# GDPR and ePrivacy: how OptinStack maps on

> How OptinStack's blocking, banner modes, categories, and consent records map onto GDPR and ePrivacy requirements.

Author: OptinStack Team  
Published: 2026-06-28  
Page: https://community.optinstack.com/articles/gdpr-and-eprivacy-how-optinstack-maps-on  
Markdown: https://community.optinstack.com/llms.md/articles/gdpr-and-eprivacy-how-optinstack-maps-on

This article explains how OptinStack's features map onto the requirements of the GDPR and the ePrivacy Directive\. It is written as a disclosure of what the platform does, not as compliance advice for your specific situation\.

> **Warning:** This is not legal advice. Whether OptinStack is sufficient for your obligations depends on your jurisdictions, the trackers you use, and your data flows. High-risk sections should be reviewed by a qualified advisor.

## How OptinStack maps onto GDPR and ePrivacy

*GDPR and ePrivacy requirements and the matching OptinStack behavior*

| Requirement | OptinStack behavior |
| --- | --- |
| Valid consent before non-essential storage or access | Pre-consent blocking gates trackers until the visitor accepts the relevant category. |
| Consent must be as easy to withdraw as to give | The preferences dialog lets visitors change or reset any category at any time. |
| Granular control over categories | Four fixed categories (necessary, analytics, marketing, preferences) each toggled independently. |
| Records of consent for accountability | Each choice is synced to the server with a timestamp and the GPC signal, and can be exported. |

## Recommended banner mode

For audiences covered by the GDPR and ePrivacy, use the opt\-in banner mode\. Optional categories start as denied and trackers stay blocked until the visitor accepts\.

### Which banner mode fits a GDPR audience?

Use opt-in mode. It treats all optional categories as denied until the visitor accepts, which aligns with the explicit-consent expectation under GDPR and ePrivacy.

### Does OptinStack keep a record I can show as evidence?

Yes. The synced consent record includes the choices, timestamp, and GPC signal, and can be exported from the Consents area.