In this work, we analyze the legal requirements on cookie banners as a consent mechanism in Web applications. We describe how banners are supposed to be implemented to be fully compliant with the ePrivacy Directive and the GDPR. Our contribution resides in the definition of 22 operational and fine-grained requirements on cookie banner design that are legally compliant, and moreover, we define whether and when the verification of compliance of each requirement is feasible. The definition of requirements emerges from a joint interdisciplinary analysis composed of lawyers and computer scientists in the domain of web tracking technologies. As such, while some requirements are provided by explicitly codified legal sources, others result from the domain-expertise of computer scientists. In our work, we match each requirement against existing cookie banners designs of websites. We exemplify each requirement with compliant and non-compliant cookie banners. For each requirement, we perform a technical assessment to decide if technical (with computer science tools), manual (with any human operator) or user studies (with a significant number of users) verification is needed to assess compliance of consent. We show that it's not possible to fully assess compliance with the law for the majority of requirements because of the current architecture of the Web. With this approach, we aim to support practically-minded parties (compliance officers, regulators, privacy NGOs, researchers, social and computer scientists) to assess compliance and detect violations in cookie banners' design and implementation, specially under the current revision of the EU ePrivacy framework.