The cookie you can't refuse

One thing that comes up constantly in client conversations is the cookie consent banner. Here’s a tidbit that gets a surprised reaction nearly every time; one for the “did you know?” pile.

Most banners will give you a list of cookie categories, usually with titles like “analytics” or “marketing” which you can toggle on or off (they should be off by default). But there’s almost always one with a switch you can’t toggle off: “necessary” cookies.

Strictly necessary cookies, the ones the site won’t run without, like remembering you’re logged in or what’s in your shopping cart, are exempt from consent under EU tracking law. No need for your permission here. But also no need to put them in the consent banner either.

So, when a site shows you a toggle you can't flip, one of two things is true: either they've relabelled tracking as "necessary" to dodge the law, or the toggle is just theatre.

And here’s another common violation: when you reject all cookies, most consent banners set a cookie to remember you’ve refused. They've stored data on your device without consent, to prove you didn't give your consent – a GDPR ouroboros.

It’s a mess, mostly a deliberately confusing one.

Colin