Cookie consent, and the GDPR signals a scan can see

What actually needs consent, and what does not

The rule that decides most of this is not in the GDPR at all. It is the ePrivacy Directive, and it says that storing or reading anything on someone's device needs their consent unless it is strictly necessary to provide the service they asked for. That covers cookies, and it equally covers localStorage, sessionStorage, IndexedDB and a fingerprint assembled from what the browser exposes. Calling it a cookie banner is a habit, not a scope.

• Strictly necessary, no consent: a session identifier for someone logged in, a shopping basket, a CSRF token, a load-balancer affinity cookie, and the cookie that remembers the consent choice itself.
• Consent required: analytics of every kind, advertising and remarketing, A/B testing, session recording and heatmaps, embedded video that sets its own identifiers, chat widgets, and social sharing buttons that phone home.

Analytics is the one people argue about. "Anonymous" analytics that still stores an identifier on the device needs consent, because the rule is about the storage, not about how identifying the resulting data is. Genuinely cookieless, server-side measurement is a different case - and it is a design decision, not a banner setting.

What makes consent valid, in the order banners get it wrong

A banner is not consent. Consent is a freely given, specific, informed and unambiguous indication of agreement - and the failures are consistent enough to list in the order regulators find them.

• Scripts that run before the answer. If the tag fires on page load and the banner is decoration, nothing about the banner matters. This is the single most common finding and the easiest to test.
• No way to refuse that is as easy as accepting. One prominent Accept button and a Reject buried two clicks into a settings panel is not a free choice, and this specific asymmetry has been enforced against repeatedly.
• Pre-ticked boxes, or sliders that default to on. Silence is not consent; a default is silence.
• Consent bundled for everything at once, with no way to accept analytics and refuse advertising.
• No way to withdraw. Withdrawal has to be as easy as giving it, which in practice means a permanently reachable link, not a one-time banner that never returns.
• A cookie wall that makes access conditional on accepting tracking, where no genuine alternative exists.

The practical test takes a minute and needs no tooling. Open the site in a fresh private window, open the network panel, and load a page without touching the banner. If requests to analytics or advertising hosts are already in flight, the banner is not doing anything.

The cookies you do set: three flags and a lifetime

Consent decides whether a cookie may exist. These decide whether the one you are allowed to set is safe. All four are visible in a response header, which is why they are checkable at all.

• Secure - the cookie is only ever sent over HTTPS. Without it, one plain-HTTP request anywhere on the domain hands the session to whoever is on the network.
• HttpOnly - script cannot read it. This is what turns a cross-site scripting bug from a session theft into a contained incident.
• SameSite - Lax is the sensible default; Strict breaks a session arriving from an external link; None requires Secure and is only for genuinely cross-site flows.
• A lifetime that matches the purpose. A session cookie that expires in two years is not a session cookie, and a consent record kept for a decade is a record you cannot justify.

Session cookies and consent are separate questions with separate answers. A session cookie for a signed-in user needs no consent and does need all three flags; an analytics cookie needs consent and is not made lawful by carrying the flags.

The documents, and what each one has to actually contain

Linked from every page, reachable without a login, and specific enough to be useful. A privacy policy that could belong to any company is a template, and a reader can tell.

• A privacy policy naming the controller, the purposes, the legal basis for each purpose, the retention period, the recipients, and the rights available - with a route to exercise them that a person can actually follow.
• A cookie policy listing what is set, by whom, why, and for how long. Categories rather than a table of individual names is fine; "we use cookies to improve your experience" is not.
• A contactable data protection address. It does not have to be a formal DPO unless you need one; it does have to reach a human.
• Terms, if you sell anything.
• An accessibility statement if you are in scope for the EU Accessibility Act or a national equivalent - increasingly a document a public-sector buyer asks for before anything else.

What no scan can tell you, including ours

This is the part that decides whether a compliance score means anything. Everything above is externally visible, which is exactly why it is checkable - and it is a small fraction of what compliance is.

• Whether your legal basis is the right one for what you actually do with the data
• Whether a record of processing activities exists and is current
• Whether processor agreements are in place with every vendor receiving personal data
• Whether transfers outside the EEA have a lawful mechanism behind them
• Whether a data protection impact assessment was done where one was required
• Whether a subject access request would actually be answered inside a month
• Whether a breach would be reported inside 72 hours, and by whom

A tool that scores those is guessing. The honest arrangement is two layers: the visible signals checked automatically on every deploy, and the rest recorded as an explicit attestation that a named person dated and signed - never quietly folded into a percentage.

And the obvious caveat, stated plainly rather than in small type: this is a technical guide written by people who build audit tooling, not legal advice. It will help you find the mechanical failures. It will not tell you whether your processing is lawful, and anyone claiming a scanner can is selling you something.