Cookie Consent Glossary: Key Terms in Plain English

How the main cookie consent terms connect to each other.

This glossary explains the words that come up when you set up cookie consent. It covers types of cookie, how consent works, the tools and records involved, UK and EU law, and advertising signals and frameworks. Each definition is short, and links to a full guide where we have one.

Where it matters, an “In Cookie Control” line explains how the product handles the term. It covers Cookie Control v9 (the current edition) and Cookie Control Premium.

All terms, A to Z: CCPA · CMP (consent management platform) · Consent · Consent cookie · Consent or pay · Consent record (consent log) · Cookie · Cookie banner · Cookie categories · Cookie declaration · Cookie policy · Cookie scan · Cookie wall · Dark patterns · Do Not Track (DNT) · DUAA (Data (Use and Access) Act 2025) · ePrivacy Directive · EU GDPR · Exceptions (UK law) and consent exceptions · First-party cookie · Geolocation · Google Consent Mode · GPC (Global Privacy Control) · ICO · Legitimate interests · Opt-in and implied consent · PECR · Preference centre · Prior consent · Privacy policy · Script blocking · Session and persistent cookies · Storage and access technologies · Strictly necessary · TCF (Transparency and Consent Framework) · Third-party cookie · Tracking · UK GDPR · Withdrawing consent

Cookies and similar technologies

Cookie

A small text file a website stores in your browser so it can remember something between pages or visits, such as a login, a basket or a setting. UK and EU cookie rules also cover similar technologies that store or read information on a device, such as local storage and tracking pixels.

First-party cookie

A cookie stored under the domain of the website you are visiting, even when another company’s script (such as Google Analytics) puts it there. Other websites cannot read it directly, but scripts running on the site can. More: First-Party vs Third-Party Cookies Explained.

Third-party cookie

A cookie set by a different domain whose content loads on the page, such as an advertising network or an embedded video player. Because the same third party can appear on many websites, its cookies can be used to follow a person from site to site. The website’s own code cannot read or delete them. More: Why Third-Party Cookies Can’t Be Deleted by Your CMP.

Storage and access technologies

The ICO’s current term for cookies and anything similar that stores or reads information on a device, such as local storage, pixels and device fingerprinting. The UK rules apply to all of them, not only cookies.

Session and persistent cookies

A session cookie is deleted when the browser closes. A persistent cookie stays until its expiry date, or until the person deletes it.

Tracking

Recording what a person does over time, on one website or across several, usually by giving their browser an identifier. Not every cookie tracks people, but the ones that do are the main focus of consent rules.

---

Consent and compliance related terms

Consent

Under UK GDPR, consent must be freely given, specific, informed and unambiguous, and shown by a clear action such as clicking a button. Pre-ticked boxes and carrying on browsing do not count. More: UK GDPR & PECR Cookie Rules Explained in Plain English.

Opt-in and implied consent

Opt-in consent means the visitor actively agrees before cookies that need consent are used. Implied consent treats something else, such as carrying on browsing or not saying no, as agreement. EU rules require opt-in consent for cookies that are not strictly necessary. UK rules do too, apart from the exceptions described below.

In Cookie Control: Premium’s compliance setting has three modes. Explicit Consent keeps optional categories off until the visitor opts in. Implied Consent switches them on unless the visitor opts out; it is only for CCPA territories such as California and cannot be selected for a geolocation in Europe. No Consent removes the consent requirement for optional categories. Where the law needs it, geolocation moves visitors to a stricter mode automatically. On v9, GDPR mode is opt-in and CCPA mode switches optional categories on by default.

Strictly necessary

Cookies a website needs to provide something the visitor has asked for, such as keeping items in a basket, keeping a login secure, or remembering the visitor’s cookie choice. They do not need consent. A cookie being useful to the business does not make it strictly necessary. More: Do You Need a Cookie Banner in the UK? 2026 Rules.

Exceptions (UK law) and consent exceptions

UK law allows some cookies and similar technologies without consent. The ICO lists five exceptions. Two are long-standing: communication and strictly necessary. Three were added on 5 February 2026: statistics used only to improve your own site, remembering appearance or functionality choices, and locating someone who asks for emergency help. The statistics and appearance exceptions still require clear information and a simple, free way to opt out.

In Cookie Control: Premium has a setting called a consent exception, which switches a category on before the visitor chooses. Use it only when the category qualifies for one of these exceptions. On v9, the lawful basis setting can mark a category as “legitimate interest”, which shows it as on while letting visitors object. More: Cookie Regulations 2027: The Complete UK & EU Guide.

Legitimate interests

A legal basis under UK and EU GDPR for using personal data without consent, where your reasons are not outweighed by the person’s rights. It does not replace consent for cookies: PECR requires consent, or an exception, before anything is stored on a device.

Prior consent

The rule that cookies and similar technologies that need consent must not be used until the visitor has agreed. A banner on its own does not do this: the scripts that set them have to wait.

Script blocking

How a website makes scripts wait for consent, so that a script only runs once the visitor has accepted its category.

In Cookie Control: on v9, your developer places each script in code that runs only when the visitor accepts that category (its onAccept function). Premium blocks third-party scripts until the visitor agrees to the relevant category. Integrations you switch on are blocked automatically; other scripts carry a category attribute (data-cmp-category) and wait for that category.

Withdrawing consent

Visitors can change their mind at any time, and it must be as easy as giving consent. Cookies already set by other domains may stay in the browser until they expire.

In Cookie Control: on v9, a small icon in the corner of the page reopens the cookie settings by default. More: Why Third-Party Cookies Can’t Be Deleted by Your CMP.

Consent cookie

The cookie a consent platform sets to remember the visitor’s choice, so the banner does not appear on every page. The ICO says a cookie that remembers a visitor’s cookie preferences can fall under the strictly necessary exception. Visitors must be told about it clearly, and it must be used for nothing else.

In Cookie Control: on v9 the cookie is called CookieControl and lasts 90 days by default. More: Why a Privacy Policy Update Brings the Cookie Banner Back.

Cookie wall

Blocking access to a website until the visitor accepts cookies. The European Data Protection Board, which brings together EU regulators, says consent given this way is not freely given.

Consent or pay

Offering visitors a choice between accepting tracking or paying, for example with a subscription, to use a site without it. In the EU its legal position is contested. The ICO says these models can comply with UK law if you can show that people are free to give or refuse consent. Take advice before using it. More: Cookie Regulations 2027: The Complete UK & EU Guide.

Dark patterns

Design choices that push people towards accepting, such as a hidden or greyed-out reject button, pre-ticked boxes, or asking again and again after someone has said no. Regulators, including the ICO and France’s CNIL, have warned or fined websites over these practices.

---

Tools and records

CMP (consent management platform)

Software that asks visitors for consent, makes scripts wait until they agree, remembers their choice and keeps a record of it. More: What Is a CMP? And When a Free One Is Enough.

Cookie banner

The part of a CMP that visitors see: the message and buttons that ask for their choice. Under UK and EU rules, rejecting should be as easy as accepting.

Preference centre

The second layer of a cookie banner, where visitors can switch individual categories on or off instead of accepting or rejecting everything.

Cookie categories

Groups of cookies sorted by purpose, such as necessary, analytics and marketing, so visitors can accept some and refuse others. Under opt-in rules such as the UK’s and the EU’s, optional categories stay off until the visitor switches them on.

Cookie scan

Checking which cookies and scripts a website actually sets, usually with a scanner, so the banner and the cookie list match what the site does. No scanner finds everything, so scans work best alongside a manual check. More: What a Cookie Scanner Can and Cannot Find.

In Cookie Control: Premium scans your site on a schedule and proposes a category for each cookie it recognises from CIVIC’s cookie database. Proposed changes wait for you to publish.

Cookie declaration

The list of every cookie a website uses, with who sets it, why, which category it belongs to and how long it lasts. It goes out of date whenever the site changes, which is why regular scans matter.

Cookie policy

The page that explains how a website uses cookies and how visitors can change their choice. It usually includes or links to the cookie declaration. It is separate from the privacy policy.

Privacy policy

The notice that explains what personal data an organisation collects, why, who it shares it with and for how long. On v9, Cookie Control can link to it from the banner and record the date it was last updated. Changing that date asks returning visitors for consent again. More: Why a Privacy Policy Update Brings the Cookie Banner Back.

Consent record (consent log)

Evidence of each consent decision, kept so you can show who agreed to what, and when.

In Cookie Control: on v9, when consent logging is switched on, it stores six things for every decision: an identifier for that browser, the categories chosen, the date and time, an anonymised IP address, the user agent and the page URL. Premium records the same six fields and exports them as a CSV. Cookie Control stores and processes consent data in the UK and Ireland. More: What Cookie Control Stores When Someone Consents.

Geolocation

Showing a version of the banner according to the visitor’s location, so you can apply different settings for different countries. More: Cookie Regulations 2027: The Complete UK & EU Guide.

In Cookie Control: a Premium feature. A geolocation is a version of your consent banner for a specific location, with its own compliance mode, layout, trackers and styling. Visitors see the banner mode that matches the law where they are.

---

Laws and regulators

UK GDPR

The UK’s main data protection law. It defines valid consent and sets the rules for personal data collected through cookies, including being able to show that someone consented. More: UK GDPR & PECR Cookie Rules Explained in Plain English.

PECR

The Privacy and Electronic Communications Regulations 2003. Regulation 6 is the UK cookie rule: you need consent before storing or reading information on someone’s device, unless one of the exceptions applies. More: UK GDPR & PECR Cookie Rules Explained in Plain English.

DUAA (Data (Use and Access) Act 2025)

The UK law that changed PECR and the UK GDPR. Its main cookie changes have applied since 5 February 2026. They added the three newest exceptions above. They also raised the maximum fine for breaking PECR from £500,000 to £17.5 million or 4% of annual global turnover, whichever is higher. More: Cookie Regulations 2027: The Complete UK & EU Guide.

ICO

The UK regulator for data protection and PECR. On 30 September 2026 the Information Commissioner’s Office became the Information Commission, but it is still known as the ICO. It publishes guidance on cookies and similar technologies, and can fine organisations that break the rules.

ePrivacy Directive

The EU law behind European cookie consent rules. Each EU country applies it through its own national law, so the details differ from country to country. More: Cookie Regulations 2027: The Complete UK & EU Guide.

EU GDPR

The EU’s data protection law, on which the UK GDPR is based. It applies to organisations based in the EU, and to organisations elsewhere that offer goods or services to people in the EU or monitor their behaviour.

CCPA

California’s privacy law, the California Consumer Privacy Act (as amended). It gives people the right to opt out of the sale or sharing of their personal information, rather than requiring opt-in consent for cookies. More: Global Privacy Control, DNT and Browser Signals: What We Honour and Why.

The five exceptions in UK law. Everything else needs consent first.

Signals and frameworks

Google Consent Mode

Google’s way for a website to tell Google’s tags what a visitor agreed to. It uses signals such as ad_storage, analytics_storage, ad_user_data and ad_personalization, each set to granted or denied. It passes on the visitor’s choice; it does not block scripts on its own.

In Cookie Control: Cookie Control is a Google-certified consent management platform. On v9, our set-up guide keeps every signal at denied until the visitor consents. On Premium, you switch Consent Mode on in your settings. More: Google Consent Mode v2 Setup with Cookie Control.

TCF (Transparency and Consent Framework)

An industry standard run by IAB Europe for passing consent choices between the companies involved in online advertising. It defines standard purposes and a list of advertising vendors, and stores the visitor’s choices in a coded string. Depending on the purpose, it can carry consent or, where allowed, legitimate interests. It is mainly used by publishers that sell advertising.

In Cookie Control: Cookie Control is registered with IAB Europe and supports the framework.

GPC (Global Privacy Control)

A browser setting that tells websites the person wants to opt out of the sale or sharing of their data. It has legal weight in California and some other US states.

In Cookie Control: on v9 and Premium, GPC is honoured in CCPA mode. On v9, every category defaults to off for a visitor sending the signal. More: Global Privacy Control, DNT and Browser Signals: What We Honour and Why.

Do Not Track (DNT)

An older browser signal asking websites not to track the person. It never became an agreed standard, and the W3C group working on it closed in 2019.

In Cookie Control: it is not supported, so the signal has no effect. More: Global Privacy Control, DNT and Browser Signals: What We Honour and Why.