Cookie policy review.
Consent before the cookie, not after.
EU visitors. GDPR ePrivacy. Consent before non-essential cookies. Third-party disclosure by tool name. Most Australian business cookie banners and policies don't meet GDPR requirements. Kontractually reviews yours against the checklist.
7-day free trial. Full platform access. No credit card required.
What changes when you review your cookie policy first.
Your website sets Google Analytics, Meta Pixel, and HubSpot cookies on page load - before the visitor clicks anything. An EU visitor files a complaint with their data protection authority. You receive a formal enquiry about your cookie consent mechanism.
Kontractually reviews your cookie policy and flags that non-essential cookies are being set without prior consent, violating the ePrivacy Directive. You implement a consent-first banner that blocks analytics and marketing cookies until the visitor opts in.
Your cookie policy lists 'analytics cookies' and 'marketing cookies' as categories but doesn't name the specific tools or third parties involved. Under GDPR, this level of disclosure is insufficient. A customer asks which third parties receive their browsing data and you can't answer from the policy alone.
Kontractually flags the missing third-party disclosure. Your updated policy names each tool (Google Analytics 4, Meta Pixel, HubSpot tracking), its purpose, cookie duration, and the third party that receives the data - meeting GDPR transparency requirements.
Your consent banner has a large green 'Accept All' button and a small grey 'Manage Preferences' link. There is no 'Reject All' option. Under GDPR guidance, this is a dark pattern - rejecting cookies must be as easy as accepting them.
Kontractually flags the asymmetric consent design as inconsistent with GDPR consent requirements. You add an equally prominent 'Reject Non-Essential' button, ensuring consent is freely given rather than nudged.
6 cookie policy requirements to check.
If you have EU visitors or EU customers, yes - GDPR ePrivacy Directive requires consent before setting non-essential cookies. The Australian Privacy Act doesn't require a consent banner specifically, but it requires transparency about personal information collection. For Australian-only sites without EU visitors, a cookie policy that discloses cookie use may be sufficient. For any site with EU visitors, a consent banner before non-essential cookies is required. Kontractually reviews your cookie policy against these requirements.
Under GDPR, a cookie consent banner must: (1) appear before non-essential cookies are set, (2) clearly distinguish between essential and non-essential cookies, (3) allow users to accept or reject by category (not just 'accept all'), (4) not use dark patterns (pre-ticked boxes, misleading button placement, 'accept' and 'learn more' with no 'reject'), (5) be as easy to withdraw consent as to give it, and (6) record and honour consent. Kontractually can review your cookie policy and banner configuration against these requirements.
The ePrivacy Directive (Directive 2002/58/EC, amended by 2009/136/EC) specifically governs the use of cookies and similar tracking technologies. While GDPR provides the general framework for consent and personal data processing, the ePrivacy Directive adds a specific requirement: storing or accessing information on a user's device (cookies, local storage, fingerprinting) requires prior informed consent unless the cookie is strictly necessary for a service explicitly requested by the user. The ePrivacy Directive is sometimes called the 'cookie law' because of this specific focus. Both frameworks apply simultaneously to cookies that process personal data.
No. The European Data Protection Board (EDPB) has confirmed that analytics cookies are not strictly necessary for providing a service requested by the user. First-party analytics cookies (such as those set by self-hosted Matomo or Plausible) may qualify for an exemption in some EU member states if they are used solely for aggregate statistical purposes and do not track users across sites. However, Google Analytics cookies are consistently classified as non-essential because data is transferred to a third party (Google) and can be used for profiling. Consent is required before setting analytics cookies under the ePrivacy Directive.
The Privacy Act 1988 does not specifically mention cookies, but APP 3 applies to any collection of personal information - including information collected via cookies that can identify an individual. If a cookie tracks a user across sessions and can be linked to an identifiable person (through login, email, IP address, or device fingerprinting), that browsing data is personal information under the APPs. APP 5 requires that individuals are notified about the collection, and APP 1 requires your privacy policy to describe how personal information is managed. Your cookie policy should align with your APP privacy notice on these points.