What do the buttons on a cookie banner actually do?
Every website seems to greet you with the same box of buttons. Click through a practice one below and see what each choice actually allows, then read the cheat sheet.
Try it: a practice banner
This pretend news site has the kind of banner you see everywhere. Nothing here is real: no cookies are set, and your clicks only change what’s on this page.
We value your privacy
We and our 847 partners store and access information on your device, such as cookies, to personalise ads and content, measure them, and develop our services.
What each button really means
“Accept all”
Yes to everything: the cookies the site needs, the ones that remember your settings, the ones that count visits, and the advertising ones that can recognise you from site to site. It’s the biggest, brightest button for a reason.
“Reject all”
No to everything that needs your permission. The site still works: it can keep the strictly necessary cookies, like the one that remembers your shopping cart, because the law doesn’t require consent for those. In 2023, Europe’s privacy regulators agreed that if a banner offers “Accept”, it should let you refuse right there too, not three screens later.
“Manage preferences”
Switches, one per kind of cookie. In Europe, the consent switches must start off: the EU’s top court ruled in 2019 that a box ticked for you isn’t consent. If you find them already switched on, that banner is cutting corners.
“Legitimate interest”
The sneaky one. It’s a different legal reason companies give for using your data: not “you agreed”, but “we have a good business reason, unless you object”. That’s why those switches start on, often in a separate tab, with an “Object” button instead of a choice.
The cookie itself still needs your “yes”. Regulators say legitimate interest can’t replace consent for that. It covers what companies do with your data afterwards.
Since 2023, the industry framework behind many of these banners no longer lets companies claim legitimate interest for personalised ads. They can still claim it for things like measuring how well their ads work. And whether “Reject all” also objects to it depends on the banner. So if you open the settings, press “Object to all” before you save.
Banners look different outside Europe, and the rules differ too: in California and some other US states, the link to look for says “Do not sell or share my personal information”. For the bigger picture of what a cookie is and why some follow you around, see why every website asks about cookies.
Sources
- European Data Protection Board: Report of the Cookie Banner Taskforce (January 2023) (edpb.europa.eu)
Europe’s privacy regulators agreed that a banner with an “Accept” button but no way to refuse on the same layer breaks the rules, and that “legitimate interest” can’t be the legal basis for placing cookies.
- EU ePrivacy Directive, Article 5(3) (eur-lex.europa.eu)
Storing or reading information on your device needs your consent, except what is strictly necessary for the service you asked for.
- Court of Justice of the EU: Planet49 (case C-673/17, 2019) (curia.europa.eu)
A pre-ticked checkbox isn’t valid consent to cookies: you have to actively say yes.
- GDPR, Article 7(3) (eur-lex.europa.eu)
“It shall be as easy to withdraw as to give consent.”
- IAB Europe: Transparency & Consent Framework v2.2 FAQ (iabeurope.eu)
Since 2023, companies in the framework many banners use can no longer claim legitimate interest for personalised ads or content; those need consent. They can still claim it for some other purposes, like measuring ads.
The questions behind it
- Why does every website ask about cookies?
Another cookie banner? Here's what a cookie really is, why some follow you from site to site, and what happens when you click “Reject all”.
- Is my phone listening to me?
You said “pizza oven” once, and now the ads are everywhere. Here's what researchers found, and where those ads really come from.
More on YouTube
Dan and Liz answer one everyday tech question at a time, most of them in under a minute.