GDPR and cookies: what is allowed without consent

Functional storage is allowed without consent: your basket, your language choice, remembering that you are logged in, and the security of a form. Without those the site does not work, and that is what the exemption is for.

For anything that tracks, measures or advertises, consent is required — given in advance, as easy to withdraw as to give, and not forced with a bar that only says 'agree'.

So a bar without a refuse button is not consent. The same goes for pre-ticked boxes and for scripts already running before anything has been chosen.

There are analytics tools that build no personal profiles and share no data with ad networks. With them you know how many visitors you have, where they come from and which pages work — without a consent bar.

That saves more than legal hassle: every banner costs visitors and speed, and the numbers left after a banner are incomplete anyway.

If you do want to advertise and measure conversions in ad platforms, asking consent is unavoidable. Then do it properly rather than halfway.

Cookies are only one part. Every form, every newsletter sign-up and every embedded video processes your visitor's data. The principle is simple: ask only for what you need, and explain on a privacy page what you do with it, how long you keep it and who you share it with.

With parties processing data on your behalf — hosting, mail system, a form service — you sign a processor agreement. Keep data inside the EU, or make sure there is a valid basis when it is not.

And think about practice: who can access the inbox with enquiries, what happens to old data, and can someone have their data deleted if they ask?