Cookie Consent in the Post-GDPR Era: What Changed in 2020–2021
For anyone building websites, the regulatory landscape around cookies has shifted again. Two major developments reshaped how consent must be obtained, and a third is still unresolved. Each has direct consequences for designers and developers who implement tracking and data collection.
Stricter Rules for Cookie Consent
In May 2020, the European Data Protection Board (EDPB) published updated guidance that clarified two practices as non-compliant under GDPR:
- Cookie walls are not acceptable. Blocking access to content unless a user accepts cookies does not offer a genuine choice. Consent must be freely given, and a cookie wall fails that test.
- Scrolling or swiping does not count as consent. Implied consent is insufficient. Users must take an explicit affirmative action to agree to cookie placement.
The practical effect is that consent mechanisms must present clear, equitable options. For users, that is an improvement over nuisance banners. For site owners, it means fewer legal avenues to justify tracking without explicit approval.
These changes anticipate broader reform. Cookies themselves are governed not by GDPR but by the ePrivacy Directive, which is slated for replacement by an ePrivacy Regulation. That regulation is still in draft and far from enactment, but its eventual scope could go well beyond cookies to cover messaging apps, spam, and IoT data transfer.
Big Tech Moves Against Third-Party Tracking
Google and Apple have each taken steps to limit third-party tracking, and each has attracted antitrust scrutiny as a result.
Google's Privacy Sandbox initiative aims to remove third-party cookies from Chrome. Firefox and Safari already block them by default. The UK's Competition and Markets Authority launched an investigation into the initiative after complaints from adtech companies and publishers. Google also faces antitrust investigations in Italy over display advertising and in the US over search advertising. The core allegation is that removing third-party cookies will concentrate even more advertising revenue in Google's hands. Google's stated position is that the industry must adapt to a web without these cookies.
Apple's App Tracking Transparency (ATT), which arrived with iOS 14 in early spring 2021, moves app users from an opt-out to an opt-in model for ad tracking. Apps must now ask permission before sharing a user's Identifier for Advertisers (IDFA). Four French digital advertising lobbies filed an antitrust suit against the change. Their argument: restricting ad revenue will force developers to raise subscription or in-app purchase prices, or push them toward Apple's own targeted ad platform. Facebook and other critics have said the shift will hurt small businesses that rely on microtargeted ads.
In summary:
- Implied consent no longer qualifies as consent under the EDPB's reading of GDPR.
- Cookie walls are effectively banned.
- Google and Apple are limiting third-party tracking, though both face legal pushback.
What Designers Need to Consider
- You are designing the consent points and data flows, so GDPR compliance is part of the design brief.
- Perform a functionality audit to map cookie activity across the service blueprint, including data and compliance layers.
- Audit existing cookie patterns to see whether they comply with current guidance. Check what content is required around the consent mechanism.
- Work from existing compliant design patterns rather than inventing new ones. Privacy by Design should be a default, not an afterthought.
- Coordinate with compliance and engineering teams early so that designs meet GDPR and are technically feasible. Collect only the data that is necessary.
- If trade-offs are required, adopt a documented, risk-based approach.
- Expect content teams to update the privacy policy as cookie usage and regulations evolve.
What Developers Need to Consider
- Get involved in decisions about consent and tracking before implementation, so the chosen approach is actually buildable.
- During redesigns, run a cookie audit in Chrome Dev Tools to identify tracking cookies. Third-party tools like Ghostery or Cookiebot offer more detail.
- Implement the standard opt-in/opt-out pattern per GDPR guidance. Note that while GDPR is a single regulation, enforcement varies by EU member state.
- Be prepared to lose Google Analytics data if users decline cookies. You may also face pressure to use dark patterns; resist it and document the risks.
Schrodinger's Law: The Unresolved ePrivacy Regulation
GDPR covers consent, but cookies fall under the ePrivacy Directive of 2002, commonly known as the Cookie Law. That directive is slated to be replaced by the ePrivacy Regulation, a more stringent law still in draft.
The distinction matters. A directive sets goals but leaves implementation to member states. A regulation mandates both goals and implementation uniformly across the EU. The ePrivacy Regulation would therefore create one consistent standard for electronic communications.
The draft has been stalled since it was first proposed in 2017. Both the European Parliament and the Council of the European Union must agree on it, and they have not done so.
The disagreement is substantive. Some member states, thought to include the Nordic countries, want users to set cookie acceptance or rejection preferences at the browser level, rather than on every site. Others, believed to include Austria and nations with large digital advertising sectors, argue that such a requirement would hurt business. The 27 member states are reportedly split down the middle, and the tech industry is lobbying heavily on all sides.
In November 2020, the Council's Working Party on Telecommunications and Information Society rejected the redrafted legislation once again. Two outcomes are possible: a compromise is reached, leading to adoption with a probable implementation date no sooner than 2025, or the Commission withdraws the proposal entirely. The EU has invested too much to withdraw voluntarily.
That limbo is why the best approach for now is pragmatic. Plan for stricter consent rules, expect further movement away from third-party cookies, and design your cookie implementation so it can adapt when the regulation finally resolves.
Cookie Consent in Practice: A Case Study
While EU member states work through the ePrivacy Directive unevenly, the UK’s ICO has taken a firm line, requiring explicit consent for analytics cookies and opposing cookie walls. For now, businesses in EU countries should follow the guidance of their national Data Protection Authority, while developments around a new ePrivacy Regulation remain pending. For non-EU based operations, ensuring EU citizens are given the options the GDPR and ePrivacy Directive require is essential.
However, in practice, the details of implementation often call for a risk-based approach. At Cyber-Duck, that is exactly what we did — and learned from the results.
The First Attempt: Strict Consent
We started with the ubiquitous cookie notice that users habitually click past. It felt meaningless, so we replaced it with a notice where tracking cookies were off by default, aligning with ICO guidance. We accepted the risk of losing analytics data since our tag manager would no longer fire on first load.
The consequence was immediate and severe. Looking at our traffic, the change is stark: traffic dropped from substantial tracked sessions to nearly zero following the 17 December launch. The orange line, representing the prior year, shows what we’d expect without any restriction.
In both scenarios, the default option won by a wide margin. Users overwhelmingly clicked “accept” without deliberation. But with tracking off by default, we were blind — unable to tailor content or understand our audience’s needs. Data drives our business decisions; losing it was like not knowing your bank balance.
Searching for a Middle Ground
We debated alternatives: removing the toggle, adding visual nudges toward acceptance, or flipping the default to enable analytics. For now, we chose a compromise with marketing and analytics cookies on by default, and a single clear switch to opt out.
Relaunched on 15 January, this banner saw traffic recover as users accepted cookies. Yet we weren’t collecting the full data set we once had — our tag manager still wasn’t firing until a user responded to the prompt.
That led to a subtle but serious tracking issue: attribution became unreliable. The pattern emerged in two ways:
- Correct attribution: A user lands on the site via a paid ad, accepts cookies immediately, and is attributed to PPC.
- Incorrect attribution: A user arrives via search, browses a few pages without responding to the banner (it shows on every page), finally accepts, and is then attributed to “direct” traffic.
This happens because nothing is tracked until the cookie prompt is answered. To Google, the user looks like they just landed on that page. The result: search traffic gets mislabeled as direct.
This entire experience is new territory — there is minimal documentation, and it’s been a steep learning curve.
Where We Landed (for Now)
We considered a cookie wall to force a decision before browsing, but given the ICO’s guidance, that would likely move us further from compliance (though incognito visits to the ICO’s own site may reveal their practice). We ultimately opted for the wall anyway. We’re still gathering data on its impact and intend to explore alternative tools, including moving away from Google Analytics.
How Major Sites Handle It
Across the web, approaches vary widely, revealing both creativity and dark patterns:
- McDonald’s UK uses straightforward on/off buttons.
- Coca-Cola’s British site visually nudges toward accept, making “reject” harder to locate.
- Sanrio only offers an option to agree to ad tracking.
- Die Zeit offers free access with tracking cookies, or a paid, ad-free, untracked option.
- Pinchos, a restaurant site, presents a default selection of “Necessary” cookies but draws the eye to an “Allow all cookies” button — then auto-checks all analytical and ad boxes when clicked.
The EU itself is not consistent. The European Parliament offers two clear choices, the CJEU’s site is muddled, and Europol’s site comes with two pre-checked boxes. The German presidency of the Council (July–December 2020) shows no cookie banner at all and places no cookies on first view — yet analytics data is captured via “Piwik” (now Matomo), a tool choice that sidesteps the consent banner entirely.
Alternatives and solutions are emerging — tools like Matomo, Fathom (server-side tracking), and HelloConsent (cookie management) — which we’ll examine in a future piece. The landscape is still shifting, and the path to compliant yet usable analytics remains a moving target.
