Building a Compliant Cookie Banner: Principles and Pitfalls to Avoid
A compliant cookie banner must obtain the visitor's prior consent before any non-essential cookie is dropped, offer a refusal option that's just as easy to access as acceptance, and allow consent to be withdrawn at any time. Cookies strictly necessary for the site to function (shopping cart, authentication) are exempt from this consent requirement, but must still be disclosed.
The real problem: banners that work around consent
Most cookie banners found across the web don't genuinely follow the CNIL's recommendations. The most common case: a clearly visible "Accept" button, with refusal tucked behind a discreet link, a second click, or barely legible grey text. This asymmetry is a breach the CNIL has identified and sanctioned on multiple occasions, including against well-known sites. A smaller site is no less exposed to a complaint or an inspection on this point, especially since the violation is immediately visible to any visitor.
The principles set out by the CNIL
The framework governing cookies rests on the ePrivacy Directive as transposed into French law, supplemented by CNIL recommendations. The key points:
- Prior consent: non-essential cookies must only be dropped after explicit consent, never before.
- Free and specific consent: the visitor must be able to choose category by category (for example accepting audience measurement while refusing advertising), not just an all-or-nothing option.
- Refusal as easy as acceptance: both options must be presented at the same visual level, with no differentiated path.
- Clear information: the purpose of each cookie category must be explained in understandable language, not merely listed by a technical name.
- Proof of consent: the site must be able to demonstrate, in the event of an inspection, that consent was properly obtained under the required conditions.
What doesn't require consent
Some cookies are exempt from the prior consent requirement because they're considered strictly necessary for the service to work as expected:
| Category | Example | Consent required |
|---|---|---|
| Technical operation | Shopping cart, login session | No |
| Declared preferences | Language chosen by the user | No, if strictly limited to that use |
| Exempted audience measurement | Anonymised statistics meeting CNIL criteria | No, under precise technical conditions |
| Standard audience measurement | Analytics tools with persistent identifiers | Yes |
| Advertising and social networks | Share buttons, advertising pixels | Yes |
| Third-party content personalisation | Profile-based recommendations | Yes |
Building a compliant banner, step by step
- Block non-essential cookies by default, before any interaction from the visitor with the banner.
- Present two options of equal weight: accept all, refuse all, with easy access to a detailed choice by category.
- Explain each purpose in one understandable sentence, without technical jargon.
- Never pre-tick consent boxes: every category subject to consent must be unticked by default.
- Provide a permanent way to change the choice afterwards, generally via a discreet but accessible link in the footer.
- Keep proof of consent, with its date and exact content, for the retention period chosen.
The technical solutions available
On most modern CMS and website-building tools, cookie management runs through a consent management platform (CMP), either built in or added via a third-party module. These tools generally block third-party scripts before consent, manage granularity by category, and keep a timestamped record. Choosing a recognised module is preferable to a homemade build, which often fails to actually block scripts before consent — the point most commonly missed.
What to remember
- Non-essential cookies must be blocked until consent has been given, not merely shown as "pending".
- Refusal must be just as easy to access as acceptance, at the same visual level.
- Consent must be obtainable category by category, not only as a single block.
- Some strictly configured audience measurement cookies escape the consent requirement, under precise technical conditions set by the CNIL.
- Consent has a limited validity period and must be requested again once it expires.
- Proof of consent must be available in the event of an inspection.
Frequently asked questions
Can visitors keep browsing the site without answering the banner? Yes, browsing remains possible, but non-essential cookies stay inactive until explicit consent has been given.
Does consent need to be requested again on every visit? No, it can be kept for a limited period, generally six months under CNIL recommendations, then requested again.
Do audience measurement cookies always require consent? Not systematically, if they're configured according to the exemption criteria set by the CNIL (no individual tracking across sites). Outside that configuration, consent is still required.
Is a banner with only an "Accept" button legal? No, this practice is explicitly sanctioned by the CNIL. Refusal must be offered with the same ease as acceptance.
In summary
A compliant cookie banner rests on a simple but often bypassed principle: refusal must be just as accessible as acceptance, and nothing may be dropped before explicit consent. This general framework reflects the CNIL's public recommendations; for a precise compliance review of your site, a dedicated audit or the advice of a legal professional is still recommended. Sites delivered by VeryAppi come with cookie management that respects these principles from the moment they go live.
Frequently asked questions
›Can visitors keep browsing the site without answering the banner?
As long as the visitor hasn't given consent, non-essential cookies must not be dropped. Browsing remains possible without answering, but in that case the trackers subject to consent stay inactive until an explicit choice is made.
›Does consent need to be requested again on every visit?
No, consent can be kept on file for a limited period (the CNIL generally recommends a maximum of six months), after which it must be requested again. A refusal must also be remembered for that same period, so the visitor who already declined isn't asked again.
›Do audience measurement cookies always require consent?
Not systematically. The CNIL provides an exemption for audience measurement tools configured so they don't allow individual tracking of a visitor from one site to another, based on precise technical criteria. Outside that exempted configuration, prior consent is still required.
›Is a banner with only an 'Accept' button legal?
No, this practice has been explicitly sanctioned by the CNIL for several years now. Refusal must be offered at the same level and with the same ease as acceptance, with no extra step or discouraging path.