Cookie Consent Tools

What a cookie banner is and when the law requires one

A cookie banner is the notice shown on a first visit that tells people which trackers the site uses and asks for their consent where consent is needed. In the European Union, the requirement comes from the ePrivacy Directive, implemented country by country, while the GDPR defines what valid consent looks like. National regulators such as France’s CNIL and Spain’s AEPD publish their own cookie guidance on top.

The word cookie undersells the scope. The rule applies to any technology that stores or reads information on the visitor’s device: HTTP cookies, browser local storage, tracking pixels, advertising IDs and fingerprints built from the device configuration. A site that sets no cookies at all but fires an ad network’s conversion pixel still needs a banner.

Strictly necessary trackers are exempt. Login sessions, shopping carts, a saved language setting, load balancing and the cookie that stores the banner answer itself can run without asking. Some audience measurement also qualifies in France, provided it stays anonymous, serves the site alone and never gets combined with other data.

Everything else needs opt-in consent before it loads. That covers advertising whenever trackers measure the ads, whether personalized or not, along with social sharing buttons, videos embedded from third-party platforms and analytics that pass data back to their vendor. An adult site earning money from ad networks almost always falls into this group.

Most US state privacy laws work the other way round. Tracking may start straight away, but visitors must be able to opt out of the sale or sharing of their data, and California requires sites to honor the Global Privacy Control signal sent by the browser. A site with European and American traffic can show the opt-in banner to the first group and an opt-out link to the second.

An age verification gate and a cookie banner answer separate obligations. The gate controls access to the content, the banner governs trackers, and having one does not excuse the site from the other.

What a compliant cookie consent banner has to show

Rejecting must be as easy as accepting. Accept all and Reject all sit on the first layer of the banner with the same size, the same contrast and the same number of clicks. The CNIL has fined large platforms whose reject option took several clicks while accepting took one. Closing the banner with its cross counts as a refusal.

The first layer names the purposes in plain words, such as analytics, advertising, social sharing and embedded video. It links to the list of companies that set trackers, usually through a second screen. That second screen lets visitors decide purpose by purpose, with every box unticked by default.

Consent requires a clear action. Scrolling, clicking elsewhere or carrying on browsing no longer counts as agreement in the EU. Regulators also target dark patterns: a greyed-out reject button, copy that guilt trips the visitor, a slider that is hard to read or a box ticked in advance.

Visitors can change their mind at any time. A permanent link, often in the footer, reopens the preference panel. The site stores the answer, acceptance and refusal alike, so the question does not come back on every page, and asks again after a reasonable period or when the list of trackers changes.

A cookie wall hides the content until the visitor accepts. European regulators assess it case by case and expect a fair alternative, such as paid access without advertising trackers.

How to block trackers before the visitor gives consent

Prior blocking keeps consent-based services from loading until the visitor has answered. While the banner waits, no ad script runs, no pixel fires and no third-party video calls home. A banner that appears while the tags are already running collects a choice it never enforces.

JavaScript consent libraries work from a declared list. Each service goes into the configuration, and its tags stay inert until consent, usually through a changed script type or an iframe source held aside. tarteaucitron.js, an MIT-licensed library from France, ships with a catalog of ready-made services. Adult ad networks are missing from it and have to be added by hand as custom services.

WordPress plugins often add a cookie scanner that crawls the pages and the installed plugins, then hold back the scripts and iframes they recognize. Complianz does this in its free version. A scan records what loads while it runs. A script that an ad network injects after a few seconds, a player that opens on click or an ad that changes with the visitor’s country slips past it.

On adult sites, trackers mostly come from ad network and pop-under tags, players and thumbnails embedded from tube sites, live cam widgets, affiliate program pixels and analytics. Test the setup in a private window with the browser developer tools open. Before any click on the banner, the network tab should show no request to those domains and the storage tab no third-party cookie.

Google Consent Mode passes the visitor’s answer to Google tags, which adjust their behavior, and Google requires it from advertisers who target European users with its ad products. The IAB TCF framework does the same job for programmatic advertising, sending a standard consent string to the companies in the auction. Both signals only reach tags that read them. The banner still has to block the rest.

Choosing a cookie banner tool: library, plugin or CMP

A JavaScript library runs on any site, sits on the site’s own server and is configured in code, which suits tube scripts, static sites and custom platforms. A WordPress plugin is set up from the admin panel and detects common plugins and integrations. A consent management platform, or CMP, is a hosted service that delivers the banner, the scanner, the reports and the consent log from its own servers, usually on a subscription.

Under the GDPR, the site owner has to be able to show that a visitor agreed. A library that keeps the choice in a browser cookie applies the preference but leaves nothing on the server. A consent log records each answer with its date, the banner version and a pseudonymous visitor ID. Several plugins keep that log for their paid tier, and tarteaucitron.js has none at all.

A banner served by a vendor contacts the vendor’s servers on every visit, passing along the visitor’s IP address and the page being viewed. On an adult site that browsing data is personal, and it reaches a third party before the visitor has chosen anything. A library served from the site’s own domain avoids the exchange. Some WordPress plugins also call their developer’s infrastructure for scanning or usage statistics.

Price the tool on the features the site needs: consent log, region-based banners, Google Consent Mode, IAB TCF, the number of domains the license covers and the renewal rate. A free library costs setup time instead, plus a check every time a new script lands on the site.