Cookie banners and GDPR in Denmark

The rules are less complicated than people think. They are just different from how most websites behave. We are not lawyers, but these are the questions we get asked, and what the rules say.

Do I even need a cookie banner?

Only if your site sets cookies that are not strictly necessary. Strictly necessary cookies — login, shopping cart, language choice — do not require consent.

If your site has no statistics, no advertising and no embedded videos, you do not need a banner. And your visitors are spared clicking past something neither of you wanted.

But everyone else has one?

Yes, because everyone else has Google Analytics. It is the choice, not the law, that creates the banner.

When may the cookie be set?

After consent, never before. This is where most sites fail: the banner appears while the tracking is already running in the background. Then the consent is meaningless, and the breach happened before anyone clicked anything.

Must "reject" be as easy as "accept"?

Yes. The Danish guidance says it directly: it must always be equally easy to decline as to consent.

A banner with a large green "Accept all" and a small grey link to "Settings", where saying no takes three clicks, does not meet that. It is also the most common design in Denmark.

Can the boxes be pre-ticked?

No. Pre-ticked boxes and toggles set to "on" are not valid consent. The user has to make an active choice.

Can I block the site until people say yes?

A "cookie wall" without a reasonable alternative is generally not valid consent. Consent has to be voluntary, and it is not if the price of saying no is being locked out.

Do I have to be able to prove it?

Yes. You must be able to document what the consent covered, when it was given, and which solution was used. That is why most people use a consent platform rather than building the banner themselves.

Who is watching?

The Danish Agency for Digitalisation supervises the cookie rules, working with Datatilsynet, which handles personal data more broadly. This is not a dormant area — orders have been issued to very large players.

The easy way out

The simplest way to comply with the cookie rules is to not set cookies that require consent.

That sounds like a joke, but it is a real option for the vast majority of company websites. What you give up is Google Analytics. What you get: no banner, a faster site, no documentation duty, and a privacy section that is true without anyone having to write around anything.

If you still want to know how many people visit, there are analytics tools that use no cookies and do not follow the individual. Then you are back in the category that does not have to ask permission.

This is not legal advice. If you are unsure about your specific situation, have a lawyer look at it — it is cheaper than an order.