Skip to main content

GDPR and ePrivacy (EU, EEA and UK)

Not legal advice

The law as we understand it on 5 November 2026. See the overview for what these pages are and are not.

What the law asks​

European Union and EEA​

Storing or reading anything on a visitor's device — cookies, local storage, pixels, tracking links — needs consent first under Article 5(3) of the ePrivacy Directive, unless it is strictly necessary for a service the visitor asked for. This applies whether or not the information is personal data. What you do with the data afterwards falls under the GDPR. EU law has no analytics exemption today.

Consent is valid only when it is freely given, specific, informed and unambiguous, given by a clear act (GDPR Articles 4(11) and 7). The European Data Protection Board and the national authorities read that as:

  • No pre-ticked boxes, and scrolling or carrying on browsing is not consent.
  • No cookie wall: access to the site cannot depend on accepting.
  • Reject on the first layer. Most authorities treat a first layer with an accept button but no reject option as an infringement (EDPB cookie banner taskforce, January 2023). A reject "link" hidden in the text does not count.
  • No misleading design: colours and contrast are judged case by case; an obviously misleading contrast is an infringement.
  • Withdrawal as easy as consent, at any time — for example a button that stays on every page.
  • Proof: you must be able to show that consent was given (Article 7(1)).
  • "Strictly necessary" must be justified for each cookie you put there; legitimate interest cannot replace consent for setting the cookie.

There is no fixed period for asking again; the EDPB suggests refreshing consent at appropriate intervals.

Authorities do enforce this: on 1 September 2025 the French CNIL fined Google €325 million and Shein €150 million over cookies set without valid consent.

United Kingdom​

The UK GDPR and the Privacy and Electronic Communications Regulations (PECR, regulation 6) ask for consent too, with exceptions that the Data (Use and Access) Act 2025 widened from 5 February 2026:

  • Strictly necessary, now with examples: security, fraud prevention, authentication, remembering the visitor's choices on the site.
  • Statistics: collecting statistics about how your site is used in order to improve it — only when that is the sole purpose, the visitor gets clear information and a simple, free way to object, and has not objected.
  • Appearance and functionality: adapting the site to the visitor's preferences, on the same conditions.
  • Emergency assistance.

The Information Commissioner's Office says none of the exceptions covers advertising, including ad measurement and frequency capping. Fines under PECR rose to £17.5 million or 4% of worldwide turnover.

What may change​

The European Commission's Digital Omnibus proposal (November 2025) would add consent-free purposes such as aggregated audience measurement and a waiting period before asking again after a refusal. On 21 October 2026 the Council agreed its position; the European Parliament has not. Nothing has changed in the law yet.

How ConnectWiz handles it​

The ruleIn ConnectWiz
Consent before anything non-essentialEvery signal is denied before the visitor chooses, set in the first lines of the page. The EU/EEA, the UK and Switzerland cannot be opened by a region rule.
No pre-ticked boxes, no cookie wallEvery box starts empty; the banner never covers or blocks the page.
Reject on the first layer, equal designAccept all, Reject all and Preferences are drawn exactly alike, whatever the appearance template.
Withdrawal as easy as consentThe cookie button stays on every page; withdrawing deletes the known cookies of that category.
ProofEvery choice is recorded, kept 13 months by default (12–120).
Specific, informedOne row per category with its purpose, providers, the countries data may go to and each cookie.
Asking againAfter a yes 1–12 months, after Reject all 6–12 months — never sooner, so a refusal is not asked away.
Embedded contentYouTube, Maps and social embeds can wait behind a placeholder until their category is allowed.

The UK's new statistics and appearance exceptions are not used: analytics stays off in the UK until the visitor accepts it. That is stricter than the law now requires, and it never needs an objection mechanism of its own.

What you still need to do​

  • List every cookie your site sets, including your own, in the banner's cookie list — run a scan and add what it finds. Put the live cookie declaration on your cookie policy page.
  • Write your privacy notice and cookie policy, and link the policy from the banner (Texts → cookie policy address).
  • Load tags only through consent: tags that start before the consent code ignore it — see Pixels that start before consent.
  • Name ConnectWiz as a processor in your privacy notice, and sign the data processing agreement.

Sources​