GDPR Cookie Consent for Developers Part 1

GDPR Cookie Consent for Developers: A Practical Guide to Compliance

tl;dr

Depending on what your application does, you have differing obligations - or none. See the table below for quick reference.

‍

Introduction

The General Data Protection Regulation (GDPR), also known as DSGVO in german-speaking jurisdictions, effective since May 25, 2018, has had a profound impact on your browsing experience. You have seen the banners.

Developers bear the brunt of this regulation, since it's unreasonable to learn how to interpret arcane legal documents while getting paid too little to get some website up and running.

Depending on who you ask, you will be told that you need to implement an audit trail of consent interactions, or some "accept all" buttons with no underlying functionality does the job. Both can be true, but who wants to get fined possibly millions to find out personally?

‍

This article will give devs a reference which will cover most web-based use cases and help map the functionality you implemented to the minimal compliance requirements.

‍

Why GDPR matters for Cookies

Cookies, small text files stored on users' devices, can collect personal data like IP addresses or browsing behavior, making them subject to GDPR if they identify individuals. Non-compliance risks hefty fines—up to €20 million or 4% of annual global turnover, whichever is higher. Recent enforcement trends show increased scrutiny: in 2023, fines for cookie-related violations spiked, with cases like a €40 million penalty against a major tech firm for non-compliant consent practices. The ePrivacy Directive, which complements GDPR, further mandates explicit consent for non-essential cookies. For developers, this means ensuring applications align with legal requirements without breaking functionality.

‍

For the official GDPR text, refer to the EU's GDPR Regulation: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679

‍

Core Principles for Developers

GDPR and the ePrivacy Directive require:

- Informed Consent: Users must know what data cookies collect, why, and by whom before consenting.

- Granular Control: Users should choose which cookie categories (e.g., analytics, marketing) to allow.

- Transparency: Cookie policies must be clear, accessible, and linked from banners.

- Easy Withdrawal: Revoking consent must be as simple as giving it.

- Audit Trail: Document consent to prove compliance during audits.

- No Cookie Walls: Access to services cannot be conditional on non-essential cookie consent.

‍

These principles apply differently depending on your application's complexity, from static sites to SaaS platforms.

‍

Application Logic vs Cookie Banner Requirements

Below is a table outlining how different application logics impact cookie banner requirements, consent storage, and related considerations. It covers the spectrum from static "business card" websites to SaaS platforms handling highly sensitive data.

Consent Audit Trail: When and How

A consent audit trail is necessary whenever non-essential cookies are used, as GDPR requires proof of compliance (Article 7). Here's how to implement it:

‍

What to Store:

• User Identifier: Anonymous ID or session ID (avoid personal data unless necessary)
• Timestamp: Date and time of consent
• Consent Details: Categories accepted (e.g. analytics, marketing)
• Policy Version: Link to the cookie policy version at the time of consent
• Method: How consent was given (e.g. banner click, preference center)
• Withdrawal Option: Proof that users can revoke consent (e.g. preference center access)

‍

Storage Mechanism

• Static Sites with Analytics: Local storage or a simple JSON file on the server suffices for small-scale consent tracking
• Dynamic Sites/SaaS: Use a database (e.g., MySQL, PostgreSQL) or a CMP like OneTrust or Cookiebot to automate logging. Ensure encryption for stored consent data to comply with GDPR's security principle (Article 32)
• High-Sensitivity SaaS: Enterprise-grade databases with audit-ready reporting (e.g., MongoDB with audit plugins or CMPs with compliance dashboards). Retain logs for at least 12 months or as required by local regulations

‍

When it’s necessary:

Required for any site using non-essential cookies. For raw static sites with no cookies, no audit trail is needed. For SaaS platforms, especially those handling sensitive data, robust audit trails are critical to demonstrate compliance during regulatory audits.

‍

Handling Encrypted Personal Data

For SaaS platforms storing highly personal data (e.g., medical journals) encrypted on the user's device with no access to decryption keys, GDPR obligations are reduced but not eliminated:

• Data Processing: If the SaaS cannot access the data (e.g., end-to-end encryption), it's not considered a data processor for that data under GDPR (Article 4). However, cookies used for tracking or analytics still require consent.
• Cookie Compliance: Tracking cookies (e.g., for usage analytics) still fall under GDPR and ePrivacy Directive. You must implement a consent banner and audit trail as described above. 
• Policy Clarity: Explicitly state in your cookie and privacy policies that user data is encrypted client-side and inaccessible to the SaaS. This builds trust and clarifies your limited role in data processing.
• DPIA Consideration: Even with encryption, a Data Protection Impact Assessment may be required if tracking cookies process personal data (Article 35). Consult a legal expert to confirm.

‍

Implementation Tips for Developers

• Use a CMP: There exist tools to help navigate the jungle. They handle varying degrees of automagical integration and customizability from audit logs to the UI:
  
  • Cookieyes: https://www.cookieyes.com/
  • Cookiebot: https://www.cookiebot.com/de/
  • Termly: https://termly.io/
• Geo-Targeting: Use geolocation to display banners only to EU users, as GDPR applies to EU residents regardless of your business's location (Article 3).
• Avoid Dark Patterns: Ensure "Reject" buttons are as prominent as "Accept" buttons. Pre-ticked boxes for non-essential cookies are non-compliant.
• Regular Audits: Scan your site quarterly for new cookies introduced by third-party scripts (e.g., via updates to analytics tools). Of course this applies only if regulations or page functionality changed.
• Secure Storage: Encrypt consent logs and store them securely to comply with GDPR's integrity and confidentiality principle.
• User-Friendly Policies: Write cookie policies in plain language, avoiding jargon. Include a link in your site's footer and banner.

‍

Example Cookie Banner Code

Below is a minimal example of a GDPR-compliant cookie banner for a static site with analytics, using JavaScript and local storage. For SaaS, consider integrating with a CMP for scalability.

<!DOCTYPE html>
<html>
<head>
 <title>GDPR Cookie Banner</title>
 <style>
   .cookie-banner {
     position: fixed;
     bottom: 0;
     width: 100%;
     background: #333;
     color: #fff;
     padding: 20px;
     display: none;
     justify-content: center;
     align-items: center;
     z-index: 1000;
   }
   .cookie-banner button {
     margin: 0 10px;
     padding: 10px 20px;
     cursor: pointer;
   }
   .cookie-banner a {
     color: #fff;
     text-decoration: underline;
   }
 </style>
</head>
<body>
 <div id="cookieBanner" class="cookie-banner">
   We use cookies for analytics. <a href="/cookie-policy">Learn more</a>.
   <input type="checkbox" id="analyticsConsent"> Enable Analytics Cookies
   <button onclick="saveConsent()">Save</button>
   <button onclick="rejectAll()">Reject All</button>
 </div>

 <script>
   // Check if consent is already given
   if (!localStorage.getItem('cookieConsent')) {
     document.getElementById('cookieBanner').style.display = 'flex';
   }

   function saveConsent() {
     const analyticsConsent = document.getElementById('analyticsConsent').checked;
     const consentData = {
       analytics: analyticsConsent,
       timestamp: new Date().toISOString(),
       policyVersion: '1.0'
     };
     localStorage.setItem('cookieConsent', JSON.stringify(consentData));
     document.getElementById('cookieBanner').style.display = 'none';
     if (analyticsConsent) {
       // Load analytics script (e.g., Google Analytics)
       // Example: const script = document.createElement('script'); script.src = 'ga.js'; document.head.appendChild(script);
     }
   }

   function rejectAll() {
     localStorage.setItem('cookieConsent', JSON.stringify({
       analytics: false,
       timestamp: new Date().toISOString(),
       policyVersion: '1.0'
     }));
     document.getElementById('cookieBanner').style.display = 'none';
   }
 </script>
</body>
</html>