Most consent banners are built once, by whoever had the CMP login that week, and never audited again. They then do two kinds of damage: they expose you to a regulator who has already published what a compliant banner looks like, and they starve your analytics. Google sets a hard floor here — a GA4 property becomes eligible for behavioral modeling only if it collects at least 1,000 events per day with analytics_storage='denied' for at least 7 days, plus 1,000 daily consented users on 7 of the previous 28 days. Below that, refused traffic is simply gone.
This is a rebuild playbook for whoever owns the banner: growth lead, analytics owner, or the developer who inherited it. Six passes, in order, each with a decision point, ending in a 14-check rubric you can score your current banner against. It covers sites selling into the EU, the UK and Turkey.
What the banner has to do, in both jurisdictions
Two supervisory bodies have written the design rules down, so this is not a matter of taste. The EDPB's Cookie Banner Taskforce report (17 January 2023) and Guidelines 03/2022 on deceptive design patterns (v2.0, 14 February 2023) set the EU baseline. Turkey's KVKK published its cookie guide in 2022 and an updated edition in mid-2025.
| Requirement | EU / UK (ePrivacy + GDPR) | Turkey (KVKK) |
|---|---|---|
| Refusal on the first layer | Absence of a reject option on any layer is an infringement | "Reject all" must carry the same visual weight as "accept all" |
| Pre-ticked categories | Silence and pre-ticked boxes are not consent | Non-essential categories default to off |
| Analytics without consent | Not exempt on most member-state readings | Outside the exemptions; analytics and measurement form their own category |
| Cookie walls | Case by case, high bar | Conditioning content access on accepting all cookies is not permitted |
| Withdrawal | Must be as easy as giving consent | Settings reachable from every page |
The enforcement signal is real. On 1 September 2025 the CNIL fined Google EUR 325 million, finding that consent "was not freely given, as it was more difficult to refuse cookies linked to personalised advertising than to accept them." Button asymmetry is not a cosmetic finding.
Pass 1 — Inventory every tag and justify each essential one
Open the site in a clean browser profile, refuse everything, and record what still sets storage. Then accept and record the difference. One row per cookie or storage key: name, setter, purpose, category, and the sentence you would say to a regulator.
The decision point is essentiality, and the burden is yours — the EDPB taskforce acknowledged the practical difficulty of assessing it but was clear that controllers must demonstrate the essentiality of what they classify as essential. Session authentication, cart contents and anti-fraud tokens survive. A heatmap tool, a testing library and a marketing pixel do not.
Worked example, a typical Turkish e-commerce checkout: session cookie, cart token and bot-protection token are essential; GA4, Meta pixel, Ads remarketing, session replay and the chat widget all need consent. Six of eight — a ratio most teams have never written down.
Pass 2 — Fix the first layer, including its accessibility
The first layer needs a plain statement of who processes what and why, "accept all" and "reject all" in identical styling, a route to granular settings, and nothing pre-selected. Equal prominence is easier to defend when you make it measurable:
- Both primary buttons at the same size, weight and treatment. If one is a filled button, so is the other.
- Text contrast at least 4.5:1, and 3:1 for button borders and other non-text UI, per WCAG 2.2 criteria 1.4.3 and 1.4.11. The taskforce flagged banners where "contrast between the text and the button background is so minimal that the text is unreadable."
- Reject must be a real button. The taskforce rejected refusal options consisting of "a link behind wording such as 'refuse'" without sufficient visual support.
- Keyboard reachable in a sane order, no focus trap (WCAG 2.1.2). Our WCAG audit tool catches the contrast and focus-order failures.
Then check your copy against the EDPB's six pattern families: overloading, skipping, stirring, obstructing, fickle, left in the dark. "Stirring" is design that "affects the choice users would make by appealing to their emotions or using visual nudges" — which is what "Accept for the best experience" does.
Pass 3 — Build the second layer and the withdrawal path
Layer two is per-category toggles, all off by default, each with a purpose description and a retention period, each independently saveable.
Withdrawal is where implementations fail. It must be as easy as granting consent, and the KVKK guide expects settings reachable from every page. A persistent footer link or a small floating control both work; a line in the privacy policy does not. Test it by withdrawing consent from a product page in two clicks.
Pass 4 — Wire consent so a refusal is still measurable
This pass decides whether compliance costs you your analytics. Google's consent mode has two shapes:
- Basic: tags do not load until the user interacts. Nothing is sent beforehand, "not even the default consent status." Simplest to defend, and you lose all signal from refusers.
- Advanced: tags load with consent defaulted to denied and send cookieless pings. You keep a shape of refused traffic and become eligible for modeling.
Advanced is the only route to behavioral modeling, which requires that "tags are loaded before the consent dialog appears, and Google tags load in all cases, not only if the user consents." Note that eligibility is not modeling: Google states that meeting the published thresholds "doesn't guarantee eligibility." Treat modeled numbers as directional, never as an experiment's deciding metric.
Decision point: if EEA, UK and Turkey traffic combined cannot plausibly clear 1,000 denied events a day, do not build the measurement plan on modeling at all. Use server-side conversion data and your own order table as the source of truth.
Pass 5 — Instrument the banner itself
The banner is a funnel step and almost nobody measures it. Log four events, no personal data, through a mechanism that does not itself require consent: banner shown (the denominator); choice made, with which choice; layer two opened; and no interaction at all.
Segment all four by country and device. The mobile non-interaction rate is usually the surprise, and the one you can improve without touching choice architecture: banner height, whether it covers the primary CTA, whether it reappears on every route change.
Pass 6 — Test only what you are allowed to test
Fair game: banner height, position, copy clarity, category naming, layer-two layout, whether the banner blocks content. Not fair game: button asymmetry, pre-ticked boxes, hidden reject paths, extra steps on the reject journey. Those are not losing variants, they are findings.
Be sceptical of the standard citation, too. The much-quoted claim that removing the first-page opt-out "increases consent by 22–23 percentage points" comes from Nouwens et al., CHI 2020, whose scrape covered thousands of sites but whose causal experiment ran with 40 participants. The direction is credible; the magnitude should not be quoted as a benchmark, and the same paper's 8–20 point figure for granular first-layer controls carries the same caveat. Vendor "average consent rate" figures are weaker still: self-selected customer bases, not independently verifiable.
Score your current banner: 14 checks
One point each. Below 12, fix before you spend money on tests.
| # | Check | Pass threshold |
|---|---|---|
| 1 | Reject option on first layer | Present, as a button |
| 2 | Accept / reject visual parity | Same size, weight, fill |
| 3 | Button text contrast | ≥4.5:1 |
| 4 | Non-text UI contrast | ≥3:1 |
| 5 | Pre-ticked non-essential categories | None |
| 6 | Cookie inventory documented | Every key has a named purpose |
| 7 | Essentiality justification written | One sentence per essential cookie |
| 8 | No tags fire before a choice | Verified in a clean profile |
| 9 | Withdrawal from any page | ≤2 clicks |
| 10 | Keyboard operable, no focus trap | WCAG 2.1.2 met |
| 11 | No emotional nudge copy | No "best experience" framing |
| 12 | No cookie wall | Content reachable after refusal |
| 13 | Consent state logged | Record retained per choice |
| 14 | Banner funnel instrumented | All four events firing |
Where this breaks down
This is an interface and measurement playbook, not a legal opinion, and four things sit outside it.
ePrivacy is a directive, so the analytics exemption is read differently across member states and a design that satisfies one authority may not satisfy another. The law is also moving: the Commission's Digital Omnibus proposal, COM(2025) 837 final of 19 November 2025, would move cookie rules into the GDPR and exempt aggregated first-party audience measurement — but Parliament's own legislative record shows it in early stages, with an EESC opinion on 18 March 2026 and no committee vote or Council position published. Posts announcing trilogues and a settled timeline run ahead of the file. Design for today's rules and keep the inventory in a form you can re-categorise fast.
It also skips mobile apps, where ATT and the Android consent surfaces have their own mechanics, and it assumes one CMP — multiple brands in one tag container need consent state scoped per domain. [INTERNAL DATA NEEDED: anonymised before/after consent rate and mobile non-interaction rate from a Switas banner rebuild, ideally one EU and one Turkish property, to replace the vendor benchmarks this article deliberately refuses to cite.]
Frequently asked questions
Does a "reject all" button lower my conversion rate?
It lowers your consent rate, which is not the same thing. On-site conversion is unaffected by whether someone accepted advertising cookies; what changes is your ability to attribute it in ad platforms. Budget for worse attribution, not worse revenue.
Can I treat Google Analytics as strictly necessary?
Not in Turkey — the updated KVKK guide puts analytics and measurement in their own category, outside the exemptions for technical transmission and expressly requested services. In the EU the position varies by member state, but the safe default is that it needs consent.
Basic or advanced consent mode?
Advanced, unless your legal team has specifically objected to cookieless pings before a choice. Basic is cleaner to defend and costs you all visibility into refused traffic, including modeling eligibility.
How long before I can ask again after a refusal?
No fixed number exists in current EU or Turkish rules; the requirement is that repeated prompting must not amount to obstruction. The Digital Omnibus proposal would add a six-month floor per purpose, but it is not law. Storing the refusal for six months and not re-prompting is a defensible policy now.
Do I need a separate banner for Turkey?
Usually not a separate banner, but you need country-specific category logic and Turkish text with the same button parity. The KVKK rules are close enough to the EDPB baseline that one well-built banner serves both when copy and categories are localised.
Is a cookie wall ever acceptable?
Treat it as unavailable. The KVKK guide does not permit conditioning content access on accepting all cookies, and the EU bar is high. "Consent or pay" on news sites is a separate, contested question, not a template for e-commerce.
How often should this be re-audited?
Score the 14 checks quarterly and immediately after any tag-manager change or new vendor integration. Most regressions arrive as a new pixel, not a banner redesign.
Score your own banner, or hand it to us
Run the 14 checks on your live banner this week; it takes under an hour with a clean browser profile and a contrast checker. If you would rather have the interface, the tag layer and the consent records audited together, with a prioritised fix list instead of a score, talk to us about an accessibility and compliance audit.
Sources
- EDPB, Report of the Cookie Banner Taskforce, adopted 17 January 2023
- EDPB, Guidelines 03/2022 on deceptive design patterns, v2.0 adopted 14 February 2023
- KVKK, Çerez Uygulamaları Hakkında Rehber (updated edition, 2025)
- CNIL, Google fined EUR 325 million, 1 September 2025
- Google, Consent mode overview
- Google, GA4 behavioral modeling for consent mode
- Google, EU user consent policy
- W3C, WCAG 2.2
- Nouwens, Liccardi, Veale, Karger, Kagal, Dark Patterns after the GDPR, CHI 2020
- European Parliament Legislative Train, Digital Omnibus Regulation Proposal, COM(2025) 837 final
