Cookies and cookie banners

When a browser loads a page, the server can include a cookie header in its response (name, value and attributes). The browser stores it and automatically sends it back with every later request to the same domain. A cookie does not run anything by itself; it only carries an identifier or a setting that the website or a third-party script then uses.

Every cookie has several attributes that control its behaviour:

• Expiry: a session cookie disappears when the browser closes, a persistent cookie lasts until a set date.
• Domain and path: define which website receives the cookie.
• Secure: the cookie is only sent over an encrypted HTTPS connection.
• HttpOnly: JavaScript on the page cannot read the cookie, which reduces the risk of session theft.
• SameSite: limits sending the cookie with requests coming from other websites.

Cookies are not programs or viruses. The privacy risk comes not from the file itself but from the identifier, which links visits from one browser over time and across websites.

By origin:

• First-party cookies are set by the website you are on (for example weboptim.eu).
• Third-party cookies are set by another domain embedded in the page, typically an ad platform, a social network or an embedded video.

By purpose (this is what matters for consent):

• Strictly necessary: login, basket, form security and storing the choice made in the cookie banner. No consent needed.
• Preference: remembering language, currency or layout, unless it is a feature the user explicitly requested.
• Analytics (statistics): traffic measurement, for example Google Analytics 4.
• Marketing (advertising): ad targeting and measurement, retargeting and tracking conversions from campaigns.

Preference, analytics and marketing cookies require prior consent under EU rules.

The basis is the EU ePrivacy Directive (2002/58/EC, Article 5(3)): storing information on a user's device or accessing it is only allowed with consent, except where it is strictly necessary to transmit a communication or to provide a service the user explicitly requested. The GDPR defines what valid consent means: freely given, specific, informed and unambiguous. In 2019 the Court of Justice of the EU confirmed in Planet49 (C-673/17) that a pre-ticked box is not valid consent.

Each member state implements the directive in national law and names its own regulator. Two examples from the markets we work in:

• Czech Republic: Section 89(3) of the Electronic Communications Act (No. 127/2005 Coll.); since 1 January 2022 an opt-in regime applies, supervised by the data protection authority ÚOOÚ.
• Slovakia: Section 109(8) of the Electronic Communications Act (No. 452/2021 Coll.), in force since 1 February 2022, supervised by the telecoms regulator ÚRSO together with the Slovak data protection authority.

The EU is negotiating changes to the rules as part of the Digital Omnibus package (Commission proposal of November 2025). As of October 2026 it has not been adopted and the draft texts differ, so the current rules above still apply.

Guidance from the Czech and Slovak regulators sets out these requirements, in line with the approach of other EU authorities:

1. Nothing except strictly necessary cookies runs before consent. Analytics and advertising scripts load only after the visitor accepts.
2. Refusing is as easy as accepting. If the first layer offers Accept all, it must also offer Reject all, ideally with the same size and colour.
3. No pre-ticked boxes for anything other than strictly necessary cookies.
4. Choice by purpose: a visitor can accept analytics and reject advertising.
5. Clear wording: a button saying OK or Got it does not express consent; use Accept or I agree.
6. The banner does not block the site: refusing must not prevent people from using it. The Slovak regulator treats closing the banner with the X as a refusal.
7. Withdrawal at any time: a link to change cookie settings should always be available, for example in the footer.
8. Cookie information: a dedicated page explaining who processes the cookies, for what purpose, for how long, who receives the data and how to withdraw consent. The site operator is responsible for describing third-party cookies too.

You must be able to prove consent (a record of when it was given and its scope). The Slovak regulator considers 12 months a reasonable validity period; the Czech regulator says the banner should reappear after a significant change in processing or when the visitor deletes their cookies.

Since 2020 Safari has blocked third-party cookies entirely by default, and Firefox isolates them per website by default. Google Chrome keeps them: in April 2025 Google announced it would not change the default behaviour, and in October 2025 it retired the remaining Privacy Sandbox technologies that were meant to replace them.

For businesses this means part of their measurement and remarketing already works differently from one visitor to the next. A more reliable foundation is a properly configured cookie banner, first-party measurement and tags deployed through Google Tag Manager so that they fire according to consent. Connecting this to Google's Consent Mode is a separate topic.

1. Open the site in a private window and do not choose anything in the banner yet.
2. Open the browser's developer tools (F12), go to Application (Chrome) or Storage (Firefox) and select Cookies.
3. Check that only strictly necessary cookies are stored before consent. If you see cookies whose names start with _ga or _fbp, analytics or advertising is running without consent.
4. Click Reject all, reload the page and check that no new analytics or advertising cookies have appeared.
5. Make sure the settings can be changed easily from the footer.

If the banner or tracking does not behave correctly, a developer or the team handling your website maintenance can fix it. Cookies also belong in a regular website security check.