diff --git a/wwwroot/app.js b/wwwroot/app.js
index c442fad..3d78d9e 100644
--- a/wwwroot/app.js
+++ b/wwwroot/app.js
@@ -40,6 +40,25 @@ function setupHandlers() {
   }
   setAuthMode(state.authMode);
 
+  const hasConsent = () => document.cookie.split(";").some((c) => c.trim().startsWith("cookie_consent=1"));
+  const setConsent = () => { document.cookie = "cookie_consent=1; path=/; max-age=31536000; SameSite=Lax"; };
+  const consentRows = document.querySelectorAll(".consent-row");
+  const toggleConsentRows = () => {
+    const hide = hasConsent();
+    consentRows.forEach((row) => row.classList.toggle("hidden", hide));
+  };
+  toggleConsentRows();
+  ["login-consent", "register-consent"].forEach((id) => {
+    const box = $(id);
+    if (box) {
+      box.checked = hasConsent();
+      box.addEventListener("change", () => {
+        if (box.checked) setConsent();
+        toggleConsentRows();
+      });
+    }
+  });
+
   const loginUser = $("login-username");
   if (loginUser) {
     const markEditing = () => { loginUser.dataset.userEditing = "1"; };
@@ -76,8 +95,10 @@ function setupHandlers() {
       const password = $("login-password").value;
       if (username.length > 24) return toast("Username must be 24 characters or fewer.", true);
       if (!username || !password) return toast(t("auth.needCredentials"), true);
+      if (!hasConsent() && !$("login-consent")?.checked) return toast(t("auth.cookieRequired"), true);
       try {
         await api.login({ username, password });
+        setConsent();
         setSavedUsername(username);
         state.isAuthenticated = true;
         setAuthUI(true);
@@ -102,8 +123,10 @@ function setupHandlers() {
       if (username.length > 24) return toast("Username must be 24 characters or fewer.", true);
       if (displayName.length > 16) return toast("Display name must be 16 characters or fewer.", true);
       if (!username || !password) return toast(t("auth.needCredentials"), true);
+      if (!hasConsent() && !$("register-consent")?.checked) return toast(t("auth.cookieRequired"), true);
       try {
         await api.register({ username, password, displayName, adminKey });
+        setConsent();
         setSavedUsername(username);
         state.isAuthenticated = true;
         setAuthUI(true);
diff --git a/wwwroot/index.html b/wwwroot/index.html
index 4f2eef0..3958d8e 100644
--- a/wwwroot/index.html
+++ b/wwwroot/index.html
@@ -41,6 +41,12 @@
         <span class="label" data-i18n="auth.password">Password</span>
         <input id="login-password" name="password" type="password" autocomplete="current-password" required />
       </label>
+      <label class="stack consent-row">
+        <span class="label">
+          <input id="login-consent" type="checkbox" />
+          <span data-i18n="auth.cookieLabel">I agree to essential cookies.</span>
+        </span>
+      </label>
       <button type="submit" data-i18n="auth.loginSubmit">Log in</button>
     </form>
     <form id="register-form" class="stack auth-form hidden" data-mode="register">
@@ -60,6 +66,12 @@
         <span class="label" data-i18n="auth.adminKey">Admin key (optional)</span>
         <input id="register-adminkey" name="adminKey" type="password" maxlength="128" />
       </label>
+      <label class="stack consent-row">
+        <span class="label">
+          <input id="register-consent" type="checkbox" />
+          <span data-i18n="auth.cookieLabel">I agree to essential cookies.</span>
+        </span>
+      </label>
       <button type="submit" data-i18n="auth.registerSubmit">Create account</button>
     </form>
     <div class="stack">
diff --git a/wwwroot/js/i18n.js b/wwwroot/js/i18n.js
index 1b5a74c..e796ed2 100644
--- a/wwwroot/js/i18n.js
+++ b/wwwroot/js/i18n.js
@@ -16,6 +16,8 @@ const translations = {
     "auth.registerHeading": "Create account",
     "auth.switchToRegister": "Need an account? Register",
     "auth.switchToLogin": "Have an account? Log in",
+    "auth.cookieLabel": "I agree to the use of essential cookies.",
+    "auth.cookieRequired": "Please agree to essential cookies to continue.",
     "auth.logout": "Logout",
     "auth.welcome": "Welcome, {name}!",
     "auth.defaultName": "Player",
@@ -185,6 +187,8 @@ const translations = {
     "auth.registerHeading": "Konto erstellen",
     "auth.switchToRegister": "Noch kein Konto? Registrieren",
     "auth.switchToLogin": "Schon ein Konto? Anmelden",
+    "auth.cookieLabel": "Ich stimme der Nutzung erforderlicher Cookies zu.",
+    "auth.cookieRequired": "Bitte stimme den erforderlichen Cookies zu.",
     "auth.logout": "Abmelden",
     "auth.welcome": "Willkommen, {name}!",
     "auth.defaultName": "Spieler",