An honest cookie banner: consent that matches what you set

A banner that is not a choice costs you what you thought you had bought: a consent you can defend. Cookie rules in Denmark — the order that implements ePrivacy — require a valid yes before you set or read anything that is not strictly necessary for the service the user asked for. Valid means free, specific, informed. A huge 'Accept all' and a grey 'Settings' three clicks down is the opposite. You have a design problem you call compliance.

Teams buy the wrong finished pack. They drop in a CMP because it looks like what other sites have, and think the work is done. The work is knowing your tags, letting no turn them off, and letting the buttons be honest. Without that the CMP is a layer on top of the same leak. The GDPR post is the map of the streams. Here is the UI that has to hold the map.

It is also a trust and SEO question, not only a legal one. A cookie wall that blocks the article is a bad way to ask for yes — and a bad way to let Google read the page. A banner that shoves LCP because it fetches a heavy vendor script before first paint is a performance problem you have called 'necessary'. The banner may be there. It must not be the thing that kills the site, or the only thing you have done.

We write this because 'cookie banner' has become a product you install before you have a sentence about what may run on no. An honest banner is boring: two buttons, few categories, scripts that wait, and a network tab you dare show a supervisor. Without that sentence you have an overlay. You do not have consent.

An honest cookie banner is three things on one screen: you say what you want to set, you let the user say yes or no without a hunt, and you keep the promise afterwards. Reject and accept sit next to each other. 'Customise' is allowed as a third — it must not be the only path to no. When the choice is given, you remember it, and you fire only what got a yes.

It is not the GDPR map. The map is the policy, the cookie list and the network — we have written that elsewhere. The banner is the control that must match the map. If the control is pretty and the map is a leak, you have a theatre banner. If the map is honest and the control hides no, you have theatre consent. You need both. This post is only the control.

It is also not your measurement. First-party analytics after consent is what you do with a yes, or how you measure without cookies. The banner must not be where you 'solve' analytics by calling everything necessary, or by turning on Consent Mode and letting the call go anyway. If measurement needs a yes, wait. If it can run without cookies, let it run without lying in the banner.

And it is not a cookie wall. Blocking the content behind accept is not a free choice. The user came to read or to buy. You may ask for yes to statistics. You may not hold the page hostage. Necessary cookies for the cart and login may be set because the service otherwise does not work. The rest waits. If you cannot show the page without ten tags, the problem is the tags — not that the user said no.

The first failure is the buttons. Accept is large. Reject is 'Settings', then 'Turn everything off', then 'Save'. Three clicks to no, one to yes. That is a dark pattern, even when the legal text in the footer is fine. Put the two choices on the first screen. Customise may come along. It must not be the trap.

The second failure is that scripts do not wait. The banner renders. GTM is already in `<head>`. Facebook, LinkedIn, a heatmap, a chat — they run on pageview, 'because the container is set up that way'. The CMP has a callback you never hung tags on. Then the banner is a layer. The test is the network before a click, and the network after no. Both should be boring, except what you have called necessary.

The third failure is that the CMP itself is the tracker. Some consent products set their own cookies, call home, or show 'partners' in a catalogue you have never read. The banner must be able to explain itself. If the vendor requires a yes in order to show the banner, you have bought the wrong vendor. Necessary is remembering the choice. It is not profiling the person who has not chosen yet.

The fourth failure is categories that do not match tags. The banner says 'statistics and marketing'. In GTM sit ten tags, three of which are chat, session replay and an A/B tool you stuffed into 'statistics'. The user said yes to one thing. You turned on another. Map tag to category, or cut the categories to what you actually have. A lie in the UI is still a lie when it is set in a CMP.

A CMP can be right when you have many tags and several sites, and you want one place to turn things off. It is wrong when you buy it to avoid knowing your calls. Read what the vendor itself sets. Turn their 'partners' off if you do not have them. If the CMP cannot show reject beside accept without an enterprise flag, you have the wrong product — or you have configured theatre. A small custom banner on a site with three tags is often more honest than a catalogue you do not maintain.

A WordPress site typically dies in the plugin layer. A cache plugin, a 'performance' plugin, a chat plugin, a pixel plugin that writes in `head` without asking the CMP. The banner can be pretty, and the theme still fires. Inventory with a cache bypass and a cold browser. If you cannot point at the filter that stops the script, you have not gated. You have installed.

A Next.js site typically dies in someone putting GA or a chat widget in `layout.tsx` 'temporarily', or in a tag-manager container sitting in root because a campaign had to go live yesterday. The App Router makes it easy to load something globally. It also makes it easy to load it before the choice. Keep vendor scripts out of root. Load them in a component that reads consent. Preview deploys are a good place to show a colleague the network tab after no — before it reaches prod.

If you already have the GDPR map and first-party measurement in place, and the banner still feels like the weak link, that is because it is. A map without buttons is a PDF. Measurement without an honest no is a hope. The banner is what the user sees. It has to be able to carry the other two.