Privacy & Security

Understanding Cookie Banners in Plain Language

By Marcus Delgado / October 26, 2026 / Updated November 8, 2026

Quick answer: A cookie banner is a website asking permission to store or read tracking data on your device. If you do not need personalised ads or the site’s extras, pick “Reject” or “Necessary only”, or open “Manage” and switch everything non-essential off. For a standing “no”, turn on Global Privacy Control and block third-party cookies in your browser. A banner is a speed bump, not a privacy shield.

Key takeaways

Trackers use cookies and also fingerprinting, which clearing cookies does not stop.
EU rules ask first, with exceptions for what a site strictly needs. California works mainly through opt-out rights, including Global Privacy Control.
France’s regulator says rejecting should be as easy as accepting, and the US FTC found dark patterns in cookie banners.
Browser settings plus Global Privacy Control give you a “no” that lasts longer than one click.

Cookies, trackers and why banners exist

What cookies and trackers are

The Electronic Frontier Foundation (EFF) explains that cookies are stored in your browser so sites can remember things such as your login. The same mechanism can link your visits across sites, and deleting cookies breaks that link. Trackers are often hidden ad scripts that collect details about your browser and device and, over time, build a profile. Safari’s documentation names the worry: third-party content providers following you across websites, commonly for advertising. Hence the hiking boots that chase you around the internet.

The EU rules

Article 5(3) of the ePrivacy Directive says storing information on a person’s device, or reading what is already there, is allowed only with their consent, after clear and full information about the purpose. There are two exceptions: storage needed solely to carry a communication, and storage strictly needed for a service you explicitly asked for. That is why many banners show a “necessary” group you cannot switch off.

The GDPR supplies the definition of consent. Under its Article 94, references to the old data protection directive now point to the GDPR. Article 4(11) says consent must be freely given, specific, informed and unambiguous. Recital 32 says silence, pre-ticked boxes or inactivity do not count, and Article 7(3) says withdrawing consent must be as easy as giving it. National regulators enforce all this, and details vary by country.

California and other US states

California’s CCPA takes a different route. The state Attorney General lists your rights as knowing what a business collects, deleting it, correcting it, opting out of the sale or sharing of your information, and limiting use of sensitive information. Businesses that sell or share personal information must offer a clear “Do Not Sell or Share My Personal Information” link, and must honor a Global Privacy Control signal as an opt-out request. The Attorney General or the California Privacy Protection Agency enforces it, and you can complain to either. The Global Privacy Control project notes that other state laws resemble the CCPA, but details differ, so check your own state.

Roughly: the EU model asks before, and California’s lets you say stop.

What accept, reject and manage really do

Accept: you consent to the uses described, typically analytics, advertising and personalisation.
Reject or Necessary only: only storage that fits the exceptions above should happen.
Manage: category switches. Turn off everything non-essential, then press Save. Do not wander off before saving.
Closing the banner with an X: unclear, and it varies by site. Prefer an explicit Reject.

Changed your mind? Look for a cookie settings link, often at the bottom of the page. Withdrawing should be as easy as agreeing was. For a clean slate, clear your browser’s cookies too (steps below).

Situation	What to click	Why
One-off visit to read an article	Reject all or Necessary only	The page still loads and less data is collected
A site you use daily	Reject non-essential, keep necessary	Necessary storage covers things like staying logged in
Big Accept button, faint Reject link	Find the Reject or Manage option	Regulators have criticised this layout
Manage lists many switches	Switch every non-essential one off, then Save	Unsaved changes may not count
A creator you want to support with ad revenue	Accept is a fair choice	Your call, made knowingly
You see “Do Not Sell or Share” (California)	Use it, or turn on Global Privacy Control	The CCPA gives you that right
Shared or public computer	Reject, then clear site data afterwards	The next person should not inherit your trail
A “cookie” pop-up asking you to download something or log in	Leave the page	A genuine cookie banner has no need for either

Dark patterns: spotting a rigged banner

The US Federal Trade Commission’s September 2022 staff report, Bringing Dark Patterns to Light, looked at manipulative design in e-commerce, cookie consent banners, children’s apps and subscriptions. It found companies increasingly using sophisticated designs, including privacy choices built to nudge people toward sharing the most. The FTC also alleged that a smart-TV maker used default settings to collect and share viewing activity, with an easily missed notice.

In Europe, France’s CNIL ordered several website publishers on 12 December 2024 to change banners after complaints, giving them one month. It objected to a reject option shown as a text link styled to be far less prominent than accept, buried in surrounding text, squeezed in with too little spacing, or offered once with vague wording while accept appeared several times. The CNIL’s position is that rejecting should be as easy as accepting. The European Data Protection Board has also published final guidelines (version 2.0, 24 February 2023) on deceptive design patterns in social media interfaces.

Red flags: a bright Accept button beside a grey text link, Reject hidden on a second screen, pre-ticked switches in Manage, and vague wording where “Reject” should be.

Take control in your browser

Global Privacy Control (GPC) is a proposed standard that sends websites a one-step signal that you do not want your data sold or shared. The GPC site lists Brave and DuckDuckGo (on by default) and Firefox (a settings option) as browsers with built-in support, plus extensions including Disconnect, OptMeowt and EFF’s Privacy Badger. Under the CCPA and similar laws it is meant to act as an opt-out request. Under the GDPR the site describes it as a general request to limit sale or sharing. The W3C took it on as a work item in November 2024. It is a request, so its force depends on the site honoring it, which California law requires.

Browser	Clear cookies	Block cross-site tracking
Chrome (desktop)	More, then Delete browsing data, then tick Cookies and other site data. For one site: More, Settings, Privacy and security, Third-party cookies, See all site data and permissions	Settings, Privacy and security, Third-party cookies, choose the block option. Incognito blocks them by default
Safari (Mac)	Safari, Settings, Privacy, Manage Website Data, then Remove or Remove All	Same Privacy pane, tick Prevent cross-site tracking
Edge	Settings and more, Settings, Privacy, search, and services, or press Ctrl+Shift+Delete	Under Cookies, block third-party cookies

Mobile steps and Firefox’s menu paths were not verified here, so check each browser’s own help page.

Checklist:

Turn on Global Privacy Control, in browser settings or with an extension.
Block third-party cookies or turn on cross-site tracking prevention.
Add a tracker blocker if you want one. EFF names Privacy Badger and Disconnect.
Clear cookies for sites you do not trust, and expect to be signed out.

What banners do not protect you from

Fingerprinting: EFF says clearing cookies will not stop it, because it relies on persistent browser and hardware traits. Tweaking single settings can make you easier to pick out.
Things you hand over directly: a banner covers device storage, not what you type into a form.
Device defaults: the smart-TV case above sat outside any banner.
Data already collected: in California, use your rights to know and delete.
Rigged or ignored choices: regulators can act, and you can complain.

Common mistakes

Clicking Accept just to make the pop-up vanish.
Toggling in Manage and not saving.
Treating Incognito as invisibility. EFF says private modes mainly stop local history being stored.
Clearing everything daily, then grumbling about logging in again.

Frequently asked questions

Is clicking “Accept all” a big deal?

It is a privacy decision: you agree to the described tracking. You can withdraw later and clear your cookies.

Why do I see banners in the US?

Some sites show one design to everyone. Legally, the EU asks first, while California gives opt-out rights and a “Do Not Sell or Share” link. It varies by state.

Does Global Privacy Control replace banners?

No. It is a request about sale and sharing, which the CCPA requires businesses to honor. A banner may still ask about analytics or ads.

Will blocking cookies break websites?

Sometimes. Edge warns some pages may not display properly with third-party cookies blocked, and clearing cookies signs you out. Chrome lets you add a single site as an exception.

Before you decide

You do not need to read every banner. Pick a default (reject non-essential for most sites), set it once in your browser, and save your attention for banners that try to trick you. Accepting is allowed too, if you know what you agreed to.