GDPR Q13

How does GDPR affect cookies and website tracking?

Q13. How does GDPR affect cookies and website tracking?

Category: Websites

Cookies and tracking technologies must be transparent and, for non-essential purposes, require consent from visitors.

In simple terms

Essential cookies that keep the site running do not need consent.
Analytics, advertising, and personalisation cookies do need opt-in consent.
You must provide clear information and honour choices.

Understanding cookie types

Essential cookies enable core functions like shopping baskets or login sessions. Non-essential cookies, such as analytics or advertising trackers, need consent under PECR and GDPR.

Explain each category in your cookie notice using simple words.
Group cookies by purpose so people can choose easily.
Review third-party scripts regularly to ensure they match your policy.

Gathering valid consent

Consent must be as easy to refuse as to give. Provide a banner or widget that lets users opt in to each category, and remember their preferences.

Pre-ticked boxes or implied consent banners are not valid.
Record the date and choices for each visitor when possible.
Refresh consent periodically, especially after changes to vendors.

Providing transparency

Update your privacy and cookie notices to explain what data is collected, why, and who receives it. Include details of any international transfers.

Link to third-party privacy information for embedded services.
Explain how users can change settings later or delete cookies.
Ensure wording is child-friendly if your site is used by young people.

Practical steps to take

Audit all scripts and cookies on your website or app.
Categorise cookies as essential or non-essential.
Implement a consent management platform that blocks trackers until consent is given.
Update notices and privacy policy with clear explanations.
Test the banner regularly to ensure preferences are respected.

Real-life examples

E-commerce site

A shop uses a consent banner with ‘Accept’, ‘Reject’, and ‘Manage settings’ buttons. Analytics and advertising scripts load only after consent is granted.

Educational portal

A school website explains each cookie in plain English and provides a toggle for students to opt in or out of analytics tracking.

Helpful reminders

Review cookies every six months to catch new ones added by updates.
Apply the same rules to mobile apps, not just websites.
Do not bundle cookie consent with consent for other services.
Ensure rejecting non-essential cookies does not break the core service.

Key takeaway

Be clear, give genuine choice, and respect the decision—cookie compliance is part of building trust online.