# EU Cookie Consent: GDPR & ePrivacy Compliant Banners

> Serve GDPR and ePrivacy-compliant cookie consent across the EU and EEA with prior opt-in, an equally prominent Reject all, granular purposes and audit-ready logs.

Canonical page: https://cookiechimp.com/eu-gdpr

> This page describes how CookieChimp is configured for EU visitors. It is not legal
> advice.

## What EU law expects

Article 5(3) of the ePrivacy Directive requires prior consent for non-essential
cookies; the GDPR sets the standard for what valid consent looks like.

- **Prior consent.** Non-essential cookies and trackers stay blocked until the visitor
  agrees. Only strictly necessary, security and load-balancing cookies are exempt.
- **Reject as easy as Accept.** "Reject all" sits on the first layer with the same
  prominence as "Accept all" — no buried or greyed-out decline.
- **Granular purposes.** Visitors control cookies purpose by purpose, with nothing
  pre-ticked and no dark patterns nudging them to accept.
- **Withdraw anytime.** A persistent floating icon or footer link lets visitors change
  or withdraw consent as easily as they gave it.
- **Proof of consent.** Every choice is logged with a timestamp, the purposes chosen,
  the policy version and the consent UI version — exportable on request.
- **In their language.** Consent information is shown in the visitor's language across
  the EU, with automatic translations on paid plans.

## How it works

1. Detect the visitor.
2. Show a compliant banner.
3. Capture granular choices.
4. Log and prove consent.

## What CookieChimp provides

- **EU & EEA targeting** — serve one banner across all 27 EU and 3 EEA states, or
  tailor it per country.
- **Prior blocking** — keep non-essential cookies blocked until the visitor consents.
- **Equal Reject/Accept** — give "Reject all" the same prominence as "Accept all" on
  the first layer.
- **Granular purposes** — let visitors consent purpose by purpose, with nothing
  pre-ticked.
- **Automatic translation** — show each visitor a banner in their language, translated
  automatically on paid plans.
- **Audit-ready records** — export consent choices, policy version and UI version as
  CSV for any DPA.
- **Signals to your stack** — forward consent to Google Consent Mode, Meta and
  Microsoft.
- **Persistent withdrawal** — let visitors change or withdraw consent at any time from
  a floating control.

## FAQ

**Do I need consent for cookies under EU law?**
Yes. Article 5(3) of the ePrivacy Directive requires prior consent before storing or
reading non-essential cookies or similar technologies. Only strictly necessary cookies
— plus narrow exemptions like security and load balancing — can run without consent,
and the GDPR governs the personal data behind them.

**Does the banner need a "Reject all" button?**
Yes. EU regulators and the EDPB's guidance on deceptive design expect "Reject all" to
be as easy and prominent as "Accept all", usually on the first layer. CookieChimp gives
reject and accept equal prominence.

**Are cookie walls allowed in the EU?**
They're restricted. Making access conditional on accepting tracking is generally
non-compliant unless an equivalent service is offered without the tracking.

**What counts as valid consent?**
Consent must be freely given, specific, informed and unambiguous — a clear affirmative
action. No pre-ticked boxes, no bundling, and purposes presented granularly so visitors
can accept some and reject others.

**How long should consent last, and when do I re-ask?**
Common practice is to refresh consent periodically — many sites use around six months —
and to re-ask when a new purpose is added or a material change is made. CookieChimp
lets you configure the consent lifespan and trigger re-consent.

**Do I have to translate the banner?**
Information should be provided in the visitor's language across the EU. On paid plans
CookieChimp translates the banner automatically and serves each visitor their language
by page or browser detection, falling back to the account default.

**Does this cover the EEA too, not just the EU?**
Yes. The same approach applies across the EEA — Iceland, Liechtenstein and Norway — so
all 27 EU and 3 EEA countries can be targeted from one account.

## Related pages

- Full page: https://cookiechimp.com/eu-gdpr
- UK GDPR: https://cookiechimp.com/uk-gdpr.md
- Consent banners: https://cookiechimp.com/features/consent-banners.md
- Index of all markdown pages: https://cookiechimp.com/llms.txt