Consent banners are the most disliked element on the modern web and, for many businesses, a legal requirement. The confusing part is that the answer genuinely depends on where your visitors are.
If you have visitors in the EU or UK you generally need prior consent before setting non-essential cookies, including most analytics. Several US states require an opt-out rather than opt-in. The practical approach is a consent tool that blocks non-essential scripts until permission is given, plus Consent Mode so you keep modelled data when people decline.
What the main rules require
| Regime | Applies to | Standard |
|---|---|---|
| GDPR and ePrivacy | EU visitors | Prior opt-in consent for non-essential cookies |
| UK GDPR and PECR | UK visitors | Same as above |
| CCPA and CPRA | California residents | Opt-out, plus a do not sell mechanism |
| Other US state laws | Various states | Generally opt-out based |
| PIPEDA | Canada | Meaningful consent, less prescriptive |
This is a summary rather than legal advice. If you handle sensitive data or operate at scale, take proper advice for your jurisdictions.
What counts as essential
- Essential, no consent needed: session cookies keeping someone logged in, shopping basket contents, security tokens, load balancing.
- Non-essential, consent needed: analytics, advertising and remarketing pixels, heatmaps, session recording, most embedded video, chat widgets that track.
Analytics being non-essential surprises people. Under EU rules it generally is, whatever your analytics vendor's marketing says.
Doing it without destroying your data
- Use a consent tool that genuinely blocks scripts until consent, rather than one that only displays a banner while tags fire anyway. The second is common and provides no protection.
- Implement Google Consent Mode so analytics receives consent signals and can model the gap rather than losing those visits entirely.
- Make accepting and rejecting equally easy. Interfaces that hide reject behind three clicks have been ruled non-compliant repeatedly.
- Log consent, so you can show what was agreed and when.
- Re-request periodically rather than treating one acceptance as permanent.
The trap to avoid
Removing a consent banner because it costs you data, while continuing to set the same cookies, is the worst of both worlds: you carry the same legal exposure and lose the record that you asked.
The opposite trap is a badly configured banner that defaults analytics to denied with no way to grant it, which silently zeroes your reporting. We have seen both, and the second is usually discovered months later.
Beyond cookies
- A privacy policy that describes what you actually collect, in plain language.
- A lawful basis for processing personal data, including form submissions.
- A retention policy, since keeping enquiry data indefinitely is hard to justify.
- A route for people to request or delete their data.
- Processor agreements with vendors handling data on your behalf.
Frequently asked questions
Do I need a cookie banner?
If you have EU or UK visitors and set any non-essential cookies, including analytics, then generally yes. If you serve only US visitors, most state laws require an opt-out mechanism rather than a banner. Check where your traffic actually comes from before deciding.
Does Google Analytics need consent?
In the EU and UK, generally yes, because it is not essential to delivering the site. Consent Mode lets you keep modelled data when visitors decline, which recovers much of the reporting value without setting cookies before permission.
Will a consent banner hurt my analytics?
It will reduce measured traffic, often noticeably. Consent Mode mitigates this through modelling. What you should not do is remove the banner while continuing to set the same cookies, since that keeps the exposure and loses the record.
Can I make rejecting harder than accepting?
No. Regulators across the EU and UK have repeatedly ruled that reject must be as easy as accept, typically one click at the same level. Interfaces designed to nudge acceptance are a common enforcement target.
Do I need a privacy policy?
Yes, if you collect any personal data, which includes a contact form. It should describe what you collect, why, how long you keep it and who you share it with, in language a visitor can follow.