Cookie consent banner: what the law requires and how to set one up

Do you need a cookie consent banner?

A cookie consent banner asks visitors whether they agree to cookies and similar technologies that aren't essential to run your site, such as analytics, advertising pixels, embedded videos and chat widgets. Whether you need one, and what it must do, depends on where your visitors are.

This is a jurisdictional topic, so this guide names the rules plainly. It's general information, not legal advice; if your situation is complex, take advice.

For most businesses with visitors from the UK or EU, the practical answer is yes: if your site uses Google Analytics, advertising pixels, LinkedIn or Meta tags, embedded YouTube videos or a third-party chat tool, you need a consent banner.

What counts as "strictly necessary"?

Strictly necessary cookies don't need consent. These are cookies the site can't work without for something the visitor has asked for:

• keeping someone logged in
• remembering what's in a basket
• load balancing and security, such as fraud prevention
• remembering the visitor's cookie choices

Analytics, advertising, social media pixels and most embedded third-party content are not strictly necessary in the EU. In the UK, the newer exemption can cover first-party analytics used only to improve your own site, but only with clear information and an easy way to object. Advertising and cross-site tracking still need consent everywhere in the UK and EU.

What a compliant cookie banner does

Regulators in the UK and EU have been consistent about what makes consent valid. The European Data Protection Board's cookie banner taskforce and the ICO's guidance both point the same way.

1. Nothing non-essential before consent. Tags that need consent must not fire until the visitor agrees.
2. Reject is as easy as accept. A "Reject all" option on the first layer, as visible as "Accept all". Making people click through to settings to refuse is the most common failing.
3. No pre-ticked boxes. Silence, scrolling or pre-selected options aren't consent.
4. Clear information. Say what each category does and name the main third parties, in plain language.
5. Granular choice. Let people choose by category (for example analytics, marketing), not just all or nothing.
6. Easy to change your mind. A link or icon on every page to reopen the settings and withdraw consent.
7. No dark patterns. Don't use colour, size or wording to steer people towards accepting.
8. Records kept. Your consent tool should log what each visitor agreed to and when.

Cookie banner examples: what good and bad look like

How to set up a cookie consent banner

1. Find out what your site actually uses

List every cookie and tracker before you choose a tool. Check your tag manager, your CMS plugins, embedded content (video, maps, booking widgets, chat) and your analytics and advertising accounts. Open your site in a private browser window, open the developer tools and look at the cookies set on first load: anything beyond essential cookies is a problem to fix.

2. Choose a consent management platform

Most businesses use a consent management platform (CMP) rather than building their own. When comparing them, check that it:

• blocks scripts until consent, rather than just showing a message
• offers a first-layer reject button
• scans your site and categorises cookies
• logs consent
• supports Google Consent Mode if you use Google Analytics or Google Ads
• lets you style the banner to match your site and meet accessibility standards

3. Connect it to your tags

This is where most set-ups fail. The banner looks right, but tags still fire before consent.

• In Google Tag Manager, use consent settings or triggers so each tag only fires when its category has been granted.
• Hard-coded scripts in your theme need to be moved into the CMP's blocking mechanism or the tag manager.
• Embedded videos and maps can be replaced with a placeholder until consent, or loaded in privacy-enhanced modes where available.

4. Set up Google Consent Mode, if you use Google tags

Consent Mode passes the visitor's choice to Google's tags, which then adjust how they behave. Google requires Consent Mode for some advertising features when you serve ads to users in the European Economic Area and the UK. Your CMP should handle this for you; check its documentation.

5. Test it

• Open the site in a private window and check no non-essential cookies are set before you choose.
• Click "Reject all" and confirm analytics and marketing tags don't fire (use your tag manager's preview mode or the browser's network tab).
• Accept, then withdraw consent, and check tags stop.
• Test on mobile, and with a keyboard only.

Write a cookie policy

Your banner should link to a cookie policy, a page (or section of your privacy policy) that explains:

• what cookies and similar technologies you use, by category
• what each is for, and who sets it (you or a named third party)
• how long they last
• how to change or withdraw consent

Keep it up to date: every new tool you add to the site may add cookies. Our guide to website privacy policies covers the wider privacy notice.

Cookie compliance: keep it working

Cookie compliance isn't a one-off. Sites drift as plugins, campaigns and embeds are added.

• Re-scan monthly, or after any new tool or campaign tag is added.
• Review the banner wording when you add a new category of tool.
• Check analytics after changes. A big drop in recorded visits after a banner change can be expected, since people are refusing, but no data at all usually means a set-up error.