GDPR: if a user doesn&#39;t agree cookies on my banner, what must I do?
<p>if a guest of my site click on "Not agree" on cookie banner, what must I do?</p>

<ol>
<li>Have I to disable all the cookies?</li>
<li>Have I to disable all the cookies except technical cookies (eg. login session cookies)?
(I hope the second one)</li>
</ol>

<p>And if I use anonymous google analytics, have I to disable also it or not?</p>

<p>Another question: for registered users is it correct to not present the cookie banner?</p>

<p>Thanks, bye</p>

<p>Technical cookies are always fine at any time, the user does not have to agree for these cookies.</p>

<p>You cannot use any other cookie until the user agreed. So if the user clicks on "Not agree", nothing changes, as you still cannot set those cookies.</p>

<p>Also see <a href="https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2013/wp208_en.pdf" rel="nofollow noreferrer">Working Document 02/2013 providing guidance on obtaining consent for cookies</a> for further guidance.</p>

<p>The same applies to google analytics, you cannot use it until the user agrees, but you can <a href="https://law.stackexchange.com/a/30638/18215">configure Google Analytics in a way you don't need consent</a>.</p>

<p>You can use a cookie to store whether the user agreed or not to the cookie banner. That way you don't have to ask it again. And yes, you can store that cookie without consent. So it might happen if a registered user did not answer the cookie banner, so you still display it.</p>

<p>Supplementing the answer by wimh, the GDPR says that you cannot require consent to use of cookies (or to any other processing) as a condition of registration, or of use of the site, <strong>unless</strong> the cookies, or other processing, are essential for the functioning of the site (or for the features made available to registered users). In general you cannot require consent as a condition of use, unless the use is not possible without the processing for which consent is being asked.</p>

gdpr