Cookie Consent in 2026: What Changed and What Your Website Must Do Now

7 min read

If you have been struggling with cookie compliance on your website, you are in good company. Many organizations discover their cookie consent implementation is no longer compliant with rules that became enforceable in 2025-2026. The regulatory landscape shifted significantly, and what was acceptable practice in 2022 is now a liability.

Managing your website’s cookie compliance is a lot like maintaining a car. When you first bought it, everything was in order. But without regular attention, small issues pile up. By the time regulators look under the hood, what seemed like minor oversights can look a lot like deliberate neglect.

Your 2022 Cookie Banner Is Probably Non-Compliant Today

If your website still has the cookie banner you deployed in 2022 or early 2023, it’s almost certainly non-compliant with rules that became enforceable in 2025-2026.

Common patterns include cookie banners with pre-checked boxes for non-essential cookies, dark patterns that make “reject all” hard to find, missing opt-out mechanisms for targeted advertising, and no documentation showing when or how consent was obtained. None of these would have been flagged as critical violations three years ago. Today, they’re liability.

The regulatory landscape around cookies shifted significantly in 2025-2026. If you haven’t revisited your cookie consent implementation since the CPRA became operative in 2023, this post is for you.

What Has Actually Changed Since 2022

Several regulatory developments converged in 2025-2026 that directly affect how cookies must be handled:

CPRA Rulemaking Finalized (Early 2026)

The California Privacy Rights Act (CPRA) became operative in January 2023, but the California Privacy Protection Agency (CPPA) didn’t finalize cookie-specific rules until early 2026. The CPPA’s guidance clarified that persistent cookies used for cross-context behavioral advertising or activities that constitute a “sale” or “share” of personal information require affirmative opt-in consent before the cookie is deployed. This means no pre-ticked boxes, no “implied consent,” and no requiring users to navigate multiple screens to opt-out.

CNIL (French DPA) Enforcement

The Commission Nationale de l’Informatique et des Libertés (CNIL), France’s data protection authority, issued updated guidance in 2025 clarifying that accept and refuse buttons must be equally prominent. Dark patterns (making one option visually prominent and the other hidden or hard to find) violate GDPR (General Data Protection Regulation) and expose companies to significant fines. CNIL has been actively investigating websites and issuing citations.

ICO (UK) Guidance Updates

The UK’s Information Commissioner’s Office updated its cookie guidance in 2025 to align with CNIL’s dark patterns framework and to clarify that consent must be freely given, specific, and informed. Pre-loaded consent for non-essential cookies is not freely given.

Chrome Privacy Sandbox Evolution

Google’s phased deprecation of third-party cookies continues in 2026, with ongoing changes to how tracking is managed. While Google has delayed full cookie deprecation, the Privacy Sandbox initiative is shifting tracking toward alternative mechanisms (Topics API, Protected Audience API, etc.). This affects how consent is structured and how analytics vendors operate. Companies can’t just move tracking from cookies to pixels. The consent requirements follow the tracking, not the technology.

CPRA’s New Cookie and Pixel Rules (2026)

This is where most companies are falling short. The CPRA rules finalized in 2026 clarified that cookies and pixels used for certain purposes require explicit opt-in consent before deployment:

What Requires Affirmative Opt-In (Pre-Consent)

• Cookies and pixels that follow a user across websites (cross-context tracking) for behavioral advertising or profiling
• Cookies/pixels that constitute a “sale” of personal information (sharing data with advertisers or data brokers who use it for their purposes)
• Cookies/pixels that constitute “sharing” of personal information (sharing for cross-context behavioral advertising specifically)
• Pixels that perform data broker functions (collecting data from a website and licensing it to third parties)

What Doesn’t Require Pre-Consent (Essential/Functional Only)

• Cookies necessary for the website to function (authentication, session management, form data)
• Cookies that measure website performance or usage (analytics) if they don’t track across sites
• Cookies that remember user preferences on your site only

The distinction matters because essential cookies don’t require consent and can be deployed immediately. Non-essential cookies require affirmative consent before they’re deployed. Most companies get this backwards: they deploy cookies and then ask for consent after the fact.

What the CNIL (France) and ICO (UK) Guidance Now Requires

Both regulators emphasize three principles that apply across Europe and anywhere you’re processing EU/UK user data:

1. Equal Prominence of Accept and Refuse Buttons

Your “Accept All” button cannot be larger, brighter, or faster-loading than your “Reject All” button. Dark patterns, making one choice visually easier or more prominent, are violations. The CNIL has cited companies for subtle differences in button size (22px vs. 20px), so take this seriously.

2. Freely Given Consent Must Not Be Conditional

You cannot require users to accept cookies in order to access your website. This includes “consent walls” where the user can’t browse until they accept all cookies. Users must be able to refuse non-essential cookies and still access the site with full functionality. If you can’t provide site access without analytics or advertising cookies, those aren’t non-essential: they’re essential, and they don’t require consent.

3. Granular Consent Options

Users must be able to accept some cookie categories and reject others. “All or nothing” consent options are not sufficient. At minimum, separate: (1) essential, (2) analytics, (3) advertising/marketing, and (4) any other third-party tracking.

Chrome’s Privacy Sandbox and What It Means for Consent

Google’s third-party cookie deprecation in Chrome (originally planned to complete in 2024, now extended into 2026+) is shifting how tracking works. But deprecation doesn’t mean tracking stops. It means the mechanism changes.

The Privacy Sandbox introduces new technologies: Federated Learning of Cohorts (FLoC, now Topics API), Protected Audience API (formerly FLEDGE), and others. These attempt to enable targeted advertising without individual-level tracking across sites.

From a consent perspective, this creates ambiguity: if a company is using Topics API instead of third-party cookies, do the CPRA and GDPR cookie rules apply? The current guidance (as of early 2026) is that if the tracking technology can identify or profile individuals across contexts, GDPR/CPRA consent rules apply. The technology doesn’t matter. The profiling does.

Many companies are adding pixels and tags to implement Privacy Sandbox APIs. These pixels still require consent if they serve tracking purposes. You can’t avoid consent requirements by switching from cookies to pixels to proprietary tracking APIs.

What a Compliant Cookie Consent Implementation Looks Like

Here’s the checklist for a 2026-compliant cookie implementation:

1. Classify Your Cookies and Tags

Document every cookie and pixel on your site. Classify each as essential (necessary for functionality) or non-essential (analytics, advertising, personalization). Be honest: if you’re using analytics to improve user experience, it’s analytics. It’s not essential.

2. Obtain Pre-Consent for Non-Essential Cookies

Before deploying any non-essential cookie, pixel, or tracking tag, obtain explicit consent. This means your consent banner or cookie consent modal loads and captures consent BEFORE the tracking code fires. Many implementations deploy the tracking code immediately and then load the consent banner. That’s backwards and non-compliant.

3. Use a Consent Management Platform

Don’t build consent management yourself. Use an established Consent Management Platform (CMP): OneTrust (which Solvation partners with), Ketch, Usercentrics, CookieYes, or similar. These platforms handle the technical complexity of storing consent signals, respecting user choices across domains, and generating audit logs.

4. Implement Equal Prominence

Your consent banner must have equally prominent accept and reject buttons. Test this with your legal and compliance team. If there’s visual or functional difference that makes one choice easier, fix it.

5. Honor Browser Signals and User Choice

Respect the Global Privacy Control (GPC) signal and similar browser-based opt-out signals where applicable (especially under California Consumer Privacy Act (CCPA)). If a user has opted out in their browser settings, honor that choice on your site.

6. Document and Log Consent

Your CMP should generate audit logs showing: when consent was obtained, what version of the consent banner was shown, what the user consented to, and when/how they withdrew consent. These logs are your defense if regulators question your consent practices.

7. Update Your Privacy Policy

Your privacy policy must describe each cookie and tracking technology, its purpose, how long it persists, and whether it requires consent. If your privacy policy doesn’t list every tracking tag on your site, it’s incomplete.

Common Banner Mistakes That Regulators Are Citing

In enforcement actions and audit findings, regulators consistently cite the same problems:

• Pre-ticked boxes: non-essential cookies with pre-checked consent. The user must actively opt-in, not opt-out.
• Non-prominent reject option: a small “Customize” link that requires three clicks to reject cookies, versus a large “Accept All” button. Make reject as easy as accept.
• Consent given after deployment: the tracking code fires before the user consents. This violates the “before” requirement.
• Consent walls: blocking site access unless the user accepts all cookies. Users must be able to refuse and still navigate the site.
• No records of consent: no audit trail showing what the user consented to. Regulators will ask for this.
• Outdated privacy policy: the policy lists one set of cookies, but your site actually deploys a different set. This is a compliance violation.
• No cookie categories: “All or nothing” consent where users can’t selectively opt-in. They must be able to accept analytics but reject advertising, for example.

CMP Selection: What to Look for in a Consent Management Platform

When implementing or updating a Consent Management Platform (CMP), look for these capabilities:

• Pre-consent deployment control: the CMP prevents non-essential scripts from firing until consent is obtained
• Consent logging and audit trails: detailed records of what was consented to, when, and by whom
• Multi-jurisdiction support: different consent rules for EU (GDPR), California (CCPA/CPRA), and other jurisdictions
• Granular cookie categories: ability to offer separate controls for analytics, advertising, personalization, etc.
• Browser signal respecting: honors GPC and similar privacy signals from browser settings
• Integration with tag managers: works with Google Tag Manager, Adobe Launch, or similar to control what tags fire
• Mobile app support: if you have a mobile app, the CMP should handle consent in-app as well
• Regular updates: the vendor actively updates the platform as regulations change

OneTrust, Ketch, and Usercentrics are market leaders. All three meet the above requirements. Smaller or cheaper platforms often cut corners on audit logging or pre-consent control.

Next Steps

Cookie compliance in 2026 is more complex than it was in 2022, but the fundamentals are straightforward: classify your cookies, obtain pre-consent for non-essential ones, use an established CMP, and document everything. Most compliance gaps come from rushing the implementation or underestimating how strict regulators have become on dark patterns and banner design.