Cookie consent examples: banners that work and banners regulators flagged

Good cookie consent examples all pass one test: saying no is as easy as saying yes. The colours and the wording either serve that test or get in its way.

This guide describes the patterns in words rather than screenshots, because a screenshot shows one site’s choice and a pattern shows the rule behind it. First the banners that work. Then seven that regulators in the EU and the UK named in a decision, a letter or a formal notice. Then a phone check for your own.

Cookie consent banner examples that work

The two-button banner. A short strip at the bottom of the page. One sentence: “We use cookies for analytics and ads. You can say no.” Two buttons in the same row, the same size, the same shape: Accept all and Reject all. A plain link beside them: Settings. Behind the banner, the page is readable and nothing non-essential has loaded. The ICO’s checklist puts it in one line: the consent mechanism makes it as easy to refuse consent as it is to accept.

The settings screen. Tap Settings and you get a short list by purpose: analytics, advertising, embedded video. Every switch is off. A Save button keeps whatever you set. Necessary cookies are listed too, with no switch, and a line saying why.

The way back. A link in the footer called Cookie settings reopens the same screen so the visitor can change their mind. The EU taskforce said sites should offer easily accessible solutions to withdraw at any time, such as a small permanent icon or a link in a standard place, and that withdrawing has to be as easy as consenting.

The honest sentence. The text names who else receives data and how long the cookies last. The Court of Justice ruled in Planet49 that the information owed to a visitor includes the duration of the cookies and whether third parties may have access to them.

No banner at all. A site that only sets a session cookie and a basket cookie has nothing to ask about. In the UK, since February 2026, a cookie whose sole purpose is to collect statistical information to improve your own service can also sit outside the consent rule, as long as you say so and give a simple way to object. Advertising cookies are never in that group.

Cookie banner examples regulators flagged

Each of these is described from the decision itself, by what the banner did.

One big button and a small grey link

The first screen has a bright Accept button. The way to refuse is a line of grey text under a paragraph, or a Settings button that leads somewhere with a second Accept. In December 2024 the CNIL sent formal notices to several website publishers over exactly this. It described reject options whose colour, size and style were far less prominent than accept, reject links buried next to other text, and accept wording repeated several times while reject appeared once in unclear terms. Its notice on dark patterns in cookie banners put it in one line: rejecting cookies should be just as easy as accepting them.

The ICO took the same view a year earlier. Its letter of 15 November 2023 to the top 100 UK sites described a banner with a button for immediate consent but no similar means to refuse in one click, and said consent given through it could not be regarded as freely given, because the banner failed to provide an equally prominent Reject All or an equivalent option.

Then the CNIL’s Google case. On 1 September 2025 it fined Google LLC and Google Ireland Limited €325 million in total, finding among other things that when users created an account it was more difficult to refuse cookies linked to personalised advertising than to accept them. Google had added an equal refuse button in October 2023; the CNIL still found the earlier consent invalid.

Pre-ticked boxes

Tap Settings and every switch is already on. This one has been settled since 2019. In Planet49 the Court of Justice ruled that consent to cookies is not validly constituted by way of a pre-checked checkbox which the user must deselect to refuse. The EU taskforce confirmed in 2023 that pre-ticked boxes do not lead to valid consent under either the GDPR or the ePrivacy rule.

It still turns up. In October 2024 the Italian Garante reprimanded the operator of sottoilcavolo.com over a banner whose only button was Save and close, above six pre-ticked boxes for a sharing widget, Facebook, Google Analytics, Google Maps, YouTube and a chat tool. In 2022 the Belgian authority fined Roularta €50,000 over its news sites, where about sixty non-essential cookies were placed before consent and the boxes for third-party partners came pre-ticked.

“By continuing to browse, you accept”

The banner has no real button, or one button, and the text says scrolling or closing it counts as a yes. The EDPB’s consent guidelines are blunt: scrolling or swiping through a page will not under any circumstances satisfy the requirement of a clear and affirmative action. The ICO says silence or inactivity doesn’t qualify and gives “by continuing to use our website, you consent” as its bad-practice example.

The Garante’s November 2024 decision on miliashop.com describes the purest version: a banner in English only, reading “If you do nothing, we’ll assume that’s ok”, with a single button, “Oh, I don’t mind using cookies”, no X and no reject. The company reworked the banner during the proceedings and received a reprimand.

No way to say no

Accept, Customise, More info. No Reject, no X. The visitor can read the page only by picking one of the three. The EU taskforce reported that a vast majority of authorities considered a banner with no refuse option on any layer that carries a consent button to be out of line with valid consent.

The Garante’s October 2024 decision on Onlinestore S.r.l. describes that exact first screen. Under Customise, the advertising and profiling option came pre-selected, and the browser held 22 cookies whether that option was on or off. The company took the site offline and received a reprimand.

Cookie walls and other ways of boxing the visitor in

Three more patterns, each about leaving the visitor no real exit.

The banner that comes back

Close it with the X and it reappears on the next visit, and the one after that, until you tap Accept. In June 2025 the Garante found that on confalonieriauto.it the banner came back on every later visit after the X, while Accept all made it go away. It said this could influence the visitor’s will, and ordered the banner reconfigured.

Legitimate interest toggles

The settings screen has two columns: Consent and Legitimate interest. The consent switches are off. The legitimate interest switches are on, for things like “select personalised ads”. The EU taskforce said this layout could be confusing for users who might think they have to refuse twice, and confirmed that the legal basis for placing or reading cookies cannot be the controller’s legitimate interests. The ICO’s guidance shows the same screen, with legitimate interest toggles switched on by default beside consent toggles, as a bad-practice example.

The cookie wall

The page is blank or blurred until the visitor taps Accept. The EDPB’s guidelines give it as Example 6a: a script blocks content except for a request to accept cookies, and since the visitor is not presented with a genuine choice, consent is not freely given. The ICO’s consent or pay guidance, published on 23 January 2025, says a take-it-or-leave-it approach does not comply in most cases. It treats a paid alternative differently, and judges it on power imbalance, the fee, whether the two versions of the service are equivalent, and whether the choice is presented equally. That page notes it is under review after the 2025 Act.

Cookie banner best practices, as the regulators put them

If you’ve read the cases above you’ve met every item already. This is the version to paste into a ticket:

• A positive action before anything non-essential loads. Scrolling, closing and silence are not actions.
• A refuse option on the first screen, as easy as accept. The ICO’s example is an equally prominent Reject All.
• No pre-ticked boxes, and no legitimate interest switches doing the job of a pre-ticked box.
• A reject button that actually stops the cookies. The ICO’s 2023 letter also described sites that placed advertising cookies despite the user opting to reject all. The CNIL’s 2021 round of formal notices included banners where the refuse button existed but consent-requiring cookies were still placed.
• A way to withdraw that is as easy as the way in.
• Words that say who else gets data and for how long.

The ICO adds one timing note: it recommends six months as a suitable timeframe before asking again, and says not to prompt people repeatedly as a matter of course.

Check your own banner on a phone

Open your site in a private tab and work through this list. No tool, five minutes.

1. Count the taps to accept everything. Then count the taps to refuse everything. Write both numbers down.
2. Look at the first screen. Is Reject a button of the same size as Accept, in the same row? Or is it a text link, a smaller button, or missing?
3. Tap Settings. Is every non-essential switch off? Is there a second column of switches labelled legitimate interest, and are those on?
4. Close the banner with the X, or scroll past it. Read the banner text: does it say that counts as a yes?
5. Open the site again in a fresh private tab. Does the banner come back after you closed it without choosing?
6. Can you read the page without choosing? If it’s blank or blurred until you tap Accept, that’s a wall.
7. Scroll to the footer. Is there a link to reopen the settings?
8. Read the words on the banner. Do they say who else receives data and how long the cookies last?

If the tap counts in step 1 differ, start there. The rest usually follows.

A banner that passes this list still has to be wired to the tags, which is a separate check. How to check website cookies covers that with three visits on a phone. For the categories behind the switches, see types of website cookies, and for the same nudges outside the banner, dark patterns examples.

Peeky reads the public pages of your site. For the banner’s buttons and the taps to refuse, the checks are EU-03 and UK-02 in the Handbook, and UK-03 for content held back until you accept.

Questions people ask

What is a cookie consent banner?

It's the notice a site shows before it stores or reads anything on a visitor's device that isn't needed to run the page, with a way to say yes and a way to say no. The ICO's guidance expects a positive action to opt in, and says silence or inactivity doesn't qualify. A site that only uses cookies the visitor needs doesn't have to show one.

Can you give me an example of opt-in consent?

Two buttons of the same size on the first screen, Accept all and Reject all, with every non-essential category switched off until the visitor taps Accept. The Court of Justice ruled in 2019 that a pre-ticked box the visitor has to untick is not consent, and that joining a prize draw isn't consent to cookies either.

Do the accept and reject buttons have to look the same?

No regulator has set a colour or size standard. The EU authorities' cookie banner taskforce said banners are judged case by case, and gave one example that is plainly misleading: a reject button whose text contrast is so low that nobody can read it. The ICO's letters to UK sites ask for an equally prominent Reject All or an equivalent.

Are cookie walls allowed?

The EDPB's consent guidelines say access to a service must not be made conditional on consent to storing or reading information on the device. The ICO says a take-it-or-leave-it approach does not meet the freely given test in most cases, and that consent or pay models are not prohibited if they meet its conditions.

Can I rely on legitimate interest instead of a cookie banner?

Not for placing or reading the cookies. The EU taskforce confirmed that the legal basis for that step cannot be the legitimate interests of the controller. The ICO's checklist lists mechanisms that incorrectly use legitimate interests as a lawful basis among its bad-practice examples.