--- title: "Cookie banner · Feature League" description: "Only three laws, but the most fines. What matters is not how the banner looks, but what the browser sends over the network before anyone clicks." url: https://featureleague.com/en/features/cookie-banner language: en --- How it can be done fairly. [Features](https://featureleague.com/en/features) / Web # Cookie banner Only three laws, but the most fines. What matters is not how the banner looks, but what the browser sends over the network before anyone clicks. - **Laws**: **3** laws - **Platforms**: Web - **Updated**: 15 October 2026 - **Status**: Draft, awaiting review by the attorney ## What to solve - Analytics, advertising and embedded services may only start after consent. Without it only what the site cannot work without may run, like the cart or sign-in. - List what the site stores and calls - Really do not run the rest, do not just hide it - On withdrawal stop the scripts and delete their cookies **Into UX:** The check does not start in the design but in the Network tab of the developer tools. Where it comes from **ePrivacy Directive 2002/58/EC**, Art. 5(3) ePrivacy Directive (s. 89(3) of the Czech Electronic Communications Act) You may store anything on the user’s device or read it from there without consent only when it is strictly necessary for the service the person asked for. Analytics, advertising and most embedded services are not. Czechia has required prior consent since 1 January 2022. EU directive · [Text](https://eur-lex.europa.eu/eli/dir/2002/58/oj) · [All features under this law](https://featureleague.com/en/laws/eprivacy) · In Czechia: Czech Electronic Communications Act No. 127/2005 Coll. (s. 89(3), cookies) and Act No. 480/2004 Coll. (s. 7, commercial communications) - Consent only counts when it is given freely and knowingly. A pre-ticked box or “by continuing you agree” is not consent. - Reject all right in the banner, as visible as accept - Separate purposes, not one consent for everything - A link to change the choice on every page **Into UX:** Two buttons of the same size. Settings is a third, smaller option. Where it comes from **General Data Protection Regulation (EU) 2016/679**, Art. 4(11), Art. 7 and the Planet49 judgment (C-673/17) Consent must be freely given, specific, informed and unambiguous. A pre-ticked box or carrying on browsing is not consent, and withdrawing it must be as easy as giving it. EU regulation · [Text](https://eur-lex.europa.eu/eli/reg/2016/679/oj) · [All features under this law](https://featureleague.com/en/laws/gdpr) · In Czechia: Czech Act No. 110/2019 Coll., on the processing of personal data - The banner is the first thing people operate. If it does not work with a keyboard or a screen reader, it blocks the whole site. - Focus starts in the banner - Buttons with readable names and contrast Where it comes from **European Accessibility Act, Directive (EU) 2019/882**, European Accessibility Act The banner is the first thing people operate on a website. On an online shop and other services covered by the act it must work with a keyboard and a screen reader, otherwise it blocks the whole site. EU directive · [Text](https://eur-lex.europa.eu/eli/dir/2019/882/oj) · [All features under this law](https://featureleague.com/en/laws/eaa) · In Czechia: Czech Act No. 424/2023 Coll., on accessibility requirements for certain products and services ## What the problem is European authorities do not fine ugly banners. They fine websites that send data to advertising and analytics services before people consent, or even after they refuse. ## How to design it Two equal buttons, “Reject all” and “Accept all”, and a third option, “Customise”. The text says what the data is for. After the choice a link stays in the corner or the footer to change it. ## In the code Third-party scripts are added to the page only after consent. Withdrawal stops them and deletes their cookies without a reload. An automated test loads the page in a clean browser and fails when a request goes to an analytics or advertising domain. ## Before you ship it - In a private window, without a click, nothing goes to analytics or advertising domains. - Rejecting works right in the banner. - After rejecting nothing starts, not even on the next page. - The choice can be changed at any time. The breakdown is a general explanation for developers and designers, not legal advice. Your feature may look different. When you need a binding assessment, write to Karel Navrátil as an attorney. [Write to Karel](https://featureleague.com/en/features/cookie-banner#kontakt) ## In depth - [Cookie lišta, která není dark pattern23. září 2026 · Shein měl na cookie liště tlačítko „Odmítnout vše“ a stejně dostal pokutu 150 milionů eur. Proč u souhlasu s cookies nerozhoduje design lišty, ale síťový provoz, a jak ji postavit tak, aby obstála.](https://featureleague.com/clanky/cookie-lista-ktera-neni-dark-pattern) --- Mgr. Karel Navrátil, attorney-at-law (Czech Bar Association No. 21034, company ID 19839448), Korunní 810/104, 101 00 Prague 10 · advokat@navratilkarel.com For AI agents: https://featureleague.com/en/agent.md The texts are general information, not legal advice on a specific matter.