European Union & United Kingdom

Cookie consent in the EU and UK: GDPR, ePrivacy and PECR

What the GDPR, the ePrivacy Directive and the UK's PECR require from a cookie banner, what regulators check, and how to set up Macaw to meet it.

Last reviewed

What the law requires

Consent before non-essential cookies

Under Article 5(3) of the ePrivacy Directive (and PECR in the UK) you need consent before setting any cookie that is not strictly necessary for the service the visitor asked for. Strictly necessary cookies, such as sign-in or security cookies, are exempt.

What counts as valid consent

  • Freely given, specific, informed and unambiguous, by a clear affirmative act (GDPR Art. 4(11)).
  • Pre-ticked boxes, scrolling or silence are not consent.
  • Rejecting must be as easy as accepting. The EDPB Cookie Banner Taskforce (January 2023) found a first layer with "Accept" but no equivalent "Reject" non-compliant for most authorities, and flagged deceptive button styling.
  • Withdrawing consent must be as easy as giving it (GDPR Art. 7(3)).

You must be able to prove it

The controller must be able to demonstrate that consent was given (GDPR Art. 7(1)): who agreed, when, to what wording and how. At the same time, data minimisation (Art. 5(1)(c)) means you should record what proves the consent, not a browsing profile.

How often to ask again

France's CNIL recommends keeping a visitor's choice, whether a refusal or a consent, for about six months before asking again, and that the trackers themselves last no longer than 13 months.

How to comply with Macaw

  1. Mark your strictly necessary category

    In Cookie Preferences, give your always-on category a key or title containing "essential", "necessary" or "strictly". Macaw shows it as "Always active" and records it as on; every other category starts off.

  2. Load optional tags only after consent

    Do not set analytics or marketing cookies until the visitor has granted that category. Listen for the consent.updated event and load each tag only when its category is true.

    macaw.on('consent.updated', (e) => {
  if (e.data.choices.analytics) loadAnalytics();
  if (e.data.choices.marketing) loadMarketingPixels();
});

  3. Keep Reject all next to Accept all

    The Macaw banner shows Reject all, Save choices and Accept all side by side with equal weight, and no optional category is pre-ticked. Avoid restyling the buttons so one looks more prominent.

  4. Keep proof of every decision

    Macaw stores each Reject all, Save choices and Accept all on its servers with every category's choice, the exact banner wording shown (as a notice version), the time, the page path and a truncated IP. Records are hash-chained, so a changed record is detected. Find one person under Compliance > Consent Records, or export everything as CSV for an audit.

  5. Let people change their mind at any time

    Add a persistent "Cookie settings" link to your site footer that reopens the Macaw banner. Visitors can change or withdraw their choice with the same effort it took to give it, and each change is stored as a new record.

    <a href="#" onclick="macaw.triggerCookie(currentUser && currentUser.id); return false;">
  Cookie settings
</a>

  6. Ask again when you should

    Each decision carries a re-ask date six months out. When you change the banner wording or categories, Macaw publishes a new notice version and treats earlier decisions as no longer current. The public state endpoint (GET /api/v1/consent/state/:spaceId?cid=…) tells you whether a visitor's choice is still current, so you know when to open the banner again.

  7. Accept decisions only from your own sites

    Under Settings, list the domains your space runs on. Macaw then rejects consent writes from any other site.

What Macaw does not do yet

  • Macaw does not choose opt-in or opt-out behaviour by the visitor's country; the banner is opt-in everywhere, which is the stricter EU standard.
  • Consent records are stored where your Macaw instance is hosted. There is no EU-only storage option yet, so cover the transfer in your data processing agreement.

Sources

This guide summarises public regulator guidance and legal commentary to help you configure consent. It is not legal advice. Laws, deadlines and enforcement change; have your counsel confirm what applies to your business.

See Macaw consent management · All regions

More consent guides