Before a regulator's check: ten points about cookies

Slovakia: the regulator checks that nothing beyond strictly necessary cookies is stored before consent (§ 109(8) of Act No. 452/2021 Coll.). It uses its own tool, Cookies Auditor, which reads cookies, local storage, session storage and third parties. The fine runs from €200 to 5% of turnover (§ 124(3)). By its own account it had run more than 105 website inspections by August 2025 and imposed fines totalling over €80,000.

Czechia: in a known case from 2023 the ÚOOÚ first warned a site. The operator then fixed the banner, whose first screen had offered only "Povolit všechny cookies" and "Upravit". The CZK 602,000 fine was for what remained: cookies set without prior consent, no stated purpose for some cookies, and the purpose not given in Czech.

The burden of proving that consent was freely given lies with the site's operator, not with the regulator.

1. 01Nothing beyond the necessary is stored before the decisionHow to check it: Open the site in a private window and, before touching the banner, look at cookies, local storage and session storage in your browser's tools (F12).
2. 02Reject is on the banner's first screenHow to check it: As visible as Accept, not hidden in the settings.
3. 03After a refusal nothing runs, not on the next page eitherHow to check it: Refuse, open another page and look at storage and network requests again.
4. 04Consent by category, nothing ticked in advanceHow to check it: Open the banner's settings and see what is on before you choose anything.
5. 05Every cookie is describedHow to check it: The cookie policy states the purpose, the duration and who sets it; no unclassified cookies.
6. 06Information in the visitor's languageHow to check it: The banner and the policy show in the page's language; in Czechia, in Czech.
7. 07The decision can be changed at any timeHow to check it: Every page has a link or button to the cookie settings.
8. 08The decision has a reasonable lifetimeHow to check it: The Slovak regulator generally names 12 months, for a refusal too. After that the banner should ask again.
9. 09You have a record of consentHow to check it: You can show who agreed, when, to what, and which banner text they saw.
10. 10You check again after every changeHow to check it: A redesign, a new plugin or a new ad can break consent without anybody noticing.

• The banner has an "Only necessary" button next to consent on its first screen, and categories with nothing ticked in advance (points 2 and 4).
• Conseto's measurement, and GA4, Google Ads and Meta through Conseto, start only after consent; we do not block scripts outside Conseto, the check tells you which to move (points 1 and 3).
• The banner speaks ten languages and leaves a button for changing the settings (points 6 and 7).
• A decision is good for a year, then the banner asks again; every decision is recorded (points 8 and 9).
• In the app you make a draft cookie policy (AI writes the draft; it is not legal advice) and run the check after every change (points 5 and 10).

• Act No. 452/2021 Coll. on Electronic Communications, § 109(8) and § 124(3) (Slov-Lex, in Slovak)
• Opinion of the Slovak Regulatory Authority for Electronic Communications and Postal Services on obtaining consent, 12 Nov 2025 (PDF, in Slovak)
• Inspections and fines of the Slovak regulator, report of 27 Aug 2025 (noviny.sk, in Slovak)
• Order of the Czech data protection office ÚOOÚ, ref. UOOU-02482/22-9, 18 Jul 2023 (PDF, in Czech)