Internet Is Fun The cookie banner is the most universally disliked thing on the internet, and the most commonly misexplained. Ask anyone why it exists and they will say GDPR.
That is not the law that requires it.
The actual law is older
The requirement comes from the ePrivacy Directive (2002/58/EC), amended in 2009 by Directive 2009/136/EC. Article 5(3) is the relevant part: a website must obtain prior informed consent before storing any non-essential cookie on your device.
That is from 2009. GDPR did not arrive until 2018. Banners predate it by years β you may remember the first, much smaller wave of “this site uses cookies” notices that simply told you and carried on.
So what did GDPR change?
It changed what counts as consent, not whether consent is needed. The two work together:
- ePrivacy Directive β tells you when you need consent: before setting non-essential cookies.
- GDPR β tells you what that consent must look like: freely given, specific, informed, unambiguous, and withdrawable at any time.
That second list is why the banners got bigger and more annoying in 2018. “Freely given” means a pre-ticked box does not count. “Withdrawable” means there has to be a way back. “Unambiguous” means continuing to scroll is not agreement.
Why they are designed so badly
Now the useful part. Once you know the requirement is “freely given”, the design of most banners becomes legible β and a lot of them are straining against it:
- Accept is one click, reject is three. Friction is not technically refusal, but it is doing a job.
- Accept is a bright button; reject is grey text. Visual weight rather than wording.
- “Legitimate interest” tabs hidden behind a second screen, sometimes pre-enabled.
- Hundreds of “partners”, each needing an individual toggle.
Regulators have pushed back on several of these patterns. The banners persist partly because the alternative β not tracking people β is a business decision rather than a technical one.
What is exempt
Strictly necessary cookies need no consent. Keeping you logged in, holding a shopping basket, remembering a language choice, load balancing. A site that shows you a banner for those alone is over-asking.
This is worth knowing because it tells you something: a site with no banner is not breaking the rules. It usually means it is not tracking you.
What to actually do about them
- Reject all, when it is one click. Almost nothing breaks β the essential cookies are exempt and still load.
- Use a browser that blocks the tracking rather than the banner. Blocking only the banner can count as no consent, which is fine, but the scripts may load anyway.
- Notice which sites do not ask. It is a reasonable signal about how they are funded.
One caveat
This describes the EU/UK position, which is why the banners are everywhere β large sites apply one policy globally rather than detecting your location. Rules elsewhere differ, and this is general explanation rather than legal advice.
Keep going
More on how the web got like this in the quiet technology that changed the internet and why every site looks the same. Practical browser habits in Guides.
