Cookie Consent Banners, GDPR, and GPC:
What Actually Requires a Banner

Two Laws, Not One: Why the Confusion Exists

When you see a cookie consent banner on a website, it exists because of two overlapping but separate pieces of legislation that are almost always described as one thing: "GDPR compliance." They are not the same thing, they have different triggers, and understanding the difference changes what you actually need to do.

The two laws are:

• The ePrivacy Directive (commonly called the Cookie Law) -- an EU law that governs the placing of cookies and similar technologies on a user's device
• GDPR (General Data Protection Regulation) -- an EU law that governs the collection and processing of personal data

They are conflated because most popular analytics tools trigger both at the same time. Google Analytics 4 uses cookies (triggering the Cookie Law) and collects personal data (triggering GDPR). One banner handles the consent requirement for both, so they get treated as a single thing.

But they are not a single thing. The trigger for each is different, the compliance mechanism is different, and -- critically -- it is entirely possible to do analytics tracking that triggers neither, meaning no banner is required at all.

The Cookie Law (ePrivacy Directive): What It Actually Says

The ePrivacy Directive (2002, updated 2009) is the law that specifically created the cookie consent requirement. It says you must get consent before placing non-essential cookies or similar tracking technologies on a user's device. The operative word is "non-essential" -- cookies that are strictly necessary for the service to function (session login cookies, shopping cart cookies) are exempt. Analytics cookies, advertising cookies, and persistent tracking identifiers are not exempt.

The Cookie Law applies whenever you are placing cookies on the device of someone in the EU, regardless of where your website or company is based. A US business with a US server running EU visitor traffic still triggers the Cookie Law for those EU visitors.

The Cookie Law does not care what the cookie contains. It does not matter whether the data in the cookie is personal or anonymous. The act of writing a file to the user's device without consent is what requires the banner. Even a cookie that contains only a random session ID -- with no personal data whatsoever -- requires consent if it is not strictly necessary for the site to function.

This is why "cookieless" analytics tools can legitimately claim they do not need a consent banner: they never trigger the Cookie Law because they never write anything to the user's device.

GDPR: What It Actually Says

GDPR (2018) applies to the processing of personal data of EU residents. Personal data is any information that can identify a specific person, directly or indirectly -- names, email addresses, IP addresses in many contexts, device fingerprints, and detailed behavioural profiles all qualify.

GDPR requires a lawful basis for processing personal data. There are six possible lawful bases: consent, legitimate interest, contract, legal obligation, vital interests, and public task. For analytics, the lawful basis most businesses use is consent, because legitimate interest for tracking individual users has not generally held up under EU regulatory scrutiny.

The critical distinction from the Cookie Law is what GDPR does not apply to: anonymous data. GDPR Recital 26 says explicitly that "the principles of data protection should not apply to anonymous information" -- information from which no individual can be identified by any reasonable means. If you are collecting truly anonymous, aggregate data with no way to link it to a specific person, GDPR does not apply to it at all.

This is the legal basis for privacy-first analytics tools that claim no consent banner is needed. They are not bending the rules -- they are operating in a space that GDPR genuinely does not cover, because no personal data is in scope.

When You Need a Banner and When You Do Not

With the two laws separated, the banner question becomes straightforward. There are four scenarios:

The practical takeaway: if you are a US business that wants to track visitors by default, skip the banner, and only stop tracking when someone actively opts out, the way to do it is to use an analytics tool that collects no personal data and sets no cookies. You give up session recordings and individual user profiles, but you gain clean analytics on 100% of your traffic rather than the 40 to 70% who click Accept on a banner.

Global Privacy Control: What It Is and Where It Has Legal Force

Global Privacy Control is a browser-level signal that lets users communicate their privacy preferences to every website they visit, without having to interact with a banner on each one. When a user enables GPC in their browser, two things happen: the browser sets navigator.globalPrivacyControl = true in JavaScript, and it sends a Sec-GPC: 1 HTTP header with every request.

Brave browser enables GPC by default. Firefox users can enable it via the privacy settings or extensions. Various Chrome and Firefox privacy extensions also set it. It is not a niche signal -- it represents a meaningful and growing portion of privacy-conscious users who have made a deliberate choice at the browser level.

Where GPC has legal force

GPC has different legal status in different jurisdictions, and this is evolving:

• California (CCPA/CPRA): Legally required to honour. The California Attorney General has confirmed that GPC qualifies as a valid opt-out of the sale and sharing of personal information under CCPA. This is binding law.
• Colorado (CPA), Connecticut (CTDPA), and other US state privacy laws passed since 2022: Most include provisions requiring businesses to honour universal opt-out signals, of which GPC is the primary example. The list of states with this requirement is growing each year.
• EU (GDPR): No current explicit legal requirement to honour GPC, but France's CNIL and other data protection authorities have indicated that browser-level privacy signals expressing user preferences should be treated as a valid withdrawal of consent. It is not yet mandated, but the direction of travel is clear.
• UK (UK GDPR): Similar position to EU GDPR -- not explicitly mandated but increasingly expected by the ICO.

For a US business, respecting GPC is already a legal requirement in California and several other states. For a business with EU traffic, respecting it is current best practice even where it is not yet mandated. The implementation cost is low. The cost of not respecting it when it does become mandated is potentially high.

How to Respect GPC in Google Tag Manager

Google Tag Manager gives you a straightforward way to check the GPC signal and block all your marketing and analytics tags from firing for users who have set it. The setup takes two components: a variable that reads the signal, and a trigger that acts as an exception on every tag you want to block.

Step 1: Create the Custom JavaScript Variable

In GTM, go to Variables, click New, and choose Custom JavaScript as the variable type. Name it CJS - Global Privacy Control. Paste this as the function body:

function() {
  return navigator.globalPrivacyControl === true;
}

The === true check is important. In browsers that do not support GPC, navigator.globalPrivacyControl is undefined. undefined === true evaluates to false, so the variable returns false and your tags fire normally. Only browsers that explicitly set it to true -- Brave by default, Firefox with the right settings -- will trigger the exception.

Step 2: Create the Exception Trigger

Go to Triggers, click New, and choose Custom Event as the trigger type. Configure it as follows:

• Trigger name: Exception - GPC Opt-Out
• Event name: .*
• Use regex matching: enabled
• This trigger fires on: Some Custom Events
• Condition: CJS - Global Privacy Control equals true

The .* regex matches every event name. When used as an exception, this trigger says: for every event that fires, check whether GPC is active. If it is, block the tag. The trigger itself never fires tags -- it only acts as an exception condition on tags you apply it to.

Step 3: Apply the Exception to Your Tags

Open each tag you want to block for GPC users -- typically your GA4 configuration tag, any advertising pixels, and any remarketing tags. Scroll to the Triggering section at the bottom of the tag. You will see your firing triggers. Below that is an Exception section. Click the plus icon and select Exception - GPC Opt-Out.

Once added, the tag will fire on its normal trigger (All Pages, for example) but will be blocked from firing for any user where CJS - Global Privacy Control returns true. The tag never runs. No data is sent for that user.

Apply this exception to every tag that collects data or drops pixels. Strictly necessary tags -- such as a tag that loads a required session management script -- can be left without the exception.

Testing the setup

Install Brave browser (GPC is on by default) and use GTM Preview mode to verify. Load your site in Brave and check the Preview panel. Any tag with the GPC exception applied should appear under Tags Not Fired for every page load. Then open the same URL in Chrome (no GPC) and confirm those same tags appear under Tags Fired. If the behaviour differs between the two browsers as expected, your GPC implementation is working.

Building a Setup That Tracks by Default and Respects Opt-Outs

The model most US businesses actually want -- track everyone unless they specifically opt out -- is achievable without a consent banner, as long as the tracking itself does not trigger the laws that require one.

Here is how the three legitimate opt-out paths work:

The key point is that none of these three paths require a consent banner. A banner is the mechanism for collecting opt-in consent before tracking. If your tracking does not require opt-in consent -- because it is anonymous, or because you are operating in a jurisdiction that only requires an opt-out mechanism -- a banner is not the tool you need.

For EU users specifically: if you want to track them with any tool that sets cookies or collects personal data (including GA4 as it stands today), you do need opt-in consent and therefore a banner. The GPC exception trigger is still worth adding on top -- it covers the users whose browser signals an opt-out, which should be respected regardless of what the banner says.

FAQ