Design cookie banners that look good, follow UX, and meet the PDPL

What is a PDPL-compliant, good-UX cookie banner?

A PDPL-compliant, good-UX cookie banner provides just enough information for users to decide, does not hide the reject button, does not force clicks, and records consent status as required. With the Personal Data Protection Law (Law 91/2025/QH15) (expected to take effect 01/01/2026), businesses need tighter consent management; if you use tracking tools like analytics, pixels, or advertising, you must ensure proper notice and choice mechanisms.

The key point: the banner doesn’t need to be “advertising-pretty”; it needs to be easy to read, uncluttered, and not give users the sense they’re being tricked into clicking quickly. If done wrong, a business may be seen as lacking transparency in its consent mechanism under the regulations; penalties will follow guiding decrees, and serious violations can face criminal handling.

What layout should a cookie banner have?

A good banner typically has four parts: a short title, a plain-language description, peer-level action buttons, and a link to cookie policy or preference management for details.

Minimum content should include:

• A banner that does not take over the entire screen unless necessary.
• A short description: the website uses cookies to operate, measure, personalize, or advertise.
• Two primary buttons placed at the same level: Accept and Reject.
• A Customize button or link to open cookie categories.
• A link to the cookie policy / privacy notice.

Short example copy for Vietnamese SMEs: “We use cookies to operate the website, analyze traffic, and improve the experience. You can accept, reject, or customize as you wish.”

How should the Accept/Reject buttons be designed to avoid dark patterns?

If you’re asking “design cookie banner good UX PDPL,” the single most important criterion is that the Accept/Reject buttons must be on equal footing in placement, size, and prominence.

Do:

• Make both buttons the same visual level.
• Use the same background color or equivalent contrast; if using an accent color, don’t privilege just one button.
• Don’t turn “Reject” into a tiny link while “Accept” is a big button.
• Don’t pre-check the consent checkbox.
• Don’t use pressure copy like “Agree to continue” unless the site truly requires it.
• Don’t block users from viewing content if they haven’t consented, unless genuinely required by regulation or the nature of the service.

Don’t:

• Hide the reject button behind multiple layers of menus.
• Use a muted gray for Reject and a bright green for Accept.
• Use countdowns, repeating pop-ups, or nagging reminders to force a choice.

From a UX angle, users need to feel in control. From a PDPL angle, businesses must be able to prove consent is voluntary, specific, and revocable under the regulations.

How to make cookie banners on mobile without breaking UX?

On mobile, the most common mistakes are banners that are too tall, cover content, or place buttons too close together, causing mis-taps. A good phone banner must prioritize scanning quickly and one-tap actions.

Practical recommendations:

• Use a bottom sheet or a fixed block at the bottom of the screen.
• Cut the copy down to 2–3 lines.
• Make buttons large enough with comfortable touch targets.
• Stack buttons vertically if the screen is too narrow, but maintain equal visual weight.
• Don’t make the policy link too small.
• Test on popular iPhone and Android devices, especially when system navigation bars are present.

If your site gets a lot of traffic from social ads, mobile UX is even more important because users often bounce quickly if the banner covers key content.

What should SMEs watch out for during implementation?

SMEs often use many off-the-shelf tools: Google Analytics, Meta Pixel, support chat, CRM forms, A/B testing. Each of these may trigger notice and consent-management obligations. So don’t just “slap on a banner”; map each tracker to a specific purpose group.

Short checklist:

• Do you have a list of cookies/trackers by page?
• Have you classified necessary vs. non-essential cookies?
• Do you have a consent log to prove choices if needed?
• Do you block scripts before consent is obtained?
• Is the reject button clearly visible on both desktop and mobile?

If you’re using a consent management platform or custom code, carefully check the script loading flow to prevent trackers from firing before users choose. For complex scenarios, consult a lawyer or PDPL specialist before deployment.

What plug-and-play cookie banner copy can you use right away?

You can start with the short template below and tailor it to your product:

“This website uses necessary cookies for operation, and analytics/personalization cookies to improve your experience. You can Accept, Reject, or Customize your choices. See the Cookie Policy for details.”

Buttons:

• Accept
• Reject
• Customize

This design is clear enough for users to understand, compact enough not to break UX, and balanced enough to avoid dark patterns.

If you’re preparing to deploy a banner, consent.vn can support the cookie banner module, store consent evidence, and DSAR flows so your dev team doesn’t have to stitch everything together.

Source: the Personal Data Protection Law (Law 91/2025/QH15) and Decree 13/2023/ND-CP: thuvienphapluat.vn; enforcement authority: Ministry of Public Security (A05): bocongan.gov.vn