytics after a rejection will be incomplete. Use privacy-aware measurement and explain coverage when reporting campaign performance.Case study
Seen in the real world.
This entirely fictional example follows Falcon Online, an invented retailer serving European customers. Its site displayed a banner but loaded an ad tag before anyone chose. A fresh-browser test found the mismatch. The team mapped its tags, delayed optional ones and added a persistent settings link.
The example does not assert that the same legal exception or design applies in every country. The site's audience crosses borders, so the team asked advisers which jurisdictions applied instead of copying another retailer's banner design. The owners now apply a simple practical test: know which technologies run, explain why, ask where the law requires it, and honour the response in the code.
Watch out
Common mistakes.
- Showing a banner while optional trackers already load in the background.
- Making acceptance immediate but hiding refusal in several screens.
- Assuming an old analytics choice covers a new advertising purpose.
Questions
People also ask.
What is cookie consent?
A choice about device storage or access for uses that need permission under applicable rules.
Which cookies need it?
Often optional analytics and advertising; assess the actual purpose and local exceptions.
Is it required everywhere?
No. Jurisdictions, purposes and exceptions differ; check the rules that apply to the site.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%Related