Nearly one in three EU websites sets analytics cookies before consent. Nearly one in five sets marketing cookies. The legal position on these is unambiguous: the EDPB has repeatedly confirmed that analytics and marketing cookies require consent under Article 5(3) ePrivacy. The CJEU’s Planet49 ruling made clear that consent must be an active, affirmative act — and it cannot be affirmative if it has not happened yet.
The practical implication is that by the time a visitor sees a cookie banner and considers whether to accept or reject, their browser has already been fingerprinted, their visit has already been logged by analytics platforms, and in many cases their browsing profile has already been updated by advertising networks. The consent choice, when it arrives, is partially retroactive — and retroactive consent is not consent at all.
We Scanned 97,000 EU Websites for GDPR Compliance. Here’s What We Found. – GDPR Privacy Monitor