Cookie consent

In the EU, the requirement comes mainly from the ePrivacy Directive, which says storing or reading information on a user's device needs consent unless it is strictly necessary for a service the user asked for. GDPR then defines what valid consent means. The UK has similar rules, with a narrow exception for some analytics used only to improve the site, while some other regions use opt-out models instead.

Consent is about more than cookies. Tracking pixels, local storage and device fingerprinting are covered too. And a banner is not consent by itself: what matters is whether tracking actually waits for a clear yes. This page is general information, not legal advice.

How it works

Cookies fall into two groups. Strictly necessary ones, such as a shopping cart, a login session or a load balancer cookie, do not need consent. Everything else usually does: analytics, advertising, social media embeds and most third-party scripts. A consent tool, often called a consent management platform, shows the choices on the first visit and blocks the non-essential scripts until the visitor agrees.

For consent to be valid under GDPR standards it must be freely given, specific, informed and unambiguous, given by a clear action. In practice that means no pre-ticked boxes, no treating continued scrolling as agreement, separate choices for different purposes, and plain information about who sets each cookie and why. EU regulators have repeatedly said rejecting should be as easy as accepting, so a "Reject all" button on the first layer has become the norm.

The choice is stored, usually in a cookie of its own, and the site must respect it on every page. Visitors must be able to change their mind as easily as they gave consent, typically through a link or small icon in the footer. Some tag systems, such as Google's consent mode, read the stored choice and adjust how analytics and advertising tags behave.

Example

A boutique hotel's site shows a banner with "Accept all", "Reject all" and "Settings". Its booking engine's session cookie runs regardless because the booking cannot work without it. Analytics and advertising pixels stay off until the visitor accepts those categories.

When the owner checks the site in a private browser window and opens the developer tools, she finds a social media pixel firing before any click. It had been added directly to the page template by a former marketer, bypassing the consent tool. Moving it into the tool's controlled categories fixes the problem. Her analytics now show fewer visitors, because some people decline, so she compares trends over time rather than raw totals.

Why it matters for your business

Running trackers without valid consent exposes you to complaints and regulator action, and it undermines trust with visitors who notice. Done properly, consent also costs you data: some visitors will decline analytics, so your reports will undercount. That is the real trade-off. Some businesses reduce their need for consent by using fewer third-party tools, or analytics configured not to use cookies or identify individuals, though whether a given setup is exempt depends on the country's rules and how the tool is configured. You can check your own site by opening it in a private window and seeing which cookies and requests appear before you click anything.

Common mistakes

• Showing a banner but loading analytics and advertising scripts before the visitor has chosen.
• Offering "Accept" prominently while hiding the option to reject behind several clicks.
• Adding new tracking scripts later outside the consent tool, so they fire without permission.
• Having no easy way for visitors to change their choice after the first visit.

Questions people ask

Do I need a cookie banner on my website?

You need one if your site uses non-essential cookies or trackers, such as most analytics, advertising pixels or embedded social media, and you have visitors in the EU, UK or other places with similar rules. A site that uses only strictly necessary cookies does not need a consent banner, though it should still explain them.

Does Google Analytics need cookie consent?

In the EU, generally yes, because it sets cookies and collects data that is not strictly necessary to provide the site. The UK exception for analytics covers only data used to improve your own site, not data a provider also uses for its own purposes. Configure it to wait for consent, for example through a consent platform. This is general information, not legal advice.

Can I just use a "by using this site you accept cookies" notice?

Not under EU rules. Continued browsing is not a clear affirmative action, so it does not count as valid consent for non-essential cookies. Visitors need a real choice, including an easy way to reject, before those cookies are set.