Cookie consent is a decision a visitor makes about what may be stored on their device and read back from it. It is not the banner, which is only the place the decision is collected, and it is not the cookie that records the outcome. Keeping those three apart is the single most useful thing a person new to this can do, because almost every problem worth fixing lives in one of them specifically.
The decision and what makes it count
For a consent to be worth anything it has to be given before the storage happens, by a clear action rather than by silence or by continuing to browse, with enough information in front of the visitor to know what they are agreeing to, and with refusing no harder than agreeing. Those four conditions are the whole test. A banner can be beautiful and fail all four, and a plain one can pass all four, which is why audits start with behaviour rather than with design.
The mechanism, which is where it usually breaks
Something has to carry the decision to the tags. In most small company stacks that is a consent signal read by the tag manager before any trigger fires. When this is wrong, the banner still appears and still records a click, and the tags still fire exactly as before. Nothing on screen indicates the failure. That is why the storage panel on a fresh visit is the first test rather than the last.
The record, which is what you will be asked for
Months later the question is not whether you had a banner. It is whether this visitor agreed, when, and to what. Answering needs a durable record holding the categories chosen, the moment, and which version of the banner text was on screen, kept long enough to outlive two rebuilds of the site. A flag that says accepted is not a record; it is a reason to stop showing the box.
What it is not
It is not a cookie policy, which is a document. It is not a privacy policy, which covers more ground. And it is not a one-off task: a site's tag stack changes, and a consent given against last year's purposes does not cover this year's new pixel. Treating it as a project with an end date is the reason so many banners are quietly describing a site that no longer exists.
Questions people ask about what is cookie consent
Is clicking accept the consent, or is the cookie?
The click is the consent. The cookie is how the site remembers it so the visitor is not asked again.
Does consent have to be per category?
In practice yes for anything beyond a trivial site, because a single all-or-nothing choice rarely meets the specific requirement.
What if the visitor ignores the banner?
Then nothing non-essential may be stored. Silence is not agreement, and a timeout that assumes agreement is the same error with a delay.
Does consent transfer between my sites?
No. It was given on one site, for that site's purposes. A shared consent platform across domains needs careful handling and is not automatic.
Do I need consent for a login cookie?
No. Storage strictly necessary to deliver what the visitor asked for is exempt, and a session for a login they initiated is the clearest example.
Where should the consent record live?
Somewhere you can query later and that survives a site rebuild. This is exactly what the paid side of this product exists to keep.