When your website needs a cookie banner.

The short answer

The European rule covers anything stored on the visitor's device, whatever it is called. Under Article 5(3) of the EU's ePrivacy Directive, storing information on a visitor's phone or computer, or reading what is already there, needs their consent, unless it is strictly necessary to give them a service they asked for. The European Data Protection Board's 2024 guidelines on the rule's technical scope cover tracking pixels and tracking links as well as cookies.

So the question is what your site sets, and why. A shopping basket, a login or the answer to the cookie question itself can be stored without asking, because the visitor needs them for what they came to do. Counting visits, measuring ads and loading content from other companies generally cannot, in the EU.

The US works the other way round. No federal law requires a cookie banner. California's privacy law and those of other states let tracking start, but require businesses above set thresholds to let people opt out of having their data sold or shared for advertising.

The rest of what the GDPR asks of a website, from processors to retention, is in our GDPR checklist. This guide is only about the banner.

What triggers a banner beyond analytics

Analytics is the trigger everyone knows, and it has a guide of its own. These are the others that small business sites carry, often without the owner choosing them:

• An advertising pixel or tag, such as Meta's pixel or a Google Ads tag. Meta's Business Tools Terms put the duty on you: clear notice on every page where the pixel runs and, where the law requires consent for cookies, as in the EU, verifiable proof that the visitor gave it.
• An embedded YouTube video. Google says its privacy-enhanced mode stops the view from shaping the viewer's YouTube recommendations and ads. It does not say that nothing is stored or sent, so in Europe treat the video as something that waits for a yes.
• An embedded map on the contact page, which loads from the map provider's servers as the page opens. The UK regulator, the ICO, advises setting up embedded content so it sets nothing the instant someone visits, and telling people what pressing play will trigger.
• A chat widget from another company. It may store an ID in the browser so the conversation survives a change of page, and it may load the vendor's own tracking. Check what yours sets.
• A booking widget from your booking tool, which can bring its own cookies onto every page it sits on.
• Fonts loaded from another company's servers. In January 2022 a Munich court ruled that a site broke the law by loading Google Fonts from Google's servers, passing a visitor's IP address to Google without consent, and ordered the owner to stop and pay damages. The court pointed out the fonts could have been used without contacting Google at all.
• Session recording and heatmap tools, which log each tap and scroll.
• Share buttons and social feeds that load from the network's own servers.

Each of these is a choice. Some are worth a banner. Others cost less to replace than to ask about.

Find out what your site really sets

Do not rely on memory, or on what your web designer believes is on the site. Plugins, themes and booking tools add things quietly, and an update can add more. You can check it yourself on a laptop:

• Open the site in a private window, so nothing from earlier visits is stored.
• Before you click anything, open the developer tools (F12 on Windows, Command Option I on a Mac). In Chrome or Edge go to the Application tab, in Firefox to Storage, and look at Cookies and Local storage.
• Open the Network tab and reload the page. Each row is a request. Look for addresses that are not your own domain, such as facebook.net, googletagmanager.com, google-analytics.com, youtube.com, fonts.googleapis.com or your chat or booking vendor.
• Repeat on each kind of page: the home page, a service page, the contact page, the booking page and any page with a video.
• Write each item in a table: its name, who sets it, what it is for, and whether the site needs it for something the visitor asked for.

Every row marked no in the last column is what the banner is for, or what you remove. Keep the table. It becomes the list your banner and your privacy notice describe, and the first thing to update when someone adds a tool.

Europe and the UK: nothing runs before a yes

In the EU, consent has to come before the tracking starts, and it has to be a real choice. In January 2023 a taskforce of EU data protection authorities, working through the European Data Protection Board, published its shared view on common banner designs:

• A first screen with Accept and a route to settings, but no way to refuse, was an infringement in the view of a vast majority of the authorities.
• Pre-ticked boxes in the settings layer do not give valid consent.
• A refuse option shown as a faint link, while Accept is a button, can mislead the visitor, and so can a refuse link placed outside the banner.

The UK's regulator says the same in its own words. The ICO's guidance asks that refusing be as easy as accepting. Its example of good practice shows equally prominent Accept all and Reject all buttons on a phone and on a desktop, and its bad example offers only Accept all and More options. Carrying on browsing is not consent, silence is not consent, and visitors must be able to withdraw as easily as they agreed.

UK law now has five exceptions where no consent is needed, after the Data (Use and Access) Act 2025. Two matter for small sites: statistics used only to improve your own site, and remembering how a visitor wants the site to look or work, such as a language. Both require clear information and a simple, free way to object. None covers advertising: the ICO says no advertising purpose meets the strictly necessary exception.

The US: opt-out, and only above a size

State privacy laws in the US do not ask for a yes before tracking. They give people the right to say no, and they apply only to businesses above set thresholds of revenue or data. Under California's CCPA, a covered business that sells or shares personal information for cross-context behavioural advertising must, in most cases, show a clear link such as Do Not Sell or Share My Personal Information, and must treat a browser's Global Privacy Control signal as a valid request to opt out.

This is not theory for ad pixels. In August 2022 California's Attorney General settled with Sephora, saying its arrangement with third-party trackers on its website and app counted as a sale of consumer information, and that it failed to process opt-outs sent through Global Privacy Control. Whether your own business is covered is in our guide to the CCPA and other state laws.

Many US sites show a banner anyway, because they have visitors in Europe or because their ad platform asks for notice. If you add one, make it mean something. A banner with a single OK button records nothing useful: it is not consent in Europe, and it is not an opt-out in California.

What a lawful banner looks like on a phone

Most visitors from a search or an ad arrive on a phone, where the banner competes with your phone number and booking button for a small screen. The ICO warns that a box designed for a desktop can be hard to read or use on a phone, and that consent given through it may not be valid. A banner that works on a phone:

• Sits at the bottom of the screen and covers no more than it has to, so the page behind it can still be read.
• Shows Accept all and Reject all as two buttons of the same size, colour and weight, side by side, on the first screen. A third, plainer option such as Choose opens the settings.
• Says in two short lines what each tool does and who runs it, for example: "We would like to use Meta's pixel to measure our ads and a counter from Google to see which pages get visits. Nothing loads unless you say yes."
• Loads none of those tools until the visitor taps a button, and nothing at all if they close the banner or scroll past it.
• Lets the visitor read the page and call you without answering first. A banner that blocks everything until they agree pushes people towards yes, which is the opposite of a free choice.
• Has a link in the footer, such as Cookie settings, that reopens it so people can change their mind.

Then test it. On a laptop, open the site in a private window with the developer tools on the Network tab, tap Reject all and click around: no request should go to Meta, Google's ad or analytics servers or anyone else you listed. Do it again with Accept all to check that the tools do start. On a landing page for ads, test the banner together with the form on a real phone, because a banner that covers the form's button costs you the enquiries the ad paid for.

Our own site, as a worked example

ggsites.com shows no cookie banner, because it sets no cookies for visitors. Visits are counted by the site's own code, without cookies and without storing anything on the device, as the privacy notice explains. Browsers that send Do Not Track or Global Privacy Control are not counted at all.

The cookies page lists what is kept in the browser instead: the conversation with the site's assistant, in session storage so it follows the visitor from page to page and disappears when the tab closes, a note that the assistant's hint was shown, the visitor's choice to reduce motion, and the answer to the cookie question if it is ever asked. The page says these are strictly necessary for features the visitor uses, and that none is used for advertising or sent to anyone else.

It also says what would change. If we start measuring Meta ads, the site will ask first, with Accept and Decline given equal weight, and only a yes loads Meta's pixel. Declining changes nothing else on the site. That is the whole decision in one line: the banner arrives with the first tool that needs it, and not before.

Fewer things to ask about

Every tool that needs consent loses data from the people who say no, and the banner itself takes attention at the top of every first visit. Before you add one, see whether you can drop what causes it:

• Replace the embedded map on the contact page with your address, a photo of the entrance and a link that opens the visitor's map app.
• Show a still image of the video with a play button, and load the video only when it is tapped, with a line saying that playing it loads YouTube.
• Host the fonts on your own server.
• Link to your booking tool's own booking page instead of embedding its widget on every page, or embed it on the booking page only.
• Load the chat widget when the visitor taps the chat button, not as the page opens.
• Count visits with a cookieless tool if counts are all you need.

If you run Meta or Google ads and want to measure them in Europe, you need the banner. Ask properly, accept that some people will say no, and carry the campaign tags into each enquiry so you still see which ads bring work. Tracking leads from Meta ads shows how.

If you use a consent tool, check what it does

Consent platforms, cookie plugins and the banners built into website builders ask the question and keep a record of each answer. They only help if they really hold the tools back. Check:

• That its scan found every tool, including the ones a plugin or a booking widget adds. Scans can miss tools that load later or only on some pages, so compare its list with your own table.
• That each tool is placed in a category and blocked until that category is accepted.
• That Reject all is on the first screen and the same size as Accept all.
• That each answer is recorded with the date and the version of the banner, in case a visitor or a regulator asks.
• That the text names your real tools in plain words, not a generic list that came with the plugin.
• That the footer link to reopen it works on a phone.

Google's consent mode is a separate setting that changes how Google's own tags behave once the visitor has answered. It does not ask the question for you, so it never replaces the banner.

Four sites, four answers

• A plumber's five-page site with a contact form, photos of finished jobs and a tap-to-call number. No analytics, no embeds, fonts hosted on the site. No banner, in Europe or in the US.
• A dental clinic in Lyon with an embedded map, Google Analytics and the booking tool's widget on every page. It needs a banner, or a map link, a cookieless counter and the widget on the booking page only. The second route is less to keep right.
• A restaurant in Manchester running Meta ads to its reservations page. The pixel needs consent under UK rules, so the banner stays, and the reservations page is tested with it on a phone before each campaign.
• An online store in Texas that sells across the US and runs Meta's pixel and Google Ads tags. No US law makes it show a banner. If it is covered by the CCPA, it needs a Do Not Sell or Share link and has to honour Global Privacy Control, and if it ships to Europe its European visitors need a banner.

Mistakes to avoid

• A banner that appears while the pixel and analytics load behind it before anyone taps anything.
• Reject hidden behind Settings, or shown as a grey link under a bright Accept button.
• Pre-ticked boxes in the settings.
• No way to change the answer later.
• A cookie list copied from another site instead of checked on your own.
• A new video, chat widget or ad tag added after launch and never added to the banner.
• A banner on a site that sets nothing that needs one. It costs attention and tells visitors you track them when you do not.

Check again whenever something is added: a new ad campaign, a chat widget, a video on the home page or a plugin update. When we build a website, the banner appears only if the site uses something that needs consent, and saying no is as easy as saying yes.

This is general information, not legal advice. Europe applies the cookie rule country by country and the US has different laws state by state. If your site uses tools that need consent, ask an adviser where your main customers are.