Cookie Consent and GDPR: A Practical Compliance Guide for European Small Businesses

Is Your Cookie Banner Actually GDPR-Compliant?

Nearly every website today has some kind of cookie banner. But most of the ones we see on European SMB sites have a problem: an "Accept All" button paired with a barely visible "Settings" link instead of an equally prominent "Reject All," or a banner that treats continued browsing as consent. None of that holds up under GDPR.

Most agency blog posts treat this as a legal checkbox — "publish a cookie policy" — without explaining what actually needs to change on the page itself.

What GDPR Actually Requires: Equal Prominence

The rule is simple but frequently broken: Accept and Reject need equal visual weight. If "Accept All" is a bold colored button and rejection is a small text link, that design choice alone can be treated as non-compliant. Pre-ticked boxes don't count as consent, and continuing to browse, scrolling, or dismissing the banner isn't an affirmative action — the visitor has to actively click something.

Which Cookies Need Consent, and Which Don't

Strictly necessary cookies (session management, shopping cart state) don't require consent. Analytics, advertising, and marketing cookies do. Here's where businesses often get it wrong: standard third-party analytics tools like Google Analytics are commonly assumed to qualify as "strictly necessary." They don't, and they shouldn't load before a visitor has consented.

The Cross-Border Data Question

If your site runs Google Ads, Meta Pixel, or similar third-party tools, that data typically leaves the EU/EEA, which triggers additional obligations around international data transfers under GDPR. For a business selling across multiple European markets, that means your cookie policy needs to explain not just what cookies exist, but where the data actually goes.

Implementing This Without a Developer

On WordPress, plugins like Cookiebot or CookieYes scan your site automatically, categorize the cookies, and generate a compliant three-option banner (Accept, Reject, Manage Preferences). On a custom-built site, the same logic needs to be enforced at the infrastructure level: no analytics or advertising script should fire before the visitor has made a choice — not just hidden from view, but not loaded at all. Keeping a simple record of consent — timestamp, the choice made, and which policy version was shown — is also part of compliance, and most consent management plugins handle this automatically.

Three Mistakes That Get Businesses Fined

1. Hiding the reject option. A prominent Accept button next to a barely visible reject link is, on its own, often enough to fail an audit.
2. Loading scripts before consent. The most common technical failure: analytics or ad pixels start collecting data in the background before the visitor has chosen anything.
3. Treating consent as permanent. Consent isn't indefinite — most guidance points to re-requesting it roughly every six months, and regulators in several EU countries have started actively auditing this.

Where This Fits

Cookie compliance isn't a plugin you install once and forget — it has to match your site's actual technical behavior. For European SMBs and e-commerce businesses, a properly built consent banner reduces legal exposure and, done well, doesn't have to hurt conversion. At Ares Yazılım, we build GDPR-compliant cookie infrastructure into every site we deliver as a standard part of the build, not an afterthought.