IMY criticises companies’ cookie banners

The Data Protection Agency has reprimanded three companies for deficiencies in their cookie banners. The cases involve Warner Music AB, ATG and Aller Media AB, and concern inadequate information, misleading design and an incorrect legal basis for processing personal data.

In ATG’s case, the issue was the use of dark patterns—interfaces that steer users towards consent through unclear options or hard-to-find rejection mechanisms. This contravenes the GDPR requirements for consent, including that consent must be freely given and informed.

Aller Media was criticised for invoking “legitimate interests” as a GDPR legal basis for processing without demonstrating a balancing test. Warner Music received a reprimand for failing to explain how consent can be withdrawn—withdrawal must be as easy as giving consent.

Cookie banner compliance: legal context

The combined effect of the GDPR and the Swedish Electronic Communications Act (LEK) is that:

• Cookies require prior consent before they are stored (LEK).
• Any subsequent processing must have a valid GDPR legal basis for processing and meet the GDPR requirements for consent.

Operational implications for cookie banner compliance

For controllers, the design of cookie banners is not a technical afterthought but a legal matter that can trigger supervision and sanctions. Effective cookie consent design must deliver valid consent under the GDPR: consent must be specific, informed and freely given consent (GDPR), and consent must be as easy to withdraw as to give. Controllers should ensure cookie consent compliance and avoid dark patterns.

Morling Consulting’s GDPR lawyers help organisations across Europe to design lawful, user-friendly cookie consent solutions—focused on cookie consent compliance and robust governance.

Practical takeaways

• Provide clear, prominent options to refuse or accept—no nudging or asymmetric paths.
• Explain purposes and vendors so that informed consent (GDPR) is meaningful and consent must be specific.
• Offer simple, persistent controls to withdraw consent, matching the effort required to give it.

Need support to assess your cookie consent solution and strengthen governance? Our team can review designs against the GDPR requirements for consent and implement improvements aligned with cookie banner compliance.