Cookie Banner Generator: Create a Free Cookie Banner (2024)

The Privacy and Electronic Communications Directive 2002/58/EC is a set of rules passed in 2002 and amended in 2009 that govern data protection and privacy in the EU.

The ePD — orEU Cookie Law— requires that a website obtains its user’s consent before storing cookies, other than those deemed strictly necessary, in the user’s browser.

Also created in the European Union (EU), theGeneral Data Protection Regulationis the world’s strictest data privacy law. It gives citizens of the EU the right to be informed when websites collect their personal data.

Tocomply with the rules of the GDPR, any website that receives visitor traffic from the EU must display a cookie banner informing EU citizens of their rights under the law.

A cookie banner that is compliant with the GDPR should:

• Include a button to accept cookies:Your website must not activate cookies until the user performs an affirmative action, such as pressing the “Accept” button — i.e., opts in. Your cookie banner should clearly state that by clicking the button, the users allow the cookies on your website to collect their data. If it contains options to accept or reject the use of cookies, both buttons must get featured with equal prominence.
• Give detailed information about how and why you use cookies:Under the rules of the GDPR, websites must allow users to make informed choices about the website’s use of cookies. To make an informed choice, the customer must receive sufficient information about the usage of the data collected via cookies from the website. Your cookie banner text must inform the user of the purpose of the data collected, whether for advertising, analytics, or another objective.
• Inform the user about sharing private data with third parties:If your website plans to share the data collected via cookies with any third party (advertising or analytics partners), the cookie banner must disclose this information to the user. Some websites include a link within the cookie banner to a list of vendors with whom they share such data.
• Include a link to the website’s cookie policy:Within the cookie banner, the user must be able to click a link to view the website’s cookie policy. That way, visitors can get informed about the types of used cookies, the reasons for collecting information, how to remove cookies, and the methods of storing data.
• Link to the cookie preference settings:Many websites link to their cookie preferences page within the cookie banner. Users can allow some cookie categories and reject others on the preferences page. A user may choose, for example, to reject targeted advertising cookies but allow those used for website analytics.

TheCalifornia Consumer Privacy Act (CCPA)was revised several times before California’s Office of Administrative Law approved thefinal (and current) versionof the law.

The CCPA does not require websites to obtain the consent of users before using cookies except for the sale of personal data of users under 16 years of age.

A cookie banner that complies with the CCPA should:

• Provide information about how and why you use cookies:A CCPA-compliant cookie banner should give users details about why the website uses cookies and whether it shares the collected data with any third parties.
• Include a button to accept cookies:The CCPA does not require explicit user consent, but many websites include a button within their cookie banner to allow the user to accept cookies. The cookie banner may also contain a link to the website’s cookie settings page, where users can select which cookie types (if any) they wish to accept.
• Include a “Do Not Sell” button:Any business subject to compliance with the CCPA must add a “Do Not Sell My Personal Information” button and page to its website, allowing customers to opt out of the sale of any personal information the website collects about them.

In the United Kingdom (UK), theInformation Commissioner’s Office (ICO)is an independent body overseeing the privacy rights of citizens of the UK.

The ICO’s guidance shares many similarities with the GDPR. For example, the ICO does not recommend accepting implied consent for cookies, instead suggesting that websites require users to give explicit consent before providing any non-essential cookies, including cookies that collect data on website analytics. In addition, it advises websites not to use pre-checked boxes or other mechanisms that may nudge users toward accepting consent.

According to the ICO’s guidance, cookie banners must:

• Include information about how and why you use cookies
• Not use “cookie walls,” which are cookie banners that force the user to accept cookies before being allowed to continue to the website.

The FrenchCNIL’scookie banner guidelines are similar the ICO and GDPR.

For a cookie banner to be CNIL compliant, it should:

• Include a button to accept cookies:The banner must give the user information about the specific data that cookies collect, the purpose of such action, and the potential share of information with third parties.
• Include specific links:The cookie banner must include links to the website’s cookie policy and settings.
• Inform the user about analytics cookies:The banner must inform the user about the use of cookies that collect data about website analytics. Before the website can use analytics cookies, it requires the user’s explicit acceptance. The banner must also include a mechanism for the user to reject analytics cookies, usually in the form of a link to the website’s cookie settings page.
• Avoid using cookie walls:The website is advised not to use cookie walls to block the use of the page if the user does not agree to allow cookies.

TheLei Geral de Protecao de Dados (LGPD), or General Personal Data Protection Act, is the Brazilian data privacy law that took effect in September 2020. Because of the similarities between the Brazilian law and the GDPR, cookie banners compliant with these two laws will appear very similar.

To be compliant with the LGPD rules, a cookie banner should:

• Explain the website’s data collection:The banner should inform users that the website collects and processes their data. It should also explain the how and why behind the cookies and list any third parties with whom the website may share this data.
• Allow users to refuse consent:Users must know they can choose to accept or refuse data collection. The banner should make this clear and provide intuitive buttons for these actions.

ThePersonal Information Protection and Electronic Documents Act (PIPEDA)is a Canadian data privacy law that applies to private-sector organizations that collect, use, or disclose personal information for commercial activity.

It differs from other privacy laws as it contains the requirement to obtain meaningful consent from the user — i.e. if the use of cookies under the circ*mstances is reasonable.

Therefore, whether you need to obtain implicit or explicit consent depends on the circ*mstances.

A cookie banner compliant under PIPEDA should:

• Obtain explicit user consent:Unless the user would expect data to be collected, your cookie banner should require meaningful consent to data gathering via cookies on your website.
• Inform the user about data collection:The banner should explain the categories of data collected and the purpose of your website processing this data.

According to the Office of the Privacy Commissioner for Canada, you must have the user’s explicit consent when:

• The information being collected, used, or disclosed is sensitive
• The collection, use, or disclosure is outside of the reasonable expectations of the user
• The collection, use, or disclosure creates a residual risk of significant harm

Canada’s Privacy Commissioner also recommends the following to make your consent process more meaningful:

• Allow users to control how many details they wish to receive and when.
• Use innovative, creative ways of obtaining consent.
• Remind users periodically about their consent choices and those available to them.
• Periodically audit your privacy solutions to ensure they reflect current practices on personal information management.
• Be prepared to demonstrate that your consent process is user-friendly and easily understandable.
• When developing consent processes, consider involving users, focus groups, privacy experts, or regulators and following established best practices.

Thailand’sPersonal Data Protection Act (PDPA)is the country’s first law designed to oversee data protection in the digital age. It often gets compared to the EU’s GDRP, and indeed, several principles of the PDPA were heavily influenced by the GDPR.

For a cookie banner to be compliant under the PDPA, it should:

• Inform the user about cookies:The cookie banner should explain to the user that your website uses cookies. It should also specify what data the cookies collect, who does so, and for how long.
• Withhold cookies until the user consents:All cookies should be blocked until or unless the visitor consents to your website’s use of cookies.
• Provide a way to change or decline consent:The banner should include a simple mechanism for the customer to change their previous consent choice or to reject the use of cookies to collect their data.

It is important to note that all of your users’ consent choices must, by law, be stored for five years.

Yes, the cookie banner generator is free to use. With ourBasic plan, you can use the website scan tool, create a cookie banner, add a preference center, and publish a cookie policy for free.

Yes, your cookie banner will be automatically generated by our tool. After you scan your website and review the cookie categorizations, you will be given a chance to customize your cookie banner and be provided a code to embed it on your website.

A cookie notice and a cookie banner are the same. A cookie policy, however, contains more details about user data usage.

The content of a cookie banner gets dictated by the specific law that applies to your website. It depends on the location of your visitors and the information you need to pass over.

Depending on the location of the users you service, you may be required to have a cookie banner by certain data privacy laws such as the ePrivacy Directive (Cookie Law), the GDPR, and the CCPA.

There is no federal cookie law in the United States. However, some individual states, like California (CCPA) and Nevada (SB220), have laws that govern cookie usage related to their residents.

Also, if your website is based in the US but receives visitors from other places worldwide, it must comply with any applicable privacy laws governing those areas.

An EU cookie banner complies with the ePrivacy Directive (ePD) and the General Data Protection Regulation (GDPR) guidelines.

Your website can obtain a user’s consent through a GDPR-compliant cookie banner, which must get displayed on the site for users to see upon the first visit. The guidelines to create this banner are addressed in the General Data Protection Regulation (GDPR) above.

Termly’s cookie banner solution can help you determine if your website uses cookies and, if so, which ones. It can also assist with the classification of the cookies it detects.

User consent is basically the user’s permission to collect and handle their data.

Getting a user’s consent before using cookies is mandatory under laws such as the General Data Protection Regulation (GDPR). On the other hand, laws like the California Consumer Protection Act (CCPA) allow you to use cookies before you get consent, as long as you make it clear and easy for a user to opt out.

Search engine crawlers don’t index the content of cookie banners, so they should not hurt your search engine optimization or indexation.