Cookies and GDPR: the checklist we use before going live

GDPR is not a banner. The banner is the visible part of work done beforehand, and the banner does not solve it.

The three pillars, in this order

**Legal basis.** Every processing activity needs an explicit legal basis. Consent is an option, not the only one: for technical cookies, legitimate interest or contract performance is enough. Consent is required for marketing and profiling.

**Minimisation.** Collect the bare minimum. If a tag exists only to understand which pages are visited, it probably does not need a cookie to do it.

**The privacy notice.** It must say who processes, why, on which legal basis, for how long and with which recipients. In Italian, understandable, linked from every page.

A banner we do well

A compliant banner hides nothing: it lists categories, states that consent can be withdrawn, makes refusal exactly as easy as acceptance, and reminds you of your choice. Half of people do not accept: if the banner is aggressive, you are only using fear.

Tags, the real weak point

Consent does not apply to a script: it applies to loading that script. The banner must block non-essential tags until consent is given, and the decision must hold across every page, not just the first.

The cookie register nobody keeps

A sheet with name, category, duration, purpose and vendor for every cookie. It is updated whenever a tag is added, and it is the first thing an audit asks for.

The practical point

If your site has no cookie register, start there: it is the document that makes everything else verifiable.