Store nothing extra without a yes

How to do it

Article 5(3) of the EU ePrivacy Directive covers any storage or reading on the device, including cookies, local storage, fingerprinting and tracking pixels. If you store nothing non-essential, you need no banner. Otherwise, block those scripts until people agree. Ask per purpose, with no box ticked in advance. Show reject on the first layer, as clearly as accept. Keep a record of each choice with its time and the banner version, as GDPR Article 7 requires proof. Let people change their choice later from a link in every footer.

Example

<!-- Blocked until consent: the browser ignores type="text/plain" -->
<script type="text/plain" data-consent="analytics" src="/js/stats.js"></script>
<script>
  function allow(kind) {
    for (const old of document.querySelectorAll(`script[data-consent="${kind}"]`)) {
      const s = document.createElement('script');
      s.src = old.src;
      old.replaceWith(s);
    }
  }
</script>

How to check

With a fresh browser profile, no non-essential cookies, storage or third-party requests appear before consent. After clicking reject, the same holds. Withdrawing consent from the footer link removes the cookies it allowed.