Security Medium impact Medium 30–60 min

Cookies & GDPR

Cookie consent and personal data protection.

What it is

Sites collecting cookies (especially analytics and marketing ones) must, under GDPR/ePrivacy, obtain the user's consent and have a privacy policy. A cookie banner and a privacy policy handle this.

Why it matters

Without proper consent there's a risk of legal penalties and fines. Tracking scripts (analytics, pixels) must not run before the user gives consent. It's an obligation, not a choice.

How to do it

1Deploy a cookie banner with a real choice (accept/reject, not just "OK").
2Run tracking scripts only AFTER consent is granted.
3Have an accessible privacy policy and cookie processing policy.
4Store proof of consent.

Conclusion

Treat cookies and GDPR as a legal obligation, not cosmetics. The key is not running tracking before consent and having a functional reject option. When in doubt, consult the wording with a lawyer, since the fines are real.