What Is GDPR and Why Every Website Now Has a Cookie Popup

Cookie popups come mainly from two EU laws working together. The ePrivacy rules require websites to ask before storing non-essential cookies on your device, and GDPR, in force since May 2018, sets a high bar for what counts as real consent. Together they turned a small notice into the banners you see today.

What the rules require

• Ask first: sites need consent before setting cookies that aren't strictly necessary, such as advertising, most analytics, and social media embeds.
• Real choice: consent must be freely given, specific and informed. Pre-ticked boxes and "by using this site you agree" don't count.
• Easy to refuse: regulators expect refusing to be as easy as accepting.
• Easy to change your mind: you should be able to withdraw consent later, often through a "cookie settings" link in the footer.

Cookies the site needs to work, such as logins, carts and security, don't need consent.

Why sites outside Europe show them

• The rules apply to any site that serves people in the EU, wherever the company is.
• Many sites use consent tools from companies like OneTrust and Cookiebot, which show the same banner to everyone by default.
• US state privacy laws, the UK's rules and laws in other countries add their own requirements.

See how US and EU rules differ.

Why banners are so annoying

Many sites design banners to push you toward "Accept": a big bright accept button, a hidden reject option, or many screens of toggles. Regulators have fined companies for this, but it's still common. See dark patterns in cookie consent.

What your choice does

• Accept all: the site and its partners can set advertising and tracking cookies.
• Reject all: only necessary cookies should be set. Sites are legally required to respect this in the EU and UK. See what happens when you click Reject all.
• Ignoring the banner: on a compliant site, no non-essential cookies should be set until you choose.

Making banners less painful

• Cookie Auto-Reject clicks reject on common banners for you, so you get the privacy choice without the clicking.
• Block third-party cookies in Chrome's settings as a backup.
• Some sites use a "pay or accept" model, a cookie wall. See cookie walls explained.

The EU has discussed simplifying the cookie rules, including letting browsers send your choice automatically, so banners may change in the next few years.