EU ePrivacy Directive Cookie banner UX test cases

Start each test run by classifying the technologies loaded on the page. Article 5(3) applies when the operation stores information on, or gains access to information already stored in, a user's terminal equipment in the required communications context. A transmission-only or strictly necessary exemption can remove the consent requirement; it does not remove the operation from the Article 5(3) assessment.

Do not limit the inventory to browser cookies. EDPB technical-scope guidance covers storage and access patterns such as JavaScript-triggered network calls, tracking pixels, tracked URLs, local storage, application identifiers, and some IP-based or device-derived signals when they originate from terminal equipment.

Open the page in a clean browser profile and inspect the first banner layer. If it offers an accept-all action for non-essential cookies, test whether the user also has a clear and usable way to refuse consent before any non-essential storage or access.

The EDPB Cookie Banner Taskforce reported that a vast majority of authorities considered the absence of any refuse, reject, or not-consent option on a layer containing a consent button inconsistent with valid consent. It did not create a binding EU-wide layout rule, and authorities did not agree on every visual-detail question. Evaluate placement, wording, contrast, keyboard focus order, and the applicable national position.

Click into the settings layer and inspect every purpose, vendor, and technology toggle. Consent-required purposes should start off by default; the user's active selection should be needed before those purposes are enabled.

The test should also check granularity. If analytics, advertising, personalization, social plug-ins, and A/B testing are bundled behind one switch, the evidence should explain whether each purpose is being accepted separately or whether a single toggle is forcing consent to unrelated purposes.

After accepting non-essential cookies, test whether the same user can find a persistent route to change or withdraw consent. The route can be a footer link, privacy settings control, account setting, or CMP icon, but it must be available without unusual effort and without lowering the service level.

The withdrawal test is not complete when the UI flips a toggle. It should also confirm that consent-dependent tags stop, future reads or writes are blocked, downstream suppression signals are sent where used, and any deletion or retention behavior is documented.

Load a page that uses a cookie wall, blocking overlay, paywall-like consent gate, or content-hidden-until-accept pattern. The test should check whether the user can access the requested service or content without consenting to non-essential storage or access.

Do not convert this into a national-law rule. The cited EU-level test is narrower: when access to a service or functionality is conditional on consenting to terminal-equipment storage or access that is not necessary for that service, the consent-choice record is weak because the user lacks a genuine choice.

Assess analytics separately before treating it as exempt. CNIL's 11 June 2020 sheet described a French audience-measurement opt-out model with purpose limits, no cross-checking, single-publisher scope, IP truncation, tracker-lifetime limits, and user-choice controls. Verify current French eligibility and the deployed configuration rather than approving an exemption from that historical checklist. Other Member States require their own national assessment.

For audience-measurement trackers that already qualify for the French exemption, CNIL's recommendation consolidated on 16 January 2026 recommends user information, a lifetime suitable for audience comparison such as 13 months without automatic renewal, a maximum 25-month retention of collected information, and periodic review. These recommendations do not establish eligibility.

When the deployment does not meet an applicable national exemption, analytics must remain off before consent, be blocked after rejection, and stop after withdrawal. Use a clear purpose control where the banner offers separate choices.

The final test is whether the organization can prove what the user saw, what the user chose, and what the technology did as a result. A correct-looking banner is not enough if the team cannot reconstruct the consent workflow at the time of the session.

Keep the evidence minimal but sufficient. EDPB consent guidance supports keeping records that show how consent was obtained, when it was obtained, what information was presented, and how the workflow met the criteria for valid consent.