GDPR cookie consent, explained plainly
In the EU, EEA and UK, non-essential cookies and trackers need a visitor's permission before they run. Here's what valid consent looks like and how Plain Theory gets you there.
- Who
- Any site with visitors in the EU, EEA or UK, wherever the business is based
- Model
- Opt-in: nothing non-essential runs until the visitor agrees
- Laws
- GDPR, UK GDPR and the ePrivacy Directive (national cookie laws)
What the law requires
Ask before anything runs
The ePrivacy rules require consent before storing or reading information on a visitor's device, unless it's strictly necessary for a service they asked for. Analytics, advertising and most third-party embeds are not strictly necessary.
ePrivacy Directive, Art. 5(3)
Consent must be a clear, free choice
Consent has to be freely given, specific, informed and unambiguous, and shown by a clear affirmative action. Pre-ticked boxes, scrolling or carrying on browsing don't count.
GDPR Art. 4(11); CJEU Planet49 (C-673/17)
Rejecting is as easy as accepting
European regulators treat a banner with a prominent Accept button and a hidden or harder Reject path as invalid. The choice to say no must be just as visible and take no more steps.
EDPB Guidelines 05/2020 and 03/2022 on deceptive design
Purposes are explained separately
Visitors should see what each category is for and be able to agree to some and not others. A single take-it-or-leave-it switch for everything isn't specific consent.
GDPR Art. 7(2)
Withdrawal is always available
People must be able to withdraw consent at any time, and withdrawing must be as easy as giving it. In practice that means a persistent way back into the choices.
GDPR Art. 7(3)
You can prove it
The controller has to be able to demonstrate that a person consented: what they were shown, what they chose and when.
GDPR Art. 7(1)
How Plain Theory handles it
Each requirement maps to something the product does by default. Nothing here needs a custom build.
| Requirement | In Plain Theory |
|---|---|
| Prior consent | Trackers are held by the script until the matching category is accepted |
| Clear affirmative action | No pre-ticked categories; opt-in model for EU, EEA and UK visitors |
| Reject as easy as accept | Equal-weight buttons on by default; the builder warns if you turn them off |
| Specific purposes | Per-category switches with plain-language descriptions you can edit |
| Easy withdrawal | A persistent Privacy choices button and PlainConsent.revoke() |
| Records of consent | Hash-chained receipts with notice version, choice and time; CSV and audit report |
Common questions
Do we need consent for analytics?
In most EU countries, yes. Some regulators allow narrowly configured, first-party audience measurement without consent, but standard Google Analytics setups need it. Plain Theory puts analytics in its own category so visitors can decide.
Can we show a 'cookie wall' that blocks the site until people accept?
Generally no. Regulators consider access conditional on consent to trackers not to be freely given. Plain Theory's banner never blocks the page behind it.
How long is consent valid?
GDPR doesn't set a period, but many regulators recommend asking again after six to thirteen months. Plain Theory re-asks after the expiry you set (180 days by default) and whenever you publish a new version of the notice.
Get GDPR-ready this week
Free for your first site. Upgrade when you add more sites or teammates.
No card needed · GDPR, CCPA/CPRA and DPDPA from one script