Cookies and GDPR: How to Configure Cookie Consent

GDPR and similar personal data protection laws require users' consent before non-essential cookies are set. The absence of a proper consent mechanism can result in fines and blocks imposed by regulators.

You can check your website's cookies using Cookie Analyzer on rechecker.ru.

Which cookies require consent

Strictly necessary (no consent required)

Cookies without which the website cannot perform its basic functions:

• Authentication session
• Online store shopping cart
• Language/region settings
• CSRF protection
• Load balancing

Require consent

• Analytics (Google Analytics, Yandex Metrica)
• Advertising and retargeting cookies
• Social widgets (“Share” buttons)
• Chat widgets with tracking
• Any cookies used for profiling and targeting

GDPR consent requirements

Consent must be:

1. Freely given — without pressure or hidden conditions
2. Informed — the user understands what they are consenting to
3. Specific — by category (analytics, marketing, preferences)
4. Unambiguous — a clear action (click, checkbox), not pre-selected
5. Easy to withdraw — it must be just as easy to withdraw consent as to give it

Consent banner: what it should include

Minimum requirements

• A brief description of how cookies are used
• A link to the privacy policy
• “Accept” and “Reject” (or “Settings”) buttons
• The ability to change the choice later (in the footer or settings)

Extended option

• Categories: necessary, analytics, marketing, preferences
• Toggles for each category
• Store the choice in a cookie for a reasonable period (for example, 12 months)

Consent Mode (Google)

Google Consent Mode v2 allows tags (Analytics, Ads) to run based on consent:

gtag('consent', 'default', {
  'analytics_storage': 'denied',
  'ad_storage': 'denied',
  'ad_user_data': 'denied',
  'ad_personalization': 'denied'
});

// После согласия пользователя
gtag('consent', 'update', {
  'analytics_storage': 'granted',
  'ad_storage': 'granted',
  'ad_user_data': 'granted',
  'ad_personalization': 'granted'
});

Before consent is updated, analytics and advertising scripts must not load or must operate in anonymous mode.

Storing proof of consent

It is recommended to record:

• Time of consent
• Version of the text/policy
• IP (if permitted under the policy)
• Session identifier

This may be needed during inspections. Implementation options include logs, a database, or a CMP (Consent Management Platform).

Simple banner example (HTML/JS)

<div id="cookie-banner" class="cookie-banner">
  <p>Мы используем cookies для аналитики и улучшения сайта. 
     <a href="/privacy">Политика конфиденциальности</a></p>
  <button onclick="acceptCookies()">Принять все</button>
  <button onclick="rejectCookies()">Только необходимые</button>
  <button onclick="showSettings()">Настроить</button>
</div>

<script>
function acceptCookies() {
  setConsent({ analytics: true, marketing: true });
  document.getElementById('cookie-banner').style.display = 'none';
  // Загрузить аналитику
}
function rejectCookies() {
  setConsent({ analytics: false, marketing: false });
  document.getElementById('cookie-banner').style.display = 'none';
}
function setConsent(prefs) {
  localStorage.setItem('cookie_consent', JSON.stringify({
    ...prefs,
    timestamp: Date.now()
  }));
}
</script>

Integration with Google Tag Manager

1. Create variables based on the consent cookie or localStorage
2. Configure triggers so tags load only when analytics_storage = granted
3. Use Consent Mode or custom triggers

Privacy policy

The policy should include:

• A list of cookies used, by category
• Purposes of use
• Retention period
• Ways to withdraw consent
• Links to third-party policies (Google, Facebook, etc.)

Regular checks

Cookies change when the website and integrations are updated. Check periodically:

• Cookie Analyzer — cookie list, attributes, GDPR compliance
• Security Headers — headers that affect security

Connection to cookie security

Technical configuration of cookie attributes (Secure, HttpOnly, SameSite) is described in Cookie security: Secure, HttpOnly, and SameSite attributes.