GDPR cookie consent for ecommerce: the 5 mistakes most stores still make

EU data protection authorities issued over 2 billion euros in GDPR fines in 2025. Cookie consent violations are among the easiest to detect and the most common trigger for complaints. Despite this, most ecommerce stores still get consent wrong.

The rules are not ambiguous. The GDPR, the ePrivacy Directive and guidance from the European Data Protection Board spell out exactly how consent must work. Yet a scan of 1,000 European ecommerce stores reveals that the majority fail on at least one of these five points.

Mistake 1: pre-checked consent boxes

The CJEU ruled in the Planet49 case (2019) that pre-ticked checkboxes do not constitute valid consent. Consent must be an affirmative action. The user must actively opt in, not passively fail to opt out.

This applies to cookie banners, newsletter signups and marketing preferences. If your cookie banner loads with "analytics" and "marketing" already toggled on, that is not valid consent. Many consent management platforms (CMPs) ship with pre-checked categories by default. Store owners install the CMP and never change the settings.

The fix is simple: all non-essential cookie categories must default to off. The user must actively toggle them on or click an explicit "accept all" button.

Mistake 2: no way to reject cookies without friction

Many cookie banners offer a prominent "Accept all" button alongside a smaller "Manage preferences" link that leads to a multi-step settings panel. Rejecting cookies requires three or four clicks. Accepting requires one.

The French CNIL fined Google 150 million euros and Facebook 60 million euros in 2022 specifically for this pattern. The CNIL stated that refusing cookies must be as easy as accepting them. Other DPAs across Europe have adopted the same position.

Your cookie banner needs a "Reject all" or "Necessary only" button that is equally prominent and accessible as the "Accept all" button. Same size, same visual weight, same number of clicks.

Mistake 3: firing tracking scripts before consent

This is the most technically damaging mistake. Many stores load Google Analytics, Meta Pixel, TikTok Pixel and other tracking scripts on page load, before the user has interacted with the cookie banner. The consent banner is cosmetic: it appears on screen but the tracking has already started.

Valid GDPR consent must be obtained before processing begins. If analytics cookies are set the moment a page loads, consent is meaningless. The user cannot consent to something that has already happened.

Implementing this correctly requires conditional script loading. Scripts in the "analytics" and "marketing" categories must only fire after the user has given explicit consent for those categories. This means using your CMP's callback system or a tag manager configured to wait for consent signals.

Common culprits: hardcoded Google Analytics snippets in the theme header, Meta Pixel base code added directly to the layout, third-party apps that inject their own tracking regardless of consent state.

Mistake 4: treating all cookies as strictly necessary

The "strictly necessary" exemption under the ePrivacy Directive allows certain cookies to be set without consent. These are cookies that the site genuinely cannot function without: session cookies, shopping cart cookies, authentication tokens, CSRF tokens.

Some stores abuse this exemption by classifying analytics, personalization or even marketing cookies as "strictly necessary." This does not hold up under scrutiny. If your store functions without a cookie, that cookie is not strictly necessary.

Google Analytics is not strictly necessary. Hotjar session recordings are not strictly necessary. Personalization engines are not strictly necessary. A/B testing tools are not strictly necessary. These all require consent.

Misclassifying cookies is not a grey area. DPAs specifically check cookie classifications during audits. The Italian Garante and the Spanish AEPD have both issued guidance listing specific cookie types and their correct classification.

Mistake 5: no mechanism to withdraw consent

Article 7(3) of the GDPR states that it must be as easy to withdraw consent as it was to give it. If a user clicked "Accept all" on a cookie banner, they must be able to change that choice just as easily.

Most ecommerce stores fail here. The cookie banner appears once, the user clicks accept, and there is no obvious way to revisit that choice. The consent preferences are buried in a privacy policy footer link, if they are accessible at all.

Good practice: a persistent "Cookie settings" link in the footer that reopens the consent panel. Some CMPs offer a small floating icon. The key is that the withdrawal mechanism must be discoverable without hunting for it. The same consent principles apply to email marketing, where GDPR requires equally easy unsubscribe mechanisms.

The enforcement landscape in 2025

GDPR enforcement has matured significantly. DPAs across Europe now use automated scanning tools to check cookie consent compliance at scale. The CNIL in France runs regular sweeps of ecommerce sites. The Austrian DSB, the Belgian APD and the Norwegian Datatilsynet have all issued fines for cookie consent violations.

Fines for cookie violations tend to be smaller than headline GDPR fines, typically in the tens of thousands to low millions of euros. But they are frequent and they are increasing. More importantly, a cookie consent complaint can trigger a broader GDPR audit that uncovers more serious issues.

The activist group noyb (led by Max Schrems) has filed hundreds of cookie consent complaints across Europe, targeting both large and mid-market ecommerce stores. Their automated scanning approach means any store selling to EU customers is a potential target.

The US angle: state privacy laws

While the US does not have a federal equivalent of the GDPR, 24 states now have comprehensive privacy laws. California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA) and others require some form of consent or opt-out mechanism for certain data processing.

The requirements vary by state, but the trend is clear: US stores can no longer ignore cookie consent. At minimum, stores with California customers need to honor "Do Not Sell or Share My Personal Information" signals, which includes cookie-based tracking used for targeted advertising.

How to get it right

• Audit your cookies. Use browser developer tools to list every cookie set by your store. Classify each one honestly: strictly necessary, analytics, marketing or personalization.
• Configure your CMP properly. Default all non-essential categories to off. Add a visible "Reject all" button. Wire up consent callbacks to control script loading.
• Block scripts before consent. Do not load analytics or marketing scripts until consent is given. Use your CMP or tag manager to enforce this.
• Test from the EU. Use a VPN or proxy to visit your store from an EU IP. Check that the banner appears, that scripts do not fire before consent and that all buttons work.
• Monitor continuously. New scripts get added, themes get updated, apps get installed. Regular automated checks catch regressions before regulators do.

The bottom line

Cookie consent compliance is not difficult. The rules are clear and the technical implementation is well understood. The problem is that most stores set up a CMP once and never check that it actually works correctly.

A properly configured consent banner that blocks non-essential cookies until consent is given, offers equal accept and reject options and provides easy withdrawal eliminates the most common complaint triggers. The cost of getting it right is trivial compared to the cost of a GDPR fine. For a broader compliance review, our GDPR compliance checklist covers every requirement that applies to ecommerce stores. Also worth noting: manipulative consent patterns that nudge users toward acceptance can now trigger fines under dark patterns regulations across the EU and US. For a more systematic approach, our guide on privacy by design for ecommerce covers how to build GDPR compliance into your store architecture from the start.

Frequently asked questions

What are the most common GDPR cookie consent mistakes?

The five most common mistakes are pre-checked consent boxes, no easy way to reject cookies, firing tracking scripts before consent is given, misclassifying cookies as strictly necessary and not providing a mechanism to withdraw consent.

Can I fire Google Analytics before cookie consent in the EU?

No. Google Analytics sets non-essential cookies that require prior consent under GDPR and the ePrivacy Directive. Scripts in the analytics and marketing categories must only fire after the user gives explicit consent.

Does the reject button need to be the same size as accept all?

Yes. The CNIL fined Google 150 million euros for making rejection harder than acceptance. Refusing cookies must be as easy as accepting them, with equal visual weight and the same number of clicks.

How do EU regulators detect cookie consent violations?

DPAs across Europe now use automated scanning tools to check cookie consent compliance at scale. The CNIL in France runs regular sweeps, and the activist group noyb has filed hundreds of complaints using automated scanning.