Cookie consent banners explained for website owners

The short answer

A cookie consent banner asks visitors to agree before a site stores or reads non-essential data such as advertising or analytics cookies. Whether it is required depends on your visitors' locations, so ask a qualified lawyer. Practically: audit the cookies you set, block non-essential ones until consent, make refusing as easy as accepting, and record choices.

What a cookie actually is

A cookie is a small piece of data that a website asks the visitor's browser to store. It lets a site remember things between page loads: a logged-in session, a basket, a language choice, or an identifier used to count visits or show ads.

Cookies are not the only technology of this kind. Local storage, tracking pixels and device fingerprinting do similar jobs, and privacy rules often cover them together. So when people say "cookie banner", they usually mean a notice about all of these.

Cookies set by your own site are called first-party. Cookies set by another company, for instance through an embedded video or advertising tag, are third-party. Browsers treat these differently and this keeps changing, so check the current documentation for the browsers your visitors use.

Why banners exist

Many countries and regions have rules about storing or reading information on a visitor's device, and about handling personal data collected that way. Some require consent before non-essential cookies are used. Others focus on notice and a way to opt out. The details, such as what counts as essential or what consent must look like, differ by place and change over time.

This guide gives general information only. Your business may face rules in several places at once if you have visitors from more than one country. Ask a qualified lawyer which rules apply to you, and have them review your banner wording and your privacy policy.

Step one: audit what your site sets

Before choosing any banner tool, find out what you are asking visitors to consent to. Open your site in a private browser window, open the developer tools, and look at the stored cookies and the network requests. A cookie scanning tool will do the same across many pages. Then list each one.

You may find cookies you did not know about, left by old plugins, chat widgets or embedded maps. Removing what you do not need is the simplest way to make the banner shorter. It also helps the site load faster.

What a good banner does

Rules vary, but sensible design principles hold almost everywhere.

• Blocks first, then asks. Non-essential scripts should not run until the visitor agrees. A banner that appears while the tracking has already fired does not do its job.
• Gives a real choice. Accept and reject should be equally easy to find and use. Pre-ticked boxes and hidden reject buttons are the kind of design regulators have criticised.
• Explains in plain words. Say what each category does and who receives the data.
• Lets people change their mind. Add a persistent link, often in the footer, to reopen the settings. See what to include in a website footer.
• Remembers the answer. Do not ask again on every page.
• Keeps a record. Store when and what the visitor chose, in case you need to show it.

The banner must also be usable with a keyboard and a screen reader, which ties it to website accessibility.

Choosing how to build it

You have three broad options. A consent management platform is a third-party service that scans your site, shows the banner and keeps the records. A plugin does a similar job inside a content management system. A custom build gives control but means your developer must maintain it as rules and browsers change.

Whatever you pick, check how it handles tag loading. If you use a tag manager, the banner should control which tags can fire, and consent state should pass to your analytics and advertising tools. Our guide to Google Tag Manager basics explains the tag side. Google, for example, documents a consent mode for its own tags; check the current Google documentation for how to set it up properly rather than copying old instructions.

Effects on your measurement

If visitors can decline analytics, your numbers will show fewer visits and conversions than really happen. That is a normal result of respecting choices, not a fault. Plan for it: compare trends over time rather than treating any one figure as exact, and record enquiries in your own system as well. For how events and conversions are set up in GA4, see GA4 events and conversions explained.

Test the banner like any other feature. Visit as a new visitor on a phone and a desktop, decline everything, and confirm with the developer tools that non-essential cookies are not set. Then accept and confirm the tools work. Repeat after any change to the site, plugins or tags.

A short checklist before you launch

Run through this list with your developer and, where needed, your lawyer before the banner goes live.

1. Do we have a written list of every cookie and tracker, with its purpose and who sets it?
2. Do non-essential scripts stay blocked until the visitor agrees?
3. Are accept and reject equally easy to use on a phone?
4. Can a visitor change their choice later from a link on every page?
5. Does the wording match what the site really does?
6. Does the banner work with a keyboard and a screen reader?
7. Have we tested it in the main browsers, including a private window?
8. Do we know who will re-scan the site and when?

If you can answer yes to each, you have a defensible setup, and a lawyer can focus on the finer points for the places you serve.

Mistakes to avoid

• Copying another site's banner text without checking what your own site sets.
• Using a banner that only says "We use cookies" with a single Accept button.
• Loading tracking tags directly in the page code so they bypass the banner.
• Forgetting embedded content such as videos and maps, which can set their own cookies.
• Never re-scanning after a redesign or new marketing tool.

None of these is difficult to avoid once you have an inventory. Keep that list, update it when tools change, and have a lawyer review the setup when your audience or services change.

Related guides

• Website development
• Website Privacy Policy: What It Should Cover
• Website Terms and Conditions: What to Include
• Wordpress website vs custom website
• Website terms and privacy policy do you need them
• What a startup website needs first

Questions and answers

Does every website need a cookie banner?

Not necessarily. It depends on which cookies you set and where your visitors are. A site that sets only strictly necessary cookies may be treated differently from one that uses advertising or analytics. Ask a qualified lawyer.

What is the difference between accepting and rejecting cookies?

Accepting lets the site set non-essential cookies such as analytics or advertising. Rejecting should leave only those cookies that are needed for the site to work, so the visitor can still use it.

Can I just use a free banner plugin?

You can, but check it blocks scripts before consent rather than only displaying a message, records choices and can be configured to match what your site actually sets. Test it after installing.

Do cookie banners affect SEO?

A banner that covers the page or slows loading can harm the experience, so keep it light and avoid hiding content. Search engines do not need your visitors' consent to crawl a page, but check current documentation for specifics.

How often should I review my cookies?

Scan after any redesign, new plugin, new advertising or analytics tool, and on a regular schedule. Embedded third-party content can change what is set without you touching your own code.

Is this legal advice?

No. It is general information. Privacy and cookie rules differ between countries and change, so ask a qualified lawyer about the rules for your business.