The best cookie consent platforms (CMP) in 2026
A CMP (Consent Management Platform) shows the cookie banner, blocks trackers before consent, and keeps proof of the visitor’s choice. In 2026, the serious options for sites in Romania and the EU include FewCookies, Cookiebot, OneTrust, CookieYes, Termly and iubenda — each with a different price and complexity profile. Below is an honest shortlist, plus the criteria to choose by.
Updated: July 20, 2026
Can you implement Consent Mode v2 without a CMP?
Technically, yes: you can set the Consent Mode v2 signals by hand in gtag (consent default "denied" plus a consent update when the user chooses). Practically it's fragile — you still need a banner UI, real blocking of trackers before consent, proof of the choice, and all four signals updated correctly. A CMP solves all of that out of the box; below is when the manual effort is worth it and when it isn't.
Updated: July 19, 2026
How to check if your website is GDPR-compliant on cookies (in 5 minutes)
To check your site’s GDPR cookie compliance, run a free scan at /check (no account), which shows which trackers fire before consent, how cookies are classified, and whether the banner uses dark patterns. Then confirm manually in the DevTools Network and Application tabs, verify the Google layer with the Consent Mode v2 checker, and fix in priority order. Below is the full self-audit, step by step.
Updated: July 18, 2026
Is it legal to block access until users accept cookies?
Generally, no. A "cookie wall" — which blocks access to your site unless the visitor accepts marketing cookies — makes consent forced, and EDPB guidance says consent obtained under such a wall is not "freely given" and therefore not valid. The "pay or consent" model (pay or accept), used by some news sites, is the subject of active European debate and has no final answer yet. For a normal business site, the practical conclusion is simple: don't build walls — design a fair banner instead.
Updated: July 17, 2026
Is a "Reject" button on the cookie banner required?
Yes, in practice: EDPB guidance and DPA practice require that rejecting cookies be as easy as accepting them. That means a visible "Reject all" button on the first layer of the banner, next to "Accept all" — not buried two clicks deep in "Settings". A banner that offers only "Accept" or hides the reject option makes consent invalid and invites complaints. Below: what a compliant first layer looks like and what happens to your data when visitors reject.
Updated: July 16, 2026
How much does a CMP (cookie banner) cost in 2026?
A CMP can cost anywhere from zero to a few hundred euros a month, depending on the model: free tiers exist but come with limits (page caps, one domain, one language, forced branding), and per-pageview or per-subpage pricing scales painfully with traffic. FewCookies costs €6/month VAT included, a fixed price, with a 7-day trial and no card. Below is an honest breakdown of the real costs — including hidden ones like setup time and the legal review of DIY solutions.
Updated: July 15, 2026
Cookie banner for an online shop: how to get it right
An online shop runs the heaviest tracker stack — analytics, remarketing pixels, heatmaps, chat, affiliates — but also cart and session cookies that do NOT need consent. A correct e-commerce cookie banner lets checkout work friction-free (essential cookies fire anyway) while blocking marketing trackers until consent. With Google Consent Mode v2 configured, Google Ads conversion data survives even when the visitor refuses — because a legally blocked pixel beats an illegally firing one.
Updated: July 14, 2026
Cookie banner dark patterns: why they make you non-compliant
Dark patterns are the manipulative designs in a cookie banner that push the visitor toward "Accept" and make rejecting harder: no reject button on the first layer, color-imbalanced buttons, guilt-tripping copy, pre-ticked boxes and maze-like settings menus. The problem is that consent obtained this way is not valid — so you are non-compliant even though you have a banner. Valid consent must be free, informed, and as easy to refuse as it is to accept.
Updated: July 13, 2026
Cookie policy: what a correct template must contain
A correct cookie policy lists exactly which cookies the site uses, for what purpose, how long they last, who sets them (first or third party) and how a visitor withdraws consent. A template copied from another site is not compliant unless it reflects your real trackers — and it drifts from reality the moment you add a pixel or a chat widget. The safest option is a policy generated from a scan of your own site that updates automatically when your tracker stack changes.
Updated: July 12, 2026
Essential vs marketing cookies: which need consent?
Cookies split into four practical categories: strictly necessary, preferences, statistics and marketing. Only the strictly necessary ones (session, cart, the consent choice) need no consent — the rest do, before they fire. The most common trap is calling analytics "essential" to avoid the banner; it is not, and misclassifying it makes you non-compliant.
Updated: July 11, 2026
The Meta (Facebook) Pixel and GDPR: do you need consent?
Yes, always. The Meta Pixel is a marketing tracker: it sets the _fbp cookie, sends navigation events to Meta, and matches visitors to Facebook accounts for remarketing. All of this is personal data processed for advertising, so it needs prior consent under GDPR and Romanian Law 506/2004 — the pixel must not fire before the click.
Updated: July 10, 2026
Can you use Google Analytics (GA4) without consent?
No, not for visitors in the EEA. GA4 sets cookies and processes personal data (identifiers, IP address, behaviour), so it needs prior consent under GDPR and Romanian Law 506/2004. You can keep some data without cookies through Google Consent Mode v2, but "normal" cookie-based analytics only starts once the visitor accepts.
Updated: July 9, 2026
How do you add a compliant cookie banner to WordPress?
To be compliant on WordPress you need a banner that truly blocks non-essential scripts until consent, not just one that paints a message over trackers that already fired. Many free plugins only do the second. The simplest robust path is a single banner script that holds Analytics, pixels and other trackers until acceptance and sends the Google Consent Mode v2 signals — then you verify the result with a free scan.
Updated: July 8, 2026
Romania’s cookie law (Law 506/2004) explained in plain language
Law 506/2004 is Romania’s transposition of the ePrivacy Directive, and it requires informed consent before installing non-essential cookies on a visitor’s device. It says "you need consent", and GDPR says what that consent must look like: freely given, specific, informed and expressed through a clear action. Cookies strictly necessary for the site to work are exempt; everything else — analytics, marketing, remarketing — needs prior consent.
Updated: July 7, 2026
What fines do you risk for cookies without consent in Romania?
Running non-essential cookies without valid consent breaks two laws at once: GDPR and Romania’s Law 506/2004. GDPR fines reach up to €20 million or 4% of annual global turnover, and the authority that enforces them in Romania is ANSPDCP. In practice the risk does not start with a raid — it starts with a complaint any visitor can file for free — and the fix takes under an hour.
Updated: July 6, 2026