How to Tell if a Cookie Banner Is Actually Compliant

Many cookie banners look official but don't follow the rules they're meant to. Under EU and UK rules, you can spot the most common problems in a minute, and test whether "Reject" actually works. This is general information, not legal advice.

The checklist

• Reject is as easy as accept. A "Reject all" button on the first screen, as visible as "Accept all". European regulators have repeatedly said that hiding refusal behind extra clicks isn't acceptable.
• No pre-ticked boxes. Optional categories like advertising and analytics should start switched off.
• Nothing set before you choose. Tracking cookies shouldn't load until you consent.
• Clear information. What each category does, and who the partners are.
• Easy to change your mind. A cookie settings link, often in the footer, that lets you withdraw consent later.
• No "legitimate interest" switches turned on for advertising. These are often hidden on a second screen.
• No tricks. Fake close buttons that mean accept, or color and wording that make reject look like an error.

Test it in Chrome

1. Open the site in an Incognito window, so you start with no cookies.
2. Before clicking anything, press F12, open the Application tab and look under Cookies. Note what's already set.
3. Click Reject all and reload the page.
4. Check the cookies again. Advertising cookies, such as ones from doubleclick.net or Meta's _fbp, shouldn't appear.
5. For a closer look, check the Network tab for requests to ad and analytics companies after you've rejected.

Common problems you'll find

• Analytics or ad cookies set before any choice.
• Reject that only hides the banner while trackers keep loading.
• A banner that only offers "Accept" and "Settings".
• A cookie wall: accept or pay to enter. See cookie walls explained.

What you can do

• Block third-party cookies in Chrome, which works regardless of the banner.
• Let Cookie Auto-Reject click reject for you on common banners.
• In the EU or UK, you can complain to your country's data protection authority, such as the ICO in the UK or the CNIL in France.

For site owners

Run the same test on your own site after any change to tags or plugins. Consent tools need correct setup to block scripts before consent; installing one isn't enough. See dark patterns to avoid and why sites have cookie popups.