GDPR and CCPA cookie banner checklist
A practical checklist for a compliant cookie consent banner under GDPR, the ePrivacy Directive, UK GDPR and CCPA/CPRA — and how to meet each point with Consentful.
Updated · By Mihir Vaghani, founder of The Plugins Company
Do you need a cookie banner? If your site uses non-essential cookies or trackers — analytics, ads, pixels, chat or video embeds that track — and has visitors from the EU, UK or other regulated regions, yes. Strictly necessary cookies (login, cart, security) don't need consent.
This checklist is practical guidance, not legal advice. Laws differ by country; ask a lawyer about your situation.
GDPR and ePrivacy (EU/EEA, UK)
| Requirement | With Consentful |
|---|---|
| Ask before setting non-essential cookies | Opt-in model (default) + script blocking |
| Refusing is as easy as accepting | Reject all shown next to Accept all (default) |
| No pre-ticked boxes | Optional categories default off |
| Granular choice by purpose | Categories and preference center |
| Clear information and a policy link | Editable wording + privacy policy link; policy generator |
| Easy to withdraw consent later | Floating preferences button |
| Prove consent was given | Consent receipts |
| Ask again after policy changes | Re-consent version |
| Google Consent Mode v2 for Google Ads in the EEA | On by default |
CCPA / CPRA (California)
| Requirement | With Consentful |
|---|---|
| Let people opt out of "sale" or "sharing" | Opt-out or Auto model; Reject all |
| Honor Global Privacy Control | Respect GPC (on by default) opts out of advertising |
| Tell people what you collect | Wording + policy link |
Other laws
Brazil (LGPD), Canada (PIPEDA/Law 25), Switzerland (nFADP) and several US states have similar rules. The Auto consent model plus showing the banner Everywhere is the simplest way to cover all of them with one setup.
Sources
- General Data Protection Regulation (EU) 2016/679
- European Data Protection Board: Guidelines 05/2020 on consent
- UK ICO: Cookies and similar technologies
- California Attorney General: California Consumer Privacy Act (CCPA)
- Global Privacy Control
This checklist is general information, not legal advice.