One of the biggest debates is whether or not to leave cookies on – thus being served or ‘firing’ – before the visitor grants consent. In essence, do we assume the visitor’s answer is “Do not do it without my permission – unless I opt-in,” or do we assume the answer is, “I am okay with it as long as I don’t say no – unless I opt-out.”

This is known as an Opt-in consent model (“Do not do it without my permission”) vs. an Opt-out model (“I am okay with it as long as I don’t say no”). Stricter regulations like the EU’s GDPR require Opt-in consent, meaning a visitor must click Accept before a cookie can be served. That means upon arrival, all cookies must be turned off. If this does not happen, the site is in violation. If the visitor does not click Accept, no cookies can be served at any point during the session.

The other model is Opt-out consent. In this case, cookies are allowed to fire unless and until the visitors specifically clicks Deny. The problem with this model from a pure privacy perspective is that the visitor’s privacy rights were already impacted because cookies fired upon arrival, before they’d ever had an opportunity to select Deny.