The popup is the part everyone argues about and the part that matters least on its own. It is an interface for collecting a decision, and it is only worth anything if the decision reaches the tags and gets written down. Most of the popups on small company sites fail on one of those two counts rather than on their wording, which is why a rewrite of the copy rarely fixes anything.
The minimum the box has to offer
A visitor has to be able to refuse as easily as they can accept, which in practice means a reject control with the same prominence as the accept control on the first screen rather than two clicks away behind a settings link. They have to be able to see what they are agreeing to, by category, without leaving the box. And nothing non-essential may be stored while they are deciding, which is the requirement that most often turns out to be broken when you look at the storage panel.
The patterns that invalidate the consent
A pre-ticked category is not consent. An accept button in the brand colour beside a reject link in grey text is a design choice a regulator will read as steering. A box that reappears on every page until the visitor accepts is coercion rather than a question. And continuing to browse is agreement has been rejected repeatedly by European authorities, because it collects nothing that could be called a decision. None of these are hard to fix; they are hard to notice, because the people who built them were chasing a click-through rate.
What has to happen after the click
Two things. The tags have to change behaviour, which means the consent state is read before anything fires rather than after, and in a tag manager that usually means moving triggers rather than editing the box. And the decision has to be stored somewhere you can read it back later: which categories, at what moment, against which version of the text. A popup that changes nothing and records nothing is a graphic.
How to test your own in five minutes
Open a private window, load the home page, and before touching anything look at the storage panel and the network tab. Anything written or sent at that point is happening without consent. Then click reject and reload: the same list should be shorter and should stay shorter. Then accept and check that the record of that acceptance exists somewhere you could produce it. Most sites fail the first test, and almost all of them can be fixed in the tag manager rather than in the code.
Questions people ask about cookie popup
Does the popup have to block the page?
It does not have to be modal, but nothing non-essential may run while the visitor has not decided. Many sites choose a modal because it makes that easier to guarantee, not because the law asks for one.
Can I default to accepted for visitors outside Europe?
You can vary by region, and many sites do. Make the rule explicit and test it, because a geolocation mistake means the wrong default for a real visitor rather than a theoretical one.
Why does my popup keep reappearing?
Almost always because the cookie that records the decision is itself being blocked, cleared or written to a different domain than the one reading it. Check that first before changing anything else.
Is a small banner at the bottom enough?
Size is not the test. Whether a visitor can refuse as easily as accept, and whether anything fired before they chose, are the tests.
Where should the popup store the decision?
Somewhere you can read back later with the categories and the moment intact. A single accepted flag in local storage is enough to stop the box reappearing and useless the day anyone asks what was agreed.
Does the popup need a settings screen?
It needs a way to choose per category. A second screen is the usual way to do that, as long as refusing everything is still available on the first one.