EU Cookie Consent for Game Sites: What 2026 Enforcement Actually Requires
EU Cookie Consent for Game Sites: What 2026 Enforcement Actually Requires
Honesty note: not legal advice — this is the compliance map for European traffic on a game website, from public regulator positions (EDPB, CNIL) as of 2026. My own site is a content site with no analytics cookies and no ad cookies yet; this is the checklist I’ll hold myself to when that changes (site privacy).
TL;DR
- The legal stack is two instruments: the ePrivacy Directive (Art. 5(3) — consent before non-essential cookies) and GDPR (validity of that consent). Together: no non-essential cookie fires until the user actively opts in.
- The EDPB Cookie Banner Taskforce set the design law (2023 report, still the reference in 2026): the reject option must be as prominent as accept — same size, same visual weight, on the first layer, not hidden in settings. Pre-ticked boxes, dark patterns, and “by continuing to browse” are all invalid consent.
- 2026 enforcement is design-specific, not theoretical: CNIL issued enforcement actions against the “big green Accept All + tiny gray Manage” pattern (6 in 2025 alone); regulators now reject banners on measurable design criteria (EDPB guidance).
- The cookieless path is the small-site win: if your game site has no analytics cookies and no ad cookies, you may need no consent banner at all — localStorage saves and strictly-necessary cookies are exempt. Only add a banner when you add trackers.
The two laws, in one line each
- ePrivacy Directive, Art. 5(3): storing/accessing information on a user’s device (cookies, pixels, fingerprints) requires prior consent — unless strictly necessary for the service.
- GDPR (Art. 7 + recital 32): that consent must be freely given, specific, informed, unambiguous, and opt-in. Silence, pre-ticked boxes, and inactivity are not consent.
The EDPB expanded Art. 5(3)‘s reach (Guidelines 2/2023, finalized Oct 2024): it covers pixels, URL tracking, IP-only tracking, and fingerprinting, not just cookies.
The banner requirements that get enforced (2026)
The EDPB Taskforce’s positions (and CNIL’s enforcement) reduce to concrete design rules:
| Requirement | What it means in practice |
|---|---|
| Reject = accept, visually | Same size/color/weight, on the first layer, next to accept — not behind “Manage preferences” |
| No pre-ticked boxes | Consent must be a positive action |
| No dark patterns | No misleading colors, no “accept” implied by scrolling, no cookie walls blocking content |
| Granular choice | Per-category toggles (necessary/analytics/marketing) in the preferences layer |
| Prior to loading | No non-essential scripts fire before the user picks |
| Withdrawal path | A persistent, easy way to change consent later |
CNIL’s 2025 enforcement actions (6 against the nudge-banner pattern alone) show this is being checked on design, not just legal text.
What this means for a game website
The good news: a game/content site with no analytics cookies and no ad cookies needs no banner — localStorage (on-device, no transmission) and strictly-necessary cookies are outside consent. My own site is currently in this state: no trackers, no banner, and a privacy policy that says so.
The moment you add trackers (GA4, ad SDKs, heatmaps), you need:
- A compliant banner (reject=accept prominence, no pre-tick, granular).
- Consent before loading the trackers (gate scripts on consent).
- The analytics/ads themselves set to respect consent (GA4 consent mode, portal SDKs handle their own).
- A withdrawal path (re-open the banner).
Ad SDKs change the math: portal-embedded games (CrazyGames, Poki) run inside the portal’s page — their banner, their consent. Your own domain (your site, your itch embed, your Cloudflare-hosted game) is where your consent obligations live (where your game actually runs).
The cookieless alternative (worth doing anyway)
For a content site, cookieless analytics (Plausible, GoatCounter, Fathom-style) or no analytics at all:
- Removes the banner requirement entirely.
- Removes the consent-gating code.
- Is privacy-better for players (a selling point, trust baseline).
If you don’t need granular visitor data in month one, skip tracking entirely; add it (with a banner) only when you have a question tracking answers (income metrics).
Pitfalls
- “By continuing to browse” banners — invalid consent; regulators and the EDPB are explicit.
- Pre-ticked analytics — pre-ticked boxes are the textbook invalid-consent example.
- Hidden reject — the “big green accept, tiny gray manage” pattern got 6 CNIL actions in 2025; it’s the current enforcement target.
- Banner on a cookieless site — unnecessary friction; no trackers = no banner needed.
- Consent after loading — firing GA4/ads before the user chooses is the core ePrivacy violation, not a technicality.
Bottom line
EU cookie consent in 2026 is design-enforced: reject as prominent as accept, no pre-tick, granular, prior to loading, with a withdrawal path — under ePrivacy + GDPR, policed by the EDPB Taskforce’s positions and CNIL’s design-specific enforcement. For a small game site, the winning move is structural: no trackers, no banner, local-only saves, and a privacy policy that says so. Add tracking (and its banner) only when you actually need the data — that’s the cheapest compliant state, and it’s the one my site ships in today (privacy policy).