Designing cookie consent banners is a problem that combines the law, usability, and user experience.
The cookie consent banner is more of an issue in IT design, the more volatile the legal situation, at least in terms of providing the most functional and convenient solutions for users and website owners.
When it comes to issues of the legal obligation to inform users, guarantee security, and obtain consent from users, we have to expect that we will be legally obligated to adapt a site to new standards from time to time.
The problem of the cookie banner, adjusting its content, particularly to legal standards, is a classic example of this.
How to deal with a cookie banner? What should the cookie consent banner contain? How to let users know about cookie usage?
If you want to learn how to design your own cookie consent banner or use a free or paid plug-in to comply with the letter of the law and not limit your website business-wise, be sure to read the following article.
We cordially invite you to read it.
Are you looking for a solution?
Monsters in cookies, browsers, and websites
Sooner or later, new technologies are regulated, especially if they potentially harm users' interests.
They're subject to regulations that are more or less practical, effective, and more or less convenient for everyday Internet use. However, they're universally binding and force organizations to adapt quickly.
GDPR is perhaps the most emblematic example of this.
Has GDPR and the data privacy laws it introduced solved the problems they were expected to solve? A reliable and honest answer to this question, as well as the adoption of accurate evaluation criteria, is still a matter of time.
One thing is sure: GDPR has created new problems and services that specialized companies are preventing and providing.
That is how consent management platforms (CMP) have appeared on the market. They're regulated by the law adopted under GDPR, among other things.
Usually, a new law doesn't fall from the sky overnight. Particularly when it's supposed to be universally binding and requires technical website adjustments, but that is only a little consolation.
The thing with the law is that even if its implementation is announced well in advance, there is still the problem of its unambiguity, interpretation, and enforcement.
As can be easily guessed, this raises many misunderstandings, controversies, fears, risks, and dilemmas that organizations usually don't want to experience. Is this also the case with cookies?
Well, to a large extent, yes. Welcome to the world of Cookie Monsters!
What are cookies?
Before we move on to patterns and recommendations for designing the cookie banner (or cookie notice) and its settings, let's say a little about cookies and the confusion they cause. Without question, these small, innocent files caused quite a commotion.
Cookies are usually defined as small pieces of text that a website sends to a browser and that the browser sends back on subsequent visits to the site.
This is the definition provided by the law firm Maruta Wachta.
Cookies are typically used for the following purposes:
- Maintaining a session (by generating and returning a temporary identifier after logging in)
- Storing any data that can be encoded as a sequence of characters
In the second variant, cookies have become very useful for web application users because they don't have to enter the same data each time.
Therefore, exchanging information through cookies is essential for websites' smooth and comfortable use.
The process begins when a user launches their Internet browser, types in the address of a website, or clicks on a link to it (e.g., in Google search results).
In response to such a user action, the server sends a cookie with a unique ID, which is then stored on the disk of the user's device.
When a user revisits a web application or a website, information about the cookie is sent to the server from the user's computer so that it can be identified by its unique ID and assigned further information.
Most of the websites (e.g., websites of institutions, simple corporate websites, social networks, service websites, and e-commerce related websites) that we deal with every day while using the Internet use cookies.
Do they do it for the same purpose and in the same way every time? Of course not. We can distinguish several types of cookies.
Cookies can be divided into the following:
- Essential
- Non-essential
Essential cookies include:
- Authentication cookies
- User-centric security cookies
- Multimedia player session cookies
Non-essential cookies are files that serve the following purposes:
- Analytical
- Marketing
- Advertising
- Functional (thanks to which it is possible to activate preferences)
According to another division, in which the criterion of time is crucial, we can distinguish the following cookies:
- Session cookies
- Persistent cookies
Session cookies are deleted when users log out of a website or close their web browser.
Persistent cookies are stored for a certain time and are usually used for statistical and analytical purposes related to personalizing a site's content.
Persistent cookies also help speed up specific actions performed on a website (e.g., login, searching).
We can also look at cookies from the perspective of their origin, and in this case, we can also distinguish two types:
- First-party cookies
- Third-party cookies
The first ones are saved on the user's device by the visited website, while third-party cookies are files created and saved by entities other than the application, website, or domain the user visits.
Regardless of which perspective we choose, it's worth remembering that tracking and identifying users is a procedural problem that has been and will continue to exist.
The new solutions (e.g., Google Privacy Sandbox) won't so much solve the problem with cookies (in particular third-party cookies) but open a new chapter in a technological and legal sense.
Keep in mind that cookies aren't just about technology but about protecting users.
That is why current legal solutions don't focus on a specific technology as on the problem. It's the collection, archiving, and processing of information about users' identities, behaviors, and preferences.
As it can be easily guessed, such actions can be potentially detrimental or even harmful to a user, so collecting such information requires the user's consent.
What can we find in cookies?
The scope and reasons for collecting and processing data contained in cookies are repetitive.
Web application owners most often use cookies to:
- Save queries and customize responses, suggestions, recommendations, and advice during subsequent visits.
- Customize the ads displayed on a site to a user's preferences.
- Build consumer profiles (individual and group).
- Learn about the types and characteristics of devices on which a website is displayed.
- Optimize a site in terms of usability and functionalities.
Cookies very often contain information related to customer preferences.
Cookies contain data regarding the following:
- The way, form, and scope of searching on a website
- The popularity of given subpages and elements on a site
- The most frequently clicked elements
- Time spent on a website
- Performed activities and behaviors
- Frequency of website use
The above information is often used for marketing, sales, and programming purposes related to optimizing a website's user experience (UX). Hence, there is a need to regulate these issues.
The adopted legal solutions apply to the following:
- Any technology that tracks user activity
- Every website owner is obligated to determine which technology is used and for what purpose
- Any action — not just those motivated by marketing matters
How to obtain user consent for using cookies?
The introduction of GDPR in 2018 in Europe is one of the milestones that mark one of the attempts to regulate cookies legally.
The solutions adopted in various European countries are far from homogeneous and unambiguous.
The legal landscape is quite unclear and complicated. It's also very far from establishing and adopting common standards, legal solutions, and interpretations for EU countries.
What kind of legal frameworks regulate cookie usage and user consent?
European Union:
- General Data Protection Regulation (GDPR)
USA:
- California Consumer Privacy Act (CCPA)
- California Privacy Rights Act (CPRA)
- Virginia Consumer Data Protection Act (VCDPA)
- The Connecticut Data Privacy Act (CTDPA)
Canada:
- Personal Information Protection and Electronic Documents Act (PIPEDA)
United Kingdom:
Australia:
- Australian Privacy Principles (AAPs)
In practice, treating cookies as a type of personal data is widely accepted. That is why these regulations — while far from consistent — are treated as complementary.
All these rules are equally important when designing cookie banners, and it's recommended that the consequences of these rules be considered when developing and implementing specific solutions.
Of course, the core of the problem is obtaining the user's consent to use cookies.
Generally, user's consent can be obtained from the level of:
- Browser
- Website or mobile/web application
However, from a legal point of view, the first one is insufficient since GDPR requires explicit consent from users who use a given app or website, and they need to provide consent for each category of cookies. Consequently, we need help designing the cookie banner properly.
From a design perspective, the most relevant issue is how a user gives permission to use the data stored in cookies.
The most crucial issue is the so-called default consent. More specifically, the question is whether consent can be the default value in the selection form. In this regard, the matter is straightforward.
Consent for storing and processing cookies can't be set by default. It must result from a website user's active action.
When using a particular website, users shouldn't express their disagreement as much as they should give their consent.
The cookie preference management tools implemented on a website or web application (CMT — Cookie Management Tool, CMP — Cookie Management Platform, CMS — Cookie Management Software) should support the active expression of a user's consent.
Moreover, the owner of a website or web application is obligated to:
- Ensure accountability for transmitting relevant information and expressing consent from a specific user and content.
- Provide consent before storing cookies on their devices (the so-called opt-in model).
- Provide users with information that is understandable and sufficiently accurate to help them understand how cookies function.
- Offer the ability to give consent actively, even if it has already been given through browser settings.
- Offer consent and its refusal in an equally simple way (identical in the number of necessary clicks and similar in the level of availability of the corresponding field and tool).
- Provide the ability to consent or refuse all or each category of cookies separately.
- Determine all cookies, determine the period of their use, and identify third parties that can access them.
An important issue that can't be ignored is the type of information collected.
Even if a site using cookies doesn't acquire personal data, it still must obtain the user's consent to collect and process data.
The expression of a user's will must, first of all, be free (not resulting from any coercion, necessity, or inconvenience), specific (the description of the conditions should be exhaustive), and informed (the user should understand to whom and what they're giving their consent).
In summary, the consent of website users regarding cookies should be:
- Clear
- Readable
- Understandable and unambiguous
- Voluntary
- Informed
- Specific
- Constructive — the cookie consent banner should allow website visitors to give consent and withdraw it easily
- Exhaustive — the information on the cookie banner should specify all entities that will access the data, including third parties
At the same time, this means that user consent cannot be:
- Default — regarded as a probable and obvious value
- Universal in terms of purposes — each purpose must be confirmed in a separate consent
- Coerced by obstructing access to the information necessary to make a decision and express it
- Unspecified — in terms of its duration and scope
Owners of websites aren't only obligated to obtain consent for processing personal data and information collected in cookies but also to inform a user of the following issues:
- Purposes that will be realized with the help of the data.
- Identity of all administrators and organizations processing the data.
The benefits resulting from proper cookie management and CMT implementation include the following:
- Lower risk of complaints and fines imposed on the organization
- Lower risk of control
- Increased business credibility (e.g., among investors and business partners)
- Increased credibility for advertising systems and marketing partners
Cookie consent banner design
Many ready-to-implement cookie management tool solutions have appeared on the market.
When choosing a specific solution, a particular system, it's worth checking whether it provides the ability to:
- Keep an inventory of cookies used on websites (first-party cookies and third-party cookies).
- Express consent regarding purposes.
- Express consent regarding a given category.
- Learn about the consent period.
- Easily withdraw consent.
- Easily understand the content and scope of the consent.
- Easily access information about trusted partners.
- Update the CMT while maintaining existing consent.
When choosing a CMT service provider, we also should pay attention to the following:
- Ability to customize the tool
- Good usability and user experience
- Ease of implementation
- Availability of technical and legal support
- Expandability of standards (e.g., regulations from outside the EU)
No less important is the alignment of legal needs with business needs. We can distinguish three approaches to this issue. They will vary depending on our attitude toward the consequences with which we want to implement the legal norms and on which cookies are used and for what purpose.
If a website uses technical cookies and doesn't use any analytical or marketing tools, the cookie banner can take the form of a very basic message (cookie notice).
In all other situations, we should implement solutions using any of the following models.
The safe model gives a user the option to:
- Accept cookies in a general sense.
- Reject cookies in a general sense.
- Accept/reject marketing and analytic cookies.
- Accept/reject files of specific vendors.
- Learn information about all cookies.
The balanced model — which is, however, carrying some legal risk — offers a user the ability to:
- Accept cookies in a general sense.
- Accept/reject marketing and analytic cookies.
- Accept/reject files of specific vendors.
- Learn information about all cookies.
The highly risky, in legal and business terms, model provides a user with the option to:
- Accept/reject cookies in a general sense.
There are also two other types of cookie consent banners that you can encounter on the Internet.
Opt-in consent banner
The opt-in consent banner is a more GDPR-compliant cookie banner because it requires the user to explicitly consent to the use of cookies by clicking the button with the following words: Agree, Confirm, or Allow. This is done before a site collects any personal data.
Opt-out consent banner
The opt-out consent banner can be encountered on US-based websites, where it's required to inform users about the collection of cookies, but users' consent isn't necessary. Consent is only required when sensitive data is collected or the data belongs to children. Depending on the law in the individual states, users should have the option to opt out of the collection of personal data.
Cookie policy
When designing a cookie consent banner, also remember to prepare a cookie policy that can:
- Take the form of a separate document that is part of a website or web application.
- Be a part of the privacy policy.
- Be a part of the terms and conditions.
A standard cookie policy should include the following:
- Description of the used cookies
- Description of the purposes that will be achieved through cookies
- Complete list of trusted partners
- An indication of the time of use
- Description of how to manage the given consent
- Legal basis
- The rights of data subjects
Cookie consent banner. What should it contain, and how to design it? Summary
- Designing the cookie consent banner is a legal, technological, and user experience problem.
- Cookies are usually defined as small pieces of text that a website sends to a browser and that a browser sends back on subsequent visits to a site.
- Cookies are usually used to maintain sessions and to remember any data that can be encoded as a sequence of characters.
- The majority of websites use cookies.
- Cookies can be divided into essential and non-essential. It's the most basic division.
- Cookies can also be divided into session cookies and persistent cookies.
- According to another division, we can distinguish first-party cookies and third-party cookies.
- Website owners often use cookies to save queries and customize responses, suggestions, recommendations, and advice during subsequent user visits. They also customize ads displayed on a site to a user's preferences and build consumer profiles (individual and group).
- Cookies are regulated by data privacy regulations, including GDPR, CCPA, CPRA, VCDPA, CTDPA, PIPEDA, and AAP.
- Website and application owners must obtain users' consent to collect personal data.
- Obtaining user consent to use cookies is the core of their problem.
- Consent for using cookies can be obtained from the browser and/or website or web application level.
- A critical issue is the so-called default consent.
- Consent for storing and processing cookies can't be set by default.
- Consent must result from the active action of a web user.
- Even if a website doesn't use cookies to obtain personal data, a website user's consent regarding cookies must be clear, readable, understandable, unambiguous, voluntary, informed, specific, constructive, and exhaustive.
- When choosing a specific cookie management tool, it's worth checking whether it allows us to keep an inventory of cookies, give consent for particular purposes, provide consent for a category, withdraw consent easily, and include information about how long the consent will be valid.
- If a website uses technical cookies and doesn't use any analytical or marketing tools, the cookie banner can be a very basic message created with a plug-in.
- In all other situations, the owner must implement solutions and provide the necessary information in any site configuration and privacy policy model—from safe to very risky in legal and business terms.
