SecureSpells
    Log in

    The #1 GDPR Cookie Mistake Most Websites Still Make

    The most common cookie mistake: analytics and ad tags that load before the visitor chooses. How to spot it, why ePrivacy Art. 5(3) applies, and the fix.

    Ott Ristikivi3 min read
    Infographic showing the difference between essential and non-essential cookies
    SecureSpells

    The most common GDPR cookie mistake is loading non-essential cookies and tags, such as analytics, advertising pixels and heatmaps, before the visitor makes a consent choice. Under ePrivacy Directive Article 5(3), storing or reading non-essential information on a device requires prior consent. A visible banner does not prevent this; the tags must be configured to wait.

    This guide explains why the mistake happens, why it creates regulatory exposure, and how to fix it.

    Scope: EU/EEA websites under GDPR and the ePrivacy Directive. Educational content, not legal advice.

    Under the GDPR and the ePrivacy Directive (Article 5(3)), the legal requirement is "Prior Consent." This means:

    1. Zero-Load Execution: No non-essential scripts (Analytics, Pixels, Heatmaps) should execute upon the initial page load.
    2. Affirmative Action: Data processing can only begin after a visitor makes an active, informed choice.
    3. Default Block: Your website must be configured to "hold" all tracking technologies in a pending state until the CMP (Consent Management Platform) signals an "Accept" event.

    The second most frequent mistake is the misclassification of cookies. We often see companies label analytics, performance tracking, or A/B testing scripts as "Strictly Necessary."

    The Regulatory Reality:

    • Essential Cookies: Only those strictly required for the service to function (e.g., login sessions, shopping carts, or security tokens).
    • Non-Essential: Anything used for business optimization, marketing, or user behavior tracking.

    Labeling a Meta Pixel as "Essential" is considered a dark pattern and is a high-priority target for Data Protection Authorities (DPAs), as highlighted in the EDPB Cookie Banner Taskforce report (January 2023).

    Enforcement examples

    French enforcement has addressed this exact pattern:

    These decisions date from 2020, but they remain relevant: the infringement they describe, advertising cookies placed automatically before any consent choice, is the same pre-consent pattern this article covers.

    To ensure your website respects user choice and avoids the spotlight of regulators, follow these steps:

    1. Perform a Behavioral Scan: Identify every script that loads on the first visit. Use a tool like SecureSpells to see exactly what fires before the "Accept" button is clicked.
    2. Synchronize your CMP: Ensure your Tag Manager is synced with your cookie banner. Use "Google Consent Mode v2" to automate the blocking of marketing tags. Then check whether your CMP actually blocks tags.
    3. Re-classify your Inventory: Be honest about what is "Essential." If it tracks user behavior for your benefit rather than the user's immediate technical need, it requires consent.
    4. Implement 'Privacy by Default': Assume the user says "No" until they explicitly say "Yes." Learn more: Cookie banner compliance guide.

    Read next