Cookie consent sits at the intersection of law, UX, and technical implementation. The ePrivacy rules cover storage or access on a user's device, while GDPR defines what valid consent looks like when it is the lawful basis. A sound implementation inventories every cookie, local-storage key, embedded player, analytics tag, and advertising pixel before deciding what can load. Rejecting optional categories must prevent those technologies from running, and withdrawing consent should be as easy as granting it. Essential login and security cookies need a separate, documented purpose. Avoiding non-essential cookies and advertising pixels reduces the amount of consent-gated technology, but it does not automatically settle the legal basis for analytics. Server-side processing, pseudonymised identifiers, embedded services, and the destination site's own scripts still need review. Requirements vary by purpose, configuration, jurisdiction, and any other technology on the site. Qualified counsel should review the actual deployment rather than the product label.