What must you not do in a consent window?

Updated: 13 October 2026

The short answer

Consent has to be free and informed, so the window must not push the visitor towards "accept". The most common mistakes are a hidden reject option, unequal buttons, pre-ticked categories and blocking the site until consent is given. The details differ slightly from country to country.

The principle behind everything else

Consent counts only when the visitor had a real choice and knew what they were agreeing to. It has to be their own active step, such as a click.

Every mistake described below is a version of one problem: the window looks as if it is asking, while in fact it decides for the visitor.

There is a purely practical reason too. Consent collected in a flawed way is a poor basis for the remarketing and conversion measurement you care about in Google Ads. An honest window brings fewer consents, but ones you can rely on.

Mistakes in how the window looks

Reject hidden deeper than accept. The first screen shows "accept" and "settings", and refusing takes several more clicks. Most regulators in our region expect refusing to be as easy as agreeing.

Unequal buttons. Accept as a large, colourful button, reject as grey text or a link. The Slovak regulator, for example, advises against a green accept button next to red alternatives, because that steers the choice.

Pre-ticked categories. The switches for statistics and marketing should be off by default. Only necessary cookies may be on from the start.

Shaming wording, such as "no, I prefer a worse site". The window must not mislead people about what refusing means.

Mistakes in how the window behaves

A cookie wall. The page stays covered until the visitor clicks accept, and there is no way to refuse. The Czech, Slovak, Croatian, Hungarian and Bulgarian authorities say plainly that access to a site must not depend on consent.

Treating scrolling or closing the window as consent. The Slovak regulator treats closing the window as a refusal.

Relying on browser settings. In Poland this point is not settled. The statute allows consent to be expressed through software settings, while the data protection authority has held such consent to be passive and invalid. We found no final court ruling. Site owners therefore usually do not rely on browser settings.

Asking over and over. The visitor refused, yet the window returns on every page. The site should remember a refusal as well.

No way back. The visitor should be able to change their decision easily. Google's policy requires this too: clear instructions on how to withdraw consent.

Mistakes in the wording

A vague purpose. "We use cookies to make things better" says nothing. Polish law requires information about the purpose of storing and reading data, and a note that conditions can also be set in the browser.

Not saying who receives the data. Google's policy requires you to identify each party that may receive data through its products.

An English-only window on a Polish site. In Poland and Slovenia, language laws cover consumer information on websites, so the window should have a version in the national language.

How countries differ

The foundation is shared, but regulators place the emphasis differently. Here are four concrete differences.

Slovakia: if the first screen lets people agree in one click, the same screen must let them refuse in one click. The regulator describes this as necessary, not as a recommendation.

Croatia and Latvia: reject and accept must look the same. The Latvian authority spells it out: the same colour, the same font and the same button fill.

Czechia: the authority considers 12 months an appropriate time to remember a decision. After a refusal, the visitor should not be asked again for at least 6 months. In Slovakia that second period is 12 months.

Romania and Poland: there is no national statute or guidance that expressly demands a reject button on the first screen. In Romania the Senate rejected a bill to that effect on 2 June 2026. In both countries, though, the authorities apply the general European standard for consent.

A practical way to approach it

People who operate in several countries usually set the window to the strictest requirements: reject on the first screen, equal buttons, nothing pre-ticked, refusals remembered. A window like that fits the expectations of every authority described here.

Legal basis in Poland: Articles 399 and 400 of the Electronic Communications Law. We describe the rules and how regulators apply them. We are not advising on your particular case.

Ready-made tools differ in how many of these rules they enforce themselves. In ConsentGate the window has three equal buttons and no pre-ticked categories.

Key points

Refusing must be as easy and as visible as agreeing.
Nothing except necessary cookies may be ticked in advance.
Access to the site must not depend on clicking accept.
The site should remember a refusal too, and let people change their mind.
The simplest route is to follow the strictest requirements in the region.

Sources

This guide is for information only and is not legal advice.