The cookie banner done right: what the law requires and what annoys visitors for nothing

The cookie banner is the first thing a visitor sees when they open your site. Before the logo, before the offer, before the first good photo. And most of the time it's done badly: either it breaks the law and leaves you exposed, or it forces the visitor to click three times and hunt for a hidden button just to say "no". Either way, you lose — either against the data authority, or against the customer who closes the page in annoyance.

The good news is that a correct banner isn't complicated. It's just that almost nobody explains it to you in plain language. Let's clear up exactly what the law requires and what's just a needless headache.

Two laws, not one: this is where the confusion comes from

People talk about "cookies and GDPR" as if it were a single thing. In fact there are two rules working together:

• The ePrivacy Directive (transposed in Romania through Law 506/2004) says something simple: you're not allowed to set cookies that aren't strictly necessary before the person agrees. Google Analytics cookies, the Facebook Pixel, remarketing — all of those must wait for consent. The strictly technical ones (the shopping cart, the login session) don't need consent.
• GDPR says *how* that consent has to look: freely given, clear, informed, and as easy to withdraw as it was to give.

In practice, that means the banner has to appear before the tracking scripts load, not after. Many sites in Romania load Analytics in the first second and only then show the "accept cookies?" banner. It's like asking your guest whether they want to come in after you've already taken their photo in the hallway. Technically, it's a breach.

What the law requires, briefly and without legalese

A correct banner ticks a few clear boxes:

• It blocks tracking until acceptance. Non-essential scripts start only after the person clicks "Accept". That's the core.
• "Accept" and "Reject" equally visible. A big green "Accept all" button next to a faded grey "Settings" link is not free choice. The European Data Protection Board (EDPB) guidance requires refusal to be as easy to reach as acceptance.
• No pre-ticked boxes. Consent means a clear action from the person. A box already ticked is not agreement, it's an assumption — and it's explicitly forbidden.
• Categories, not a single "yes". Analytics separate from marketing separate from necessary. The person can accept only part.
• They can change their mind. A small, permanent button that lets them change their choice at any time. As simple as it was at the start.
• A cookie policy that says what, why and for how long. Not a wall of copied text, but the real list of the cookies you use.

The tricks that look clever and cost you

These are "dark patterns" — tricks that push the person toward "yes" through visual manipulation. They look like a short-term win, but the data authority treats them as if consent didn't exist, and the customer feels them and leaves annoyed.

• The reject button hidden two or three clicks deep, while "Accept all" is a finger away.
• Refusal made deliberately tedious — you have to untick 40 "partners" one by one.
• The cookie wall — "accept everything or you don't get on the site". In the vast majority of cases this isn't free consent, so it isn't valid.
• The colour that fools you — refusal written in grey on white, almost invisible, while accept shouts in green.
• The banner that comes back on every page if you haven't said "yes", to wear you down.

The rule we work by is simple: if an element exists to fool the person, sooner or later it costs you — either a fine or their trust.

What a banner that annoys nobody looks like

The nice paradox is that the legally correct banner is also the least annoying one. A short message, two equal buttons, one category you can untick, done. The person clicks in two seconds and gets on with their day. You don't hold them hostage, you don't trick them, you don't wear them out.

On the sites we build, we put the correct banner in from the start — not as an obligation ticked off at the end, but as the first impression you leave. A clean banner says, without words: "this company is serious and respects you".

If you sell online or use tracking for ads, the subject matters even more — it's worth reading how much a website costs to see where the compliance part fits, and do I need a website if you still work only from your Facebook page.

What it costs to have the correct banner

The good news: it isn't a separate expense. With us, the correctly configured cookie banner is included in every site we build.

On an online store, where you have the Pixel, Analytics and remarketing, the configuration is more involved — but it stays part of the project, not a surprise cost.

Let us show you on your own site

The simplest thing is to show you concretely. We'll build you a free demo site for your business, with the cookie banner already done correctly, so you can see the difference with your own eyes — no tricks, no headache, no scaring customers away.

Write to us on WhatsApp: wa.me/40750257140. Tell us what you do and we'll send the demo.