Most cookie banners on Czech websites fail in one of two ways. Either they nudge the visitor towards "Accept all" with a big coloured button and a grey link for everything else, or they guard cookies the site never needed to set in the first place.
Both are fixable, and the second one is cheaper. Here is what the rules say, what a banner has to do, and how to find out whether you need one at all.
What the law says
Storing information on a visitor's device, or reading it back, is regulated in Czechia by the Electronic Communications Act (No. 127/2005 Coll.), section 89(3). For years the Czech text was more relaxed than the EU directive behind it: a site could set cookies unless the visitor objected.
That ended on 1 January 2022, when amendment No. 374/2021 Coll. made consent the rule. Non-essential cookies may now only be set after the visitor has agreed.
When a cookie also involves personal data, which is almost always true of analytics and advertising cookies, the GDPR applies on top. The supervisor for both is the Office for Personal Data Protection (ÚOOÚ).
Which cookies need consent, and which do not
Technical cookies that the site needs in order to work do not need consent. A shopping basket, a login session and the small record of the cookie choice itself are the usual examples.
Analytics cookies, advertising and remarketing cookies and personalisation cookies do need it, and they need it before they are set, not after the visitor has already been tracked for the first page view. A "statistics only" label does not change that: statistics is analytics.
What a compliant banner does
Refusing must be as easy as accepting. In practice that means a "Reject all" button on the same layer as "Accept all", with the same size and visual weight. Burying refusal behind a "Settings" link is the single most common mistake.
Nothing can be pre-ticked. The Court of Justice of the EU ruled in the Planet49 case (C-673/17) that a pre-ticked box is not valid consent, and the same logic applies to a banner whose optional categories are switched on by default.
Silence is not consent. Scrolling, clicking elsewhere or simply carrying on browsing does not count, and neither does closing the banner. The visitor has to make an active choice.
The site has to keep working when the answer is no. Blocking the page until someone accepts, a so-called cookie wall, is regarded by the European Data Protection Board and several supervisors as making the consent not freely given.
Withdrawing consent must be as easy as giving it, which is why you see a "Cookie settings" link in so many footers. And you should be able to show later what each visitor agreed to and when.
The cheapest way to comply: set fewer cookies
A site that sets only technical cookies does not need a consent request for them. It still has to say what it does, in a privacy policy, but it can skip the pop-up entirely. For a brochure site that is often the right answer: ask yourself whether you will really use the analytics report, and whether the advertising pixel is attached to a campaign that is running today.
Check before you decide. Open the site in a private window, open the browser's developer tools, look at the cookies and local storage under the Application tab, and note what appears before you click anything. Tag managers, chat widgets, embedded videos and maps are the usual sources of cookies nobody remembers adding.
Third-party embeds deserve a second look for another reason. Loading a map, a video or a font from another company's servers sends your visitor's IP address to that company. That should be covered in your privacy policy and, depending on what the embed does, may need consent too. Self-hosting fonts and loading embeds only when the visitor clicks are two simple ways to avoid the problem.
A short checklist before launch
List every cookie and storage item the site sets, and what each is for. Remove what you do not need. Group what is left into necessary, analytics and marketing, and make sure the last two stay off until the visitor opts in.
Give "Reject all" and "Accept all" equal weight on the first layer. Link to a privacy policy that names the cookies, the purposes and how long they last. Add a footer link that reopens the choices. Then test it yourself: refuse everything, reload, and confirm in the developer tools that nothing optional was set.
What this costs if you get it wrong
Under the GDPR, fines can reach 20 million euros or 4 percent of worldwide annual turnover, whichever is higher. Czech cookie fines have been far smaller than that: in a summary the ÚOOÚ published in August 2023, the highest final cookie fine was CZK 898,000. The office checks websites on its own initiative as well as after complaints, so "nobody will notice" is not a plan.
This article is general information, not legal advice, and the rules and the ÚOOÚ's guidance do change. If your site tracks visitors across other sites, sells to consumers or handles sensitive data, have a lawyer look at your set-up.