A correct cookie banner in 2026: what the law requires (and why yours probably isn’t OK)

Almost every website in Romania has a cookie banner. And almost all of them are wrong. Not because they’re missing, but because they do exactly the wrong thing: they load trackers before the user clicks anything, then ask for “consent” for show.

A banner saying “by continuing to browse you agree” or one with a single “Accept” button that loads everything anyway is not consent under GDPR. It’s a compliance liability that can cost you in an audit.

What valid consent means

Four conditions, all mandatory:

• prior — no tracker (Analytics, pixel, ads) loads before “Accept”;
• granular — the user can accept only necessary cookies and refuse marketing/analytics;
• as easy to refuse as to accept — a “Reject” button, not just a big green “Accept”;
• provable — you must be able to show, in an audit, that the user actually consented (so, recording the choices).

The common mistakes

1. The decorative banner — looks good, but Analytics is already running when it appears.
2. Only “Accept” — no real refuse option.
3. “Continued browsing = consent” — that isn’t consent, it’s a fiction.
4. No record — you can’t prove anything in an audit.

How to do it right

You use a real consent tool — Klaro (open-source) or Cookiebot — configured to keep trackers blocked until acceptance and to record the choices. Not a hand-stitched banner that only displays some text.

This is one piece of the GDPR kit — see also the broader article on what you need to be legal. And because the cookie map changes when you add a new tool, compliance stays current only with a bit of maintenance.

In short

A correct cookie banner blocks trackers until acceptance, offers refusal as easily as acceptance, is granular and records the choices. If yours loads Analytics before you click anything, you’re not covered — you only look it. Test it in incognito with the Network tab open; if you see trackers before “Accept”, write to us.