Default Cookie Settings
Definition
The initial cookie configuration applied to users before they make explicit choices—typically whether non-essential cookies are enabled or blocked by default. Privacy laws generally require that non-essential cookies be disabled by default, loading only after users provide consent. This means cookie consent banners should present choices with analytics, marketing, and targeting cookies pre-set to 'off,' requiring users to actively enable them. Default settings that enable all cookies and require users to opt-out violate privacy principles and regulatory guidance. The default should be privacy-protective, with essential cookies only. Cookie management platforms should enforce appropriate defaults, prevent non-consented cookies from loading, respect defaults until consent is given, and remember user choices for future visits. Default settings matter because many users don't actively manage preferences—they accept defaults. Privacy-protective defaults respect user privacy even for those who don't engage with consent interfaces.
Applicable Laws & Regulations
- 1GDPR Article 25(2) - Privacy by default
- 2ePrivacy Directive Article 5(3) - Prior consent for non-essential cookies
- 3GDPR Recital 32 - No consent if silence, inactivity, or pre-ticked boxes