Use cookie consent for the actual purpose-level decision, storage blocking, consent record, renewal, and withdrawal model for cookies and similar technologies; use cookie banner for the entry surface, consent prompt for non-cookie optional data-use consent, preference center for durable settings, privacy settings for broader privacy controls, and legal acceptance for terms or policy agreement.
Use cookie consent for the actual purpose-level decision, storage blocking, consent record, renewal, and withdrawal model for cookies and similar technologies; use cookie banner for the entry surface, consent prompt for non-cookie optional data-use consent, preference center for durable settings, privacy settings for broader privacy controls, and legal acceptance for terms or policy agreement.
Practice the judgment: Imagine this situation: Analytics, advertising, or personalization tags fire before the user chooses a cookie purpose. Write the person's goal, choose one of these patterns, and show the state that helps the person continue. Use the decision rules and source trail below to explain your choice.
Review the underlying principle →| Dimension | Cookie consent | Cookie banner | Consent prompt | Preference center | Privacy settings | Legal acceptance |
|---|---|---|---|---|---|---|
| UI or UX | UI + UX - Purpose-level consent and runtime enforcement model for cookies, local storage, pixels, tags, SDKs, and similar device storage or access | UI + UX - Cookie and tracking consent control | UI + UX - Specific opt-in decision for optional data use, participation, communication, sharing, or training | UI + UX - Persistent hub for communication, consent, topic, privacy, language, and personalization choices | UI + UX - Durable privacy-control surface for account, product, device, app-access, activity, visibility, and sharing settings | UI + UX - Explicit agreement gate for terms, conditions, contracts, policies, legal disclosures, or updated service rules before access or transaction commitment |
| UI guidance | Present strictly necessary storage separately from optional cookie purposes such as analytics, advertising, personalization, functional enhancements, pixels, SDKs, and similar technologies. | Render a clearly labelled cookie banner at the top of the document before ordinary page content, with service-specific copy, essential-cookie information, equal accept and reject actions for non-essential purposes, and a link to detailed cookie settings. | Render a consent prompt as a focused opt-in decision that names the requester, purpose, data involved, optionality, benefit, consequence of declining, withdrawal route, and consent record before the user chooses. | Render a preference center as a returnable hub with categories for communications, channels, topics or interests, notification delivery, privacy and data sharing, cookie or tracking consent, personalization, language or locale, required messages, managed values, source-of-truth status, and save feedback. | Render privacy settings as a returnable control surface with current effective values, privacy categories, data types, app or service access, account/device/product scope, source of truth, managed or unavailable reasons, last updated status, and save or immediate-apply feedback. | Render legal acceptance as a required agreement control that names the document, owner, version or effective date, scope, linked or embedded full terms, and consequence of accepting or declining. |
| UX guidance | Use cookie consent when the user must decide which non-essential storage or tracking purposes can run before optional cookies, tags, pixels, local storage, or SDKs are activated. | Use a cookie banner to collect or confirm choices for non-essential cookies, local storage, pixels, service-worker storage, analytics, advertising, personalization, or similar device storage technologies. | Use consent prompt when the product needs the user to knowingly agree to a specific optional data-processing purpose such as marketing, research participation, AI training, personalization, partner sharing, or sensitive-data use. | Make the effective result clear before and after save: what changes now, what stays required, which rows are policy-managed, which external system owns the value, and where users can withdraw consent or unsubscribe. | Use privacy settings when users need to inspect and change ongoing privacy posture for saved activity, profile visibility, app access, device permissions, data sharing, ad personalization, location, connected apps, or product privacy dashboards. | Use legal acceptance when users must knowingly agree to terms of service, conditions of sale, workplace terms of use, contract amendments, policy acknowledgements, or other legal documents before proceeding. |
| Good UI | A cookie settings page shows essential cookies locked on, analytics, personalization, and advertising off by default, plus Accept all, Reject all, Save choices, and a vendor details panel. | A service banner says it uses essential cookies and asks to use analytics cookies, with Accept analytics cookies, Reject analytics cookies, and View cookies controls at the same level. | An AI writing tool asks whether the user wants workspace snippets used to improve future suggestions, shows included data types, keeps the default off, and records the consent version after opt-in. | A customer account preference center shows Email, SMS, Push, Topics, Cookies, Data sharing, Language, and Required service messages, each with current status, scope, and last saved time. | An account privacy dashboard groups Saved activity, Profile visibility, Ad personalization, Connected apps, Location history, Device permissions, and Data deletion, with current values, scope labels, last updated times, and unavailable reasons. | A checkout step shows an unchecked I agree to the conditions of sale checkbox beside linked terms, blocks Place order until checked, and validates the missing agreement next to the checkbox. |
| Bad UI | A second-layer settings panel has all optional cookie categories preselected and a prominent Save button. | A banner says by continuing you accept cookies and fires analytics before any button is clicked. | A modal says By continuing you agree to personalized offers and partner sharing, with a large Continue button and a small privacy policy link. | A single Receive updates switch hides whether it controls marketing email, SMS, push, product notices, analytics consent, or service messages. | A single Privacy mode switch claims to turn everything off but leaves ad personalization, public profile visibility, connected apps, and activity retention unchanged. | A prechecked agreement checkbox also opts the user into marketing emails and partner sharing. |
| Good UX | A user rejects all optional cookies, continues using the service, later opens Cookie settings, enables analytics only, receives a saved confirmation, and can withdraw again. | A user changes their mind from Accept to Reject in cookie settings and optional tracking stops for future page loads. | A user consents to a beta research study, sees what data will be reviewed, receives a saved confirmation, and later withdraws from the account privacy page with the same purpose label. | A user turns off promotional email, keeps outage SMS and account security email, changes language to Spanish, withdraws ad personalization, and sees which transactional messages remain required. | A user pauses saved activity, clears search history for a date range, disables ad personalization, hides birthday visibility, revokes a connected app, and sees which values apply immediately versus after sync. | A returning user sees updated terms with a change summary, old and new effective dates, a download route, an accept action, and a clear message that access pauses if they decline. |
| Bad UX | The user closes the banner and the product treats inactivity as consent to advertising cookies. | Reject only closes the banner while ad pixels and analytics continue firing. | A user clicks Next to finish onboarding and unknowingly opts into marketing because the consent copy was bundled into the terms paragraph. | A user opts out of marketing email but continues receiving promotional SMS because the channel matrix was hidden. | A user withdraws a consent prompt, but privacy settings still show personalization enabled because the source of truth and sync state are hidden. | The UI claims acceptance because the user continued browsing or clicked Pay. |
| Best fit | The service needs purpose-level runtime enforcement and an evidence record for optional storage choices. | The service sets non-essential cookies or similar device storage technologies. | The product needs a user's active agreement for optional data use, marketing, research participation, personalization, partner sharing, AI training, or sensitive-data processing. | Users need to revisit and change communication, consent, topic, personalization, privacy, channel, language, or data-sharing choices. | Users need ongoing control over personal data collection, saved activity, visibility, app access, device permissions, connected services, data sharing, or personalization. | A user must accept terms of service, conditions of sale, policy documents, service agreements, acceptable-use rules, or legal disclosures before access or transaction completion. |
| Avoid when | The product only needs to show the first-layer cookie notice; use cookie banner. | The service uses only strictly necessary cookies and can explain them on a cookies page. | The choice is only about non-essential cookies or device storage; use cookie banner. | The product only needs a small app setting unrelated to communications, consent, or personalization. | The task is a first-time opt-in to one optional purpose; use consent prompt. | The choice is optional data processing, marketing, research, or AI training consent; use consent prompt. |
| Required state | Pre-consent state with optional storage blocked. | Accept non-essential cookies state. | Pre-consent state with optional processing off and the core task still understandable. | Overview with preference categories and current effective status | Privacy settings overview with categories and current effective values. | Initial unchecked required agreement state. |
| Accessibility burden | Use native buttons and form controls for accept, reject, save, and purpose choices. | Label the cookie banner region with the service name so users know which service is asking for the choice. | Associate every checkbox or toggle with a complete purpose label and consequence description. | Group categories with headings, fieldsets, legends, and persistent labels that name the affected channel, purpose, topic, source, and scope. | Use clear headings, labels, descriptions, and status text for each privacy category and control. | Associate missing-acceptance validation with the agreement control and preserve focus context. |
| Common misuse | Firing analytics or advertising tags before the user chooses. | Accept-only banners. | Treating continued use, scrolling, closing, or inactivity as consent. | Using one master preference switch for communication, privacy, cookies, topics, and required messages. | Replacing privacy settings with a privacy policy link or legal notice. | Relying on continued browsing, payment, account creation, or a footer link as the only acceptance signal. |