Cookie Banner Examples for the GDPR, CPRA, and More

Sure, data privacy regulations say you need to inform website visitors about any data collection activities you perform. You know that the most significant tracking technologies on your website are cookies, so you need to show website visitors a cookie banner. 

But what does that cookie banner actually need to do? What does it actually need to look like?  

Well, here’s an example: 

It’s a great example of how to get on the fast track to receiving a painful GDPR fine. But unless you’re a masochist, it’s more of an example of what not to do.  

Websites must obtain user consent to opt into or out of the collection and processing of their personal data, and a well-crafted cookie banner is a vital tool in meeting this compliance requirement. In this article, we will delve into different data privacy regulations’ requirements for things like: 

• Cookie banner text 
• Cookie banner design 
• Cookie banner functionality 
• And more 

Throughout, we’ll provide you with some cookie banner examples that align with the requirements of the GDPR, CCPA/CPRA, and other data privacy laws, as well as cookie banner examples that you might see on various content management systems (CMSs). 

The Different Types of Cookie Banners and Consent 

There are three primary types of cookie banners: notice-only, opt-in, and opt-out. While there are variations within each type, these broadly represent the general approaches to obtaining user consent for the use of cookies on a website. We’ll give examples of each of these later on, but for now, we just want to cover the kind of cookie banner text, information, and functionality you can expect to see on these variations. 

1. Notice-Only Cookie Banners

   A notice-only cookie banner, also known as an information-only banner, is a minimalistic approach that simply informs users about the website's use of cookies. It typically displays a brief message or notification at the bottom or top of the webpage, alerting visitors to the presence of cookies and providing a link to the website's cookie policy. This type of banner does not seek explicit consent from users to place cookies on their devices but serves as a disclosure mechanism. While notice-only banners may be used in certain jurisdictions, they may not fully comply with the stricter requirements of modern data privacy laws. They don’t live up to the GDPR’s standards, for example. You can use them under the CPRA, but you’ll also need certain links on your homepage to be compliant (more on that later.)

2. Opt-In Cookie Banners

   An opt-in cookie banner requires users to actively provide consent for the use of cookies. When users visit a website with an opt-in banner, they are presented with a clear message that explains the purpose of the cookies and their implications. Users are given the option to either accept or decline the use of cookies through an affirmative action, such as clicking an "Accept" or "Allow" button. Opt-in banners prioritize user control and align with the GDPR's principles of privacy by default. They require explicit consent from users before any cookies are placed on their devices.

3. Opt-Out Cookie Banners

   In contrast to opt-in banners, opt-out cookie banners work on the premise that users are presumed to have given their consent unless they actively choose to opt out. These banners display a message that informs users about the website's use of cookies and provides them with the ability to manage their cookie preferences. This is key—if the user hasn’t been informed about the use of cookies and isn’t given a clear way to opt out, it’s not a compliant opt-out banner. Often, cookie banners that comply with U.S. privacy laws take an opt-out approach. 

GDPR Cookie Banner Examples 

The GDPR doesn’t explicitly mention cookies, but it does have several requirements for consenting to data processing and collection. The most important thing for website owners to know is how the GDPR defines “consent”: 

“Consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her. 

So, a GDPR-compliant cookie banner must: 

• Not coerce or manipulate the user into giving consent—consent must be freely given. 
• Clearly describe what kind of data your website will collect upon consent and what the implications of giving consent are—that is, consent must be specific, informed, and unambiguous. 
• Prevent data collection from happening unless the user gives their consent first through an affirmative action—like clicking “agree.” That’s what makes GDPR banners opt-in. 

Furthermore, because different cookies can be used for different purposes (such as marketing, analytics, and personalization), the GDPR requires that you give users granular control over the types of cookies they consent to or not. A user might be comfortable with analytics cookies that merely help diagnose site performance, but don’t want cookies used for marketing purposes. 

An example cookie banner that meets these requirements looks like this:  

Specifically, this cookie banner complies with the French Data Protection Authority’s (DPA’s) requirements for GDPR compliance. As you can see, it:  

• Clearly describes what it means to consent.  
• What you would be consenting to. 
• What the cookies will be used for. 
• Links to a privacy policy. 
• Allows users to select which categories of cookies they consent to. 
• Allows users to reject cookies outright.  

Here’s another GDPR-compliant banner from France in the original French: 

Note that both of these banners are compliant with the French DPA’s GDPR guidance even though they look a little different—one is vertically aligned and would appear on the side of the screen while the other is horizontally aligned and would appear at the top; their color scheme is different; and the language they use is different. 

If you were to cater to French citizens, you would obviously default to using the French language. But your cookie banner ought to adjust to the language preferences set by the individual user in their browser—that ensures the user is truly informed (as required by the GDPR). 

The GDPR permits you to use different color schemes, styling, and placement of your cookie banner. But remember: Consent must be freely given through an affirmative action. So, certain design practices that manipulate users into giving consent are forbidden by the GDPR. If you were color the “Continue Without Accepting” button the same shade as the background and thereby make the “Accept All” button easier to click, that would constitute a violation of the GDPR. Similarly, if your banner were incredibly small and appeared in a tiny corner of the screen, that would also violate the law. 

One last important point to note about GDPR cookie banner examples: You may have noticed we referred to the French DPA’s interpretation of the GDPR above. Each member state in the EU has its own DPA, and each DPA has its own interpretation of the GDPR. That means each GDRP jurisdiction may require its own banner. 

For example, take a look at this example of a GDPR-compliant banner that would display in Spain (again, translated into English):  

Rather than require a user to click a “Customize Your Choices” button as was the case with the French banner, the Spanish banner provides those choices right up front. The cookie banner’s text is also different—these are all individual differences determined by the given jurisdiction’s DPA.  

Obviously, this makes providing a GDPR-compliant banner really difficult. To deploy a homegrown cookie consent banner solution, you’d have to research every DPA’s interpretation of the GDPR and translate that interpretation into a compliant design.  

That’s not to mention the difficulty of actually operationalizing all of this! Getting a GDPR-compliant cookie banner isn’t just about finding the right examples of cookie banner text; the banner has to actually do what it says it will. Remember the fake banner we showed at the start of this article? If you click on Agree or Reject, the banner actually has to allow or block cookies, respectively, as soon as the user makes their preference clear. 

CCPA/CPRA Cookie Consent Banner Examples 

Like the GDPR, your cookie banner’s design will depend on how the CPRA’s specific requirements around consent and data collection. Here’s a lightly edited passage on what the CPRA has to say about cookie consent: 

A business that sells or shares consumers’ personal information or uses or discloses consumers’ sensitive personal information […] shall: 

• Provide a clear and conspicuous link on the business’s internet homepages, titled “Do Not Sell or Share My Personal Information,” to an internet web page that enables a consumer […] to opt-out of the sale or sharing of the consumer’s personal information. 
• Provide a clear and conspicuous link on the business’s internet homepages, titled “Limit the Use of My Sensitive Personal Information,” that enables a consumer [...] to limit the use or disclosure of the consumer’s sensitive personal information.
  

We cleaned up the text a little bit for clarity and ease of reading (surprisingly, legal texts can be a bit convoluted), but if you want to take a look at the original, the relevant passage in the CPRA is Section 1798.135. 

However, you’ll notice that this section of the CPRA doesn’t mention anything about banners—the CPRA actually doesn’t require businesses to include links titled “Do not Sell or Share My Personal Information” or “Limit the Use of My Sensitive Personal Information” on their banner; merely that they appear on the “business’s internet homepages.”  

Thus, a CPRA-compliant cookie consent banner might look like this: 

This banner conforms with the CPRA’s requirements on providing notice, as stated in Section 1798.100: “A business that controls the collection of a consumer’s personal information shall, at or before the point of collection, inform consumers [regarding the personal information to be collected].” It provides a link to a cookie policy, which contains further information required for CPRA compliance. 

To be compliant, a business would also need to include the links mentioned above somewhere on their website homepage, usually in the footer. When clicking on these links, consumers should be able to trigger a data subject access request (DSAR) that allows them to exercise their right to opt out. The thing about DSARs, however, is that they can take some time and effort to execute, which can irk some consumers and creates additional risk. That’s why it can be a good idea to default to a higher standard of consent. 

For example, the following is an example of a CPRA-compliant cookie consent banner that relies on opt-in consent; you won’t collect any personal information from consumers unless they click “Accept” first.  

Both of these banners comply with the CPRA—just note that you still need links titled “Do Not Sell or Share My Personal Information” or “Limit the Use of My Sensitive Personal Information” on your homepage. 

What About WordPress, HubSpot, and other CMS Cookie Banners?

If you use a software tool to manage your website like a content management system (CMS), they’ll often provide some sort of cookie banner functionality. The following is an example of a cookie banner provided by HubSpot CMS.  

With HubSpot and similar tools, you can customize your cookie banner to notify visitors about the use of cookies, require opt-in, display cookies by category, and deliver the bulk of the design elements required by different privacy laws across the world. 

However, you need to manually create these cookie banners for each jurisdiction, putting the burden of compliance on you. The alternative is to build one cookie banner that follows the strictest consent requirements, but then you wind up losing a lot of business intelligence when visitors fail to opt in—even when they live in a jurisdiction that requires opt-out consent or a jurisdiction with no relevant regulation. 

When a CMS offers a cookie banner functionality, it can only find and block cookies that it drops or that it has dropped on its behalf via integrations. If you have manually added scripts to your website or use third-party scripts, CMSs won’t be able to detect or block them accordingly. As a business grows, more and more of these scripts tend to accumulate on the website from various stakeholders in marketing, development, and other teams—relying on CMS cookie banners indefinitely can be problematic in that case. 

In essence, CMS cookie banners are good for personal websites and websites owned by small businesses limited to a single jurisdiction with minimal data tracking technologies. Any business that serves customers from multiple jurisdictions or that intends to use a digital channel for growth is better served by using a consent management platform (CMP) to manage cookies instead.  

Consent Management Platforms 

As purpose-built solutions for cookie banners, CMPs address the issues you’ll run into developing a homegrown cookie banner or using a CMS to deliver cookies banners. The specific features vary from CMP to CMP, so we’ll cover how Osano Cookie Consent avoids these issues. Osano Cookie Consent: 

• Automatically identifies cookies and scripts running on your website, including third-party and manually added scripts.  
• Recommends cookie classification categories, so you can comply with laws like the GDPR that give visitors granular control over the cookie categories they consent to. 
• Provides pre-built, customizable cookie banner example templates that comply with various jurisdictions laws. 
• Automatically detects where a user is coming from, so you can serve up the appropriate banner for that specific region (even within the various sub-jurisdictions of the EU). 
• Actually blocks or permits cookies based on the visitors’ consent preference and governing law without requiring technical work on your website’s backend systems and processes. 

CMPs ideally provide you with compliant banners out of the box, but being able to customize banners to match your branding is important too. Osano allows businesses to customize their banners while providing guardrails against excessive customization that could cause a cookier banner to fall out of compliance. 

In fact, the bulk of the compliant banners shown in this article were templates accessible right in the Osano platform.