> 1. A pop-up notifying the visitor on the website's cookie policy (required by EU law). > 2. A pop-up asking the visitor to consent to its privacy policy (req

> 1. A pop-up notifying the visitor on the website's cookie policy (required by EU law). > 2. A pop-up asking the visitor to consent to its privacy policy (required by EU law). You never need both. GDPR superceded the "Cookie Law", so the cookie policy pop-up is no longer needed. You may not even need the explicit consent popup. You do need user consent for storing user personal data, if you gather, store, and process personal data. Even then, you only need explicit consent if none of the other implicit authorizations apply: https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/