A non-compliant cookie banner is the easiest breach to spot on a shop: open the home page and the browser inspector. It is also one that data protection authorities sanction regularly, with amounts that are anything but symbolic for large platforms.
Here is the checklist, and the mistakes that come up every time.
The five substantive rules
Consent has to be freely given. Refusal must carry no consequence for access to the service, outside the narrow framework of a tracking wall.
Specific. Consent is given per purpose: audience measurement, advertising, social networks, personalisation. A single blanket agreement does not satisfy that requirement.
Informed. The visitor has to know who is setting the trackers, why, and for how long, before choosing.
Unambiguous. It requires a positive act. No pre-ticked boxes, no consent inferred from scrolling, none inferred from continued browsing.
As easy to withdraw as to give. A permanent link has to let visitors revisit their choice at any time.
The eight classic mistakes
- The reject button on a second layer. Accept in one click, reject only after opening a preferences panel. This is the most frequent and most sanctioned breach. Both buttons belong on the same level, on the first screen.
- Refusal visually downgraded. Accept button in a bright colour, reject in light grey or as a plain underlined link. The difference in visual treatment is treated as an obstacle to refusal.
- Setting trackers before the choice. The scripts load with the page, the banner appears afterwards. By then the trackers are already set and the consent serves no purpose. This is the most common technical fault.
- Consent inferred from scrolling. A practice abandoned years ago, and still present on live sites.
- No withdrawal path. No link to revisit the choice, or a link buried in the legal notice.
- Unlimited duration. A consent recorded with no expiry, never renewed.
- Exempt trackers treated like the rest, or the other way round. Blocking the cart cookie until consent breaks the shop; treating an advertising tracker as exempt is an infringement.
- The decorative banner. The bar exists, the choices are recorded, and no script is actually conditioned on them. The mechanism blocks nothing.
DataFirefly Cookie Manager — powered by the open-source tarteaucitron.js engineThe GDPR-compliant cookie banner without giving up measurement.€220.00
What is exempt
Not every tracker requires consent. Those strictly necessary to provide the service the user asked for are exempt.
On a shop, that covers the cart, authentication, the session, the language or currency preference, load balancing, and the cookie that records the consent choice itself.
Audience measurement can also be exempt, under strict conditions: purpose limited to measurement on behalf of the publisher, no cross-referencing with other processing, no tracking across sites or applications, no data passed to third parties, and a limited retention period. A standard configuration of a mainstream analytics tool does not meet those conditions by default.
Proving consent
You have to be able to demonstrate that every consent was validly collected. That means keeping, for each visitor, a timestamped record containing: date and time, the purposes accepted and refused, the version of the banner displayed, and a technical identifier tying the record to the visit.
A point often overlooked: the banner version. If you change your purposes or your partners, earlier consents no longer cover the new scope.
The durations
Three distinct durations, often confused.
The validity period of the consent, after which you have to ask the visitor again. National authorities set their own guidance here, commonly in the range of six to twenty-four months, so check the position of the authority that supervises you.
The lifetime of the trackers set, which should not exceed thirteen months as a widely applied benchmark.
The retention period of the data collected through those trackers, typically capped at twenty-five months.
A practical point: a refusal has to be stored for as long as an acceptance. Asking again on every visit of someone who refused is both unpleasant and treated as a practice designed to obtain consent through fatigue.
Testing your banner in ten minutes
Five checks, in this order.
1. Open the site in a private window with the network tab active. Before any click, look at the outgoing requests and the cookies set. Only exempt trackers should appear.
2. Count the clicks to accept, then to refuse. The number has to be identical.
3. Refuse, then reload and check that no consent-based tracker is present.
4. Look for the withdrawal link. If it takes you more than ten seconds to find it, a visitor will not find it.
5. Check that the scripts of your third-party modules actually go through the blocking mechanism. A chat, map or video module installed after the banner was set up is often forgotten.
The Cookie Manager for PrestaShop puts this in place on PrestaShop 8 and 9: scripts blocked before consent, refusal on the same level as acceptance, management per purpose, timestamped recording of the choices and a permanent withdrawal link.