Consent banners on subdomains: one banner or one per subdomain

A site with a shop on shop.example.com and a blog on blog.example.com usually has one consent banner, on the main domain, and a quiet assumption that it covers the rest. It does not. Consent is given to a controller for a purpose, and the banner on the main domain records a choice for that domain. The subdomain is a different origin for cookies, and a cookie set on example.com does not prove anything about shop.example.com unless the consent scope was designed that way.

The question is not how many banners to show. The question is what the consent record covers. A consent record has to show who consented, to what, when, and in which version of the text. If the record says the visitor consented on example.com and the tracking fires on shop.example.com, the record does not cover the processing, and the processing is happening without a lawful basis. That is the gap a regulator finds, and it is the gap most sites have.

How the cookie scope actually works

A consent cookie can be set at the parent domain, which makes it readable across subdomains, but readability is not the same as validity. The cookie proves a choice was made on one domain. It does not prove the visitor saw the same banner, the same purposes, and the same vendors on the subdomain, because the subdomain may load different tags, different vendors, and different purposes. If the subdomain loads an analytics tag the main domain does not have, the consent for that tag was never given, whatever the cookie says.

The honest design is to define the scope in the banner itself. The banner says which domains it covers, the purposes are the same across those domains, and the vendor list is the same. Then one banner and one record cover the scope, because the scope was designed, not assumed. If the purposes differ between subdomains, the banner has to differ too, and one banner per scope is the answer, even if it looks like more banners to the visitor.

What breaks in practice

What breaks is the subdomain that was added later. The marketing team launches a shop on a subdomain, the tags come with the platform, and nobody updates the consent scope. The banner on the main domain keeps showing, the shop keeps setting cookies, and the consent record keeps saying the visitor consented to something they never saw. The first time anyone notices is an audit, or a complaint, and by then the gap has been running for months.

Test it the way a visitor experiences it. Clear cookies, visit the subdomain directly, and see what loads before any banner appears. If tags fire before consent on the subdomain, the banner is not covering it, whatever the design document says. Then check the consent record: does it name the subdomain, the purposes, and the text version? If it names only the main domain, the record is incomplete, and the fix is in the scope, not in the banner copy.

The rule to keep

One banner per consent scope, and the scope is defined by purposes and vendors, not by domains. If two subdomains share purposes and vendors, one banner covers both, and the record says so. If they do not, they need separate banners, or a single banner that lists the combined purposes honestly. A banner that claims a scope it does not have is worse than no banner, because it creates a record that looks like compliance and is not.

Keep reading: The close button that is not consent: designing a banner exit that holds up, Consent records and the retention period that decides deletion.

Frequently asked questions

Does a consent banner on my main domain cover my subdomains?

Only if the consent scope was designed that way. A cookie set on the main domain is readable across subdomains, but it only proves a choice made on the main domain. If the subdomain loads different tags or purposes, the consent does not cover them.

Can one consent cookie be shared across subdomains?

Yes, by setting it at the parent domain. But readability is not validity. The record still has to show the visitor saw the same purposes and vendors on the subdomain, and if the subdomain has different tags, the consent was never given for them.

How do I test whether my subdomain is covered?

Clear cookies, visit the subdomain directly, and see what loads before any banner appears. If tags fire before consent, the banner is not covering it. Then check the consent record: does it name the subdomain, the purposes, and the text version?

Should each subdomain have its own banner?

One banner per consent scope, and scope is defined by purposes and vendors, not domains. Subdomains that share purposes and vendors can share a banner. Subdomains with different purposes need separate banners, or one banner that lists the combined purposes honestly.