Few topics have created so much effort with so little clarity as the cookie notice. The reason is that two sets of rules interlock: whether consent is needed at all is answered not by the GDPR but by electronic communications law, in Germany section 25 TDDDG. How consent must look is answered by the GDPR. Without this distinction you end up with a banner that asks for consent to everything, which is legally unnecessary and needlessly lowers acceptance rates.
When consent is required
For storing information on a device and accessing it, the principle is: consent is required unless access is strictly necessary to provide a service explicitly requested by the user, or serves solely to transmit a message. Strictly necessary are typically session cookies for a shopping cart, load-balancing cookies, security features against abuse and storage of the consent decision itself. These need no consent, but they do need transparency. Not strictly necessary are audience measurement, advertising and marketing cookies, embedded third-party content and personalised recommendations. These require consent, before they are set.
Audience measurement is a common misunderstanding. Its classification differs by country and design; some supervisory authorities have described narrow exceptions for purely statistical measurement operated by the site owner. Anyone relying on that should check the specific conditions rather than a general statement.
Why banners fail in practice
The requirements for valid consent are not new but are regularly missed. Four points recur in complaints. First, rejecting must be as easy as accepting; a prominent accept button next to a link that leads to a detail layer does not meet this. Second, pre-ticked boxes or switches preset to on are not consent, including in the detail layer many banners open with categories activated. Third, scrolling or continuing to use the site is not consent. Fourth, withdrawal must be as easy as giving consent, which in practice means a permanently accessible link to the settings, not a note in the privacy policy.
The technical point most often overlooked
The legally cleanest banner is useless if scripts load anyway. In practice this is the most common defect: the consent tool is configured correctly, but a third-party script is hard-coded into the page and fires before the decision. You can check this without tools: open the page in a fresh browser profile and, without making a choice, look at the network requests. Everything sent to third parties in this state runs without consent. The second technical point is storing the decision: time, scope and version of the notice text must be provable, otherwise a given consent cannot be demonstrated in a dispute.
The link with third-country transfers
Many analytics and advertising services transfer data to third countries. Consent in the banner does not automatically cover this transfer; separate requirements apply to the transfer mechanism. For Swiss operators, the revised FADP has its own system for disclosure abroad. A website serving both jurisdictions should be able to answer both strands.
What makes sense now
First, compile a complete list of what the site actually loads, not what is configured in the consent tool; the two lists usually differ. Second, separate consistently between strictly necessary and consent-based; this shrinks the banner and improves acceptance without sacrificing anything legally. Third, make the reject path as short as the accept path; it is where most complaints start, and it is easy to fix. Assessments of individual set-ups still differ between authorities, and the debate on pay-or-consent models is not settled, so solutions at the edge of what is permitted should be planned with adjustment in mind. The rules are summarised in our glossary entries on cookie consent and the TDDDG.