Cookies and GDPR: what your website must actually do

Almost every website in Romania has a cookie banner. Most of them are wrong — not because they are missing, but because they do something that looks like compliance without being it. This article separates what is required from what is myth, with the rules written in plain terms.

We write it having built the consent module for two sites ourselves rather than using a plugin. When you implement the mechanism, you find out exactly where most people cut corners.

Where the obligation actually comes from

There are two sets of rules, and confusing them explains most mistakes:

• The cookie rule comes from the ePrivacy directive, transposed in Romania as Law 506/2004. It says: you may not write to or read from someone's device without their consent — with one exception, what is strictly necessary for the site to work.
• GDPR deals with personal data generally: what you collect through forms, how long you keep it, who you pass it to, what rights the person has.

A site can comply with GDPR and still breach the cookie rule, or the other way round. You need both.

The six mistakes we see most often

1. A banner with only "Accept"

If the only option is to accept, it is not consent, it is a notice. Refusing must be as easy as accepting — one button, in the same place, equally visible. Not hidden behind "Preferences", two clicks away.

2. Scripts that fire before the answer

The most common, and the most invisible to the owner. The banner shows up nicely, but Google Analytics and the Facebook pixel have already loaded. Consent requested after the cookie is set is worth nothing.

Check it simply: open the site in a private window, press F12 → Application → Cookies and look before touching the banner. If analytics or advertising cookies are already there, you have a problem.

3. Pre-ticked boxes

Consent must be an action, not the absence of one. Pre-ticked boxes, scrolling treated as acceptance, and "by continuing to browse you agree" are not valid.

4. No way to withdraw

Withdrawal must be as easy as giving consent. In practice: a permanent link in the footer — "Cookie settings" — that reopens the preferences dialog. If someone cannot change what they chose a month ago, the mechanism is incomplete.

5. A generic policy copied from another site

The cookie policy must list the cookies you set: names, purpose, duration, who receives them. Copied text mentioning services you do not even use looks bad and protects nobody.

6. Forms with no basis and no retention period

On the contact form: say why you are asking for the data, how long you keep it and who receives it. You do not need a consent tick to reply to someone who wrote to you — you have a legitimate interest. You do need a separate tick if you also want to add them to a newsletter list.

What counts as "strictly necessary"

Yes, YouTube too. An embedded video sets cookies when the page loads, not when someone presses play. The fix is a static preview that loads the video only on click — or the enhanced privacy mode.

There is also the no-banner option

The least known option: if you set no cookies that require consent, you need no banner at all.

Traffic can be measured without cookies — there are analytics services that do not track individuals and store no identifiers. Maps and videos can be replaced with images and links. The result: a faster site, without the dialog everyone finds annoying, and without the compliance risk.

The right question is not "which banner do I need" but "do I actually need these cookies". Often the answer is no, and then the problem disappears entirely.

The checklist

1. The banner has Accept and Reject equally visible, plus a preferences button.
2. No non-essential cookie is set before the answer. Verified in a private window.
3. Nothing is pre-ticked.
4. There is a permanent footer link for changing the choice.
5. The cookie policy lists your real cookies, with durations.
6. Forms state why you ask for data, how long you keep it and where it goes.
7. The newsletter has a separate, unticked box.
8. You can demonstrate, if asked, what each visitor chose and when.

What you actually risk

The large fines in the news are for large companies and serious breaches. A small Romanian company realistically risks a complaint followed by a deadline to fix things. No reason to panic, but not to ignore either: a complaint usually comes from a competitor or from a customer unhappy about something else.

The real cost is different: badly built banners slow the site down, put visitors off, and when implemented wrongly they corrupt your analytics — you measure wrong and make decisions on false figures.

In short

• Refusing must be as easy as accepting.
• Nothing non-essential fires before the answer — check in a private window.
• No pre-ticked boxes, no "by browsing you agree".
• A permanent link for withdrawing consent.
• The policy must describe your cookies, not somebody else's.
• The simplest compliance: do not set cookies that need consent.

This article explains general rules and implementation practice based on our technical experience. It is not legal advice — for specific situations, ask a lawyer.