How it can be done fairly.

Features / Web

Cookie banner

Only three laws, but the most fines. What matters is not how the banner looks, but what the browser sends over the network before anyone clicks.

Laws
3 laws
Platforms
Web
Updated
Status
Draft, awaiting review by the attorney

What to solve

  • Analytics, advertising and embedded services may only start after consent. Without it only what the site cannot work without may run, like the cart or sign-in.

    • List what the site stores and calls
    • Really do not run the rest, do not just hide it
    • On withdrawal stop the scripts and delete their cookies

    Into UX: The check does not start in the design but in the Network tab of the developer tools.

    Where it comes from

    ePrivacy Directive 2002/58/EC, Art. 5(3) ePrivacy Directive (s. 89(3) of the Czech Electronic Communications Act)

    You may store anything on the user’s device or read it from there without consent only when it is strictly necessary for the service the person asked for. Analytics, advertising and most embedded services are not. Czechia has required prior consent since 1 January 2022.

    EU directive · Text · All features under this law · In Czechia: Czech Electronic Communications Act No. 127/2005 Coll. (s. 89(3), cookies) and Act No. 480/2004 Coll. (s. 7, commercial communications)

  • Consent only counts when it is given freely and knowingly. A pre-ticked box or “by continuing you agree” is not consent.

    • Reject all right in the banner, as visible as accept
    • Separate purposes, not one consent for everything
    • A link to change the choice on every page

    Into UX: Two buttons of the same size. Settings is a third, smaller option.

    Where it comes from

    General Data Protection Regulation (EU) 2016/679, Art. 4(11), Art. 7 and the Planet49 judgment (C-673/17)

    Consent must be freely given, specific, informed and unambiguous. A pre-ticked box or carrying on browsing is not consent, and withdrawing it must be as easy as giving it.

    EU regulation · Text · All features under this law · In Czechia: Czech Act No. 110/2019 Coll., on the processing of personal data

  • The banner is the first thing people operate. If it does not work with a keyboard or a screen reader, it blocks the whole site.

    • Focus starts in the banner
    • Buttons with readable names and contrast
    Where it comes from

    European Accessibility Act, Directive (EU) 2019/882, European Accessibility Act

    The banner is the first thing people operate on a website. On an online shop and other services covered by the act it must work with a keyboard and a screen reader, otherwise it blocks the whole site.

    EU directive · Text · All features under this law · In Czechia: Czech Act No. 424/2023 Coll., on accessibility requirements for certain products and services

What the problem is

European authorities do not fine ugly banners. They fine websites that send data to advertising and analytics services before people consent, or even after they refuse.

How to design it

Two equal buttons, “Reject all” and “Accept all”, and a third option, “Customise”. The text says what the data is for. After the choice a link stays in the corner or the footer to change it.

In the code

Third-party scripts are added to the page only after consent. Withdrawal stops them and deletes their cookies without a reload. An automated test loads the page in a clean browser and fails when a request goes to an analytics or advertising domain.

Before you ship it

  • In a private window, without a click, nothing goes to analytics or advertising domains.
  • Rejecting works right in the banner.
  • After rejecting nothing starts, not even on the next page.
  • The choice can be changed at any time.

More features

Features
Toadvokat@navratilkarel.com