A privacy-respecting design starts with the purpose of a tracker, not the colour of a consent button. Rules concerning access to information on a device interact with the GDPR when personal data are processed. National implementation and guidance also matter. This guide examines that relationship through French and Romanian official sources, checked on 23 October 2026, without certifying any software or website.
Separate device access from subsequent processing
A technology can store or read information on a device and then support further processing elsewhere. These are connected operations, but asking whether a cookie needs consent does not exhaust the data-protection analysis. The CNIL explanation of cookies and other trackers describes the distinction between trackers requiring prior consent and limited exceptions. An exemption for a genuinely necessary function does not establish that every later use of the resulting information is lawful. Document the purpose, the data involved, the recipients and the retention logic separately. The name “cookie” is not the boundary of the analysis: other mechanisms accessing device information can raise similar questions.
Necessity is tied to a function requested by the user
A site may need a mechanism to maintain a session or provide a feature the person expressly requested. That reasoning is different from saying that advertising, measurement or personalisation is commercially useful to the publisher. Examine the actual configuration and purpose instead of assigning an entire vendor or product family to an exempt category. A tracker used for multiple purposes may require a more careful assessment than a single-purpose technical mechanism. The practical documentation should explain what stops working without it, why that function is relevant to the request and whether a less intrusive implementation is available. The label “essential” alone proves none of those points.
Choice must be intelligible and usable
Consent cannot be inferred merely from the presence of a banner. The information, available choices and consequences of action matter. CNIL's consolidated recommendation published in January 2026 discusses practical presentation, including the accessibility of acceptance and refusal. A design review should compare the effort, visibility and clarity of those choices, then examine whether the recorded decision is respected. This is not a claim that every European country mandates one identical button label or graphic layout. A reader should be able to understand the purposes without navigating contradictory explanations, and a later change of choice should be represented accurately in the system.
National sources should remain visible
| Layer | Official source example | Boundary to preserve |
|---|---|---|
| Device-access rules | Romanian Law 506/2004 | National implementation is relevant |
| Practical consent guidance | CNIL cookie recommendation | French guidance is not a universal EU screen template |
| Personal-data principles | European Commission GDPR principles | A cookie exemption does not remove all GDPR duties |
| Technical safeguards | EDPB security guidance | A secure tracker is not automatically a lawful tracker |
Romania's official legislative publication of Law 506/2004 and the Romanian authority's cookie information identify a national framework connected to electronic communications privacy. The authority item is historical, not a new 2026 ruling. Direct retrieval of the consolidated legislative page was unavailable during this check, so this guide does not claim to reproduce every current amendment, penalty or procedural detail. Country-specific conclusions need the applicable national text.
Inventory what actually runs
A useful inventory connects each mechanism with its domain, purpose, activation condition, duration and recipient. Compare that record with observed behaviour before a choice, after refusal and after acceptance. Do not assume that the visible banner controls embedded video, analytics, advertising tags or third-party widgets correctly. A change in configuration can change the privacy assessment even when the product name remains the same. Separate evidence about intended settings from evidence about execution. This article describes review questions rather than a technical audit result: no inspection of an external site's live scripts has been performed here, and no compliance badge is implied.
Minimisation and security continue after consent
The Commission's GDPR principles include purpose limitation, data minimisation and storage limitation. Consent is not a general permission to collect unrelated information forever. The EDPB security guidance also treats protection of personal data as an ongoing responsibility. Limit access to collected information, document the period needed for the stated purpose and review the effects of sharing with another organisation. A security measure and a lawful basis answer different questions: encryption can protect data without making an excessive collection necessary. Likewise, publishing a privacy notice does not itself demonstrate that the actual recipients and retention settings match its promises.
Checklist for an accessible privacy interface
Review the stated purposes; identify genuinely necessary functions; compare the visibility and effort of acceptance and refusal; verify the default behaviour; test a later withdrawal or change; and match the inventory to the privacy notice. Include keyboard access, readable labels and understandable language in the review because a nominal choice can be difficult to exercise in practice. Keep the date and configuration version with the findings. If the interface changes, the previous review should not be presented as evidence for the new implementation. A practical record explains the tested circumstances and unresolved questions rather than asserting that one banner design guarantees compliance everywhere.
- Map purposes to actual mechanisms.
- Test behaviour before choice and after refusal.
- Compare acceptance and refusal effort.
- Retain the configuration version and national source.
Document limits instead of offering a universal seal
A cross-border publication can explain shared principles while preserving national variations. It should identify which authority's guidance supports each practical example and distinguish a legal requirement from an implementation suggestion. When a source is historical, say so; when a consolidated text is unavailable, avoid inventing its current wording. This approach makes the information useful to designers and readers without converting a public-information portal into a certification body. The appropriate outcome of a review is a reasoned record of purposes, choices, actual behaviour and remaining uncertainties. It is not a promise that a particular plugin, banner or collection practice is automatically lawful in every jurisdiction.
Frequently asked questions
Does an “essential” label create an exemption?
No. The actual purpose and function must justify the relevant exception; a product label is not sufficient.
Does valid consent remove other GDPR obligations?
No. Purpose limitation, minimisation, retention and security still require attention where personal data are processed.
Are the same consent buttons mandatory everywhere in Europe?
This guide makes no such claim. National rules and guidance must be distinguished from general European principles.
Sources and verification
- Cookies and trackers: French legal guidance — CNIL — 2026-10-23
- Consolidated cookie recommendation, January 2026 — CNIL — 2026-10-23
- Romanian Law 506/2004 — Romanian official legislation portal — 2026-10-23
- Romanian authority explanation of cookie legislation — ANSPDCP — 2026-10-23
- Principles of personal-data processing — European Commission — 2026-10-23
- Security of personal data — European Data Protection Board — 2026-10-23