What a cookie bar should look like under GDPR and ePrivacy in 2026

A cookie bar is a part of a website that many companies only notice when the data in Google Analytics stops working or a question comes from a client, an audit or a lawyer. In reality, however, it is one of the most important parts of the whole website: it decides whether you can use analytics and marketing cookies, whether you can prove consent and whether the visitor understands what is happening with their data.

A proper cookie bar should not be a trick. It should not use pre-ticked consents, hidden rejection or texts that push the user toward one choice. A good cookie bar is clear, fair and technically connected to what actually happens on the website.

The basic rule: not all cookies are the same

First you need to distinguish between necessary cookies and optional cookies.

Necessary cookies are those without which the website or service cannot function. This typically includes login, the shopping cart in an e-shop, security features, protection against abuse or storing a language choice. For such cookies consent is usually not required, because they are needed to provide the service the user requested.

Optional cookies are different. These mainly include analytics cookies, marketing cookies, remarketing, advertising identifiers, social plugins and third-party tools. They should only be triggered after the user has given valid consent.

For a CMP such as Cookienovo it is therefore important that the website not only displays the bar, but also technically prevents optional scripts from running before consent.

What the user must see in the first layer

The first layer of the cookie bar should be short, but not empty. Already at first contact the visitor should understand:

• that the website uses cookies or similar technologies,
• for what main purposes they are used,
• that necessary cookies can work even without consent,
• that analytics and marketing cookies will only be used after consent,
• that they can accept, reject or configure consent in more detail.

A practical good text might read:

We use cookies to ensure the website works, to measure traffic and to improve advertising. Necessary cookies always work. We will use analytics and marketing cookies only with your consent. You can change your settings at any time.

This is clearer than a long legal sentence that no one reads.

Buttons: accept, reject, configure

A cookie bar should have equal options. In practice we recommend at least these three:

• Accept all
• Reject all
• Cookie settings

If the "Accept all" button is prominent and "Reject all" is hidden in the second layer, that is a risk. The EDPB repeatedly emphasizes that consent must be freely given and that withdrawing consent must be as easy as granting it. A design that pushes the user toward accepting may be a problem not only legally, but also reputationally.

The second layer: categories, purpose, providers

The second layer of the cookie bar is where the user should see the details. It does not have to be a legal treatise, but it should contain:

• the cookie categories,
• the purpose of each category,
• information on whether the category is necessary or optional,
• a list of specific cookies,
• the provider or third party,
• the retention period,
• the option to turn individual categories on or off.

Typical categories are necessary, functional, analytics and marketing cookies. It is important not to name marketing cookies as "improving the experience" if they actually serve targeted advertising campaigns. Transparency means naming things truthfully.

The cookie declaration: not just a list of names

The cookie list itself should not contain only technical names like _ga, _fbp or IDE. For an ordinary visitor these mean nothing. The cookie declaration should explain for each cookie:

• the cookie name,
• the provider,
• the category,
• the purpose,
• the expiry period,
• whether it is a first party or a third party.

That is why Cookienovo scans the website and creates the declaration automatically. Regular scanning reduces the risk that a new script or plugin appears on the website while the cookie policy stays old.

Consent must be provable

The GDPR states that if processing is based on consent, the controller must be able to demonstrate that consent was given. In practice this means that the CMP should store a record of consent or its withdrawal.

Such a record should not collect more data than necessary. It is reasonable to store, for example:

• an anonymized or pseudonymized browser identifier,
• the consent status for individual categories,
• the time of granting or withdrawal,
• the website or domain,
• the version of the settings or the cookie declaration.

You should also set a retention period for these records. If Cookienovo keeps records for at most 365 days, it is advisable to state this clearly in the cookie policy.

The most common mistakes

Most often we see these problems:

• marketing scripts run before consent,
• rejection is harder than acceptance,
• consents are pre-ticked,
• the cookie declaration is out of date,
• the list of third parties is missing,
• the retention period information is missing,
• after consent is withdrawn, scripts keep running,
• Google Consent Mode is not set up or sends incorrect signals.

These mistakes cannot be solved by a nice banner alone. You need a CMP that also handles the technical part: scanning, blocking, storing consents and integrations.

How Cookienovo helps with this

Cookienovo is built so that the cookie bar is not just a graphical element. It helps with:

• automatic cookie scanning,
• splitting cookies into categories,
• generating the cookie declaration,
• collecting and recording consents,
• withdrawing consent,
• Google Consent Mode v2,
• auto-blocking scripts before consent,
• exporting records for an audit.

For the website owner this means less manual work and a lower risk that the reality on the website does not match the text in the policy.

Conclusion

A proper cookie bar is a combination of three things: fair text, good UX and technically correct behavior. If one part is missing, a problem arises. A nice banner that fires marketing scripts before consent does not help. Neither does a legal policy that no one can find or that does not correspond to the reality on the website.

If you want your cookie bar to be in order, start with a scan of the website. You will find out which cookies are actually used, which of them are optional and what needs to be blocked before consent.

With Cookienovo you can try a cookie bar for free and run your first website scan in a few minutes.

Recommended sources:

• GDPR, especially Art. 7, Art. 12 and Art. 13: https://eur-lex.europa.eu/eli/reg/2016/679/oj
• ePrivacy Directive, Art. 5(3): https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32002L0058
• EDPB Guidelines 05/2020 on consent: https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_en.pdf
• CJEU judgment Planet49 C-673/17: https://curia.europa.eu/juris/document/document.jsf?docid=218462&doclang=EN

---