GDPR Cookie Consent Guide for Non-EU Websites
Complete cookie consent guide for non-EU websites. ePrivacy Directive, GDPR cookie rules, consent management platforms, EU Rep from EUR 490/yr.
If your website serves EU visitors, you need a compliant cookie consent mechanism under the ePrivacy Directive and GDPR. This applies regardless of where your business is based — a US website with EU traffic must obtain valid consent before dropping non-essential cookies.
What the Law Requires
The ePrivacy Directive (2002/58/EC, amended 2009) requires that websites obtain informed consent before storing or accessing information on a user’s device. GDPR Article 7 adds that consent must be freely given, specific, informed, and unambiguous. Together, this means:
- Prior consent: No cookies loaded before the user has made a choice (except strictly necessary cookies)
- Granular choice: Users must be able to accept/reject different categories (analytics, marketing, functional)
- Easy to withdraw: Withdrawing consent must be as easy as giving it
- Recorded consent: You must keep evidence of consent given
Cookie Categories
Strictly necessary: No consent needed. Session cookies, shopping cart cookies, CSRF tokens.
Functional/Preference: Consent needed (usually bundled with necessary). Language, region, display settings.
Analytics: Consent needed. Google Analytics, Plausible, Matomo — any tracking of user behaviour.
Marketing/Tracking: Consent needed. Facebook Pixel, Google Ads, retargeting, advertising cookies.
Consent Management Platforms (CMPs)
A CMP handles cookie scanning, consent banners, preference centres, and consent records. Popular options include Cookiebot, CookieYes, Osano, OneTrust, and Termly. Comparison →
Cookie Consent + Article 27
Having a cookie banner does not satisfy Article 27. You still need an EU Representative as a separate obligation. EU Shield provides this from EUR 490/year. Get started →
Best Practices
- Implement “Consent Mode v2” for Google tags to respect consent choices
- Provide a “Cookie Settings” button in your footer
- Store consent records for at least 3 years
- Use a reputable CMP — do not DIY cookie compliance
- Update your Privacy Policy to list all cookies used
Ready to get compliant?
€490/year. 15-minute setup. Active next business day.