Does my website need a cookie banner? A plain-English guide for small businesses

Cookie banners are the most misunderstood thing on the web. Half the small-business sites we measure show a banner they don’t legally need, and a good share of the rest run tools that do need one without asking. Both come from the same place: nobody explained the rule in plain language.

This is that explanation. One caveat up front: this is practical guidance from people who build websites, not legal advice. If your situation is unusual — health data, children, a large audience — talk to a lawyer.

The short answer

You need a cookie banner if your website stores anything on the visitor’s device, or reads anything from it, that isn’t strictly necessary to make the site work. Analytics cookies, advertising pixels, most embedded widgets — yes. A login session, a shopping basket, remembering that someone closed a notice — no.

So the question isn’t “do I have a website?” but “what have I plugged into it?”

What the rule actually says

In the EU, two pieces of law apply. The ePrivacy Directive (the actual “cookie law”) says that storing or accessing information on a user’s device requires their consent, unless it is strictly necessary to provide a service the user asked for. The GDPR then governs whatever personal data those cookies collect. The UK kept the same rule after Brexit, under PECR; the ICO’s guide to cookies is the clearest official write-up of how it works in practice and reads almost identically to the EU position.

Three things follow from that wording:

• It isn’t only about cookies. Local storage, tracking pixels, device fingerprinting — anything that stores or reads information on the device counts.
• “Strictly necessary” is narrow. It means necessary for the thing the visitor asked for: logging in, keeping a basket, remembering a language choice, remembering the consent choice itself. “Necessary for our marketing” doesn’t qualify.
• Consent has to be real. Freely given, specific, informed, and as easy to refuse as to give. Pre-ticked boxes don’t count. A banner with a big “Accept” and a hidden “Reject” has been fined — France’s regulator penalised Google and Facebook in 2022 precisely for making refusal harder than acceptance.

In the United States there is no federal cookie law. State privacy laws such as California’s apply above revenue and data-volume thresholds that most small businesses don’t reach, and they work on an opt-out basis rather than consent. If you sell to EU or UK visitors, though, EU rules apply to those visitors regardless of where you are.

Which tools trigger a banner

Here is the practical list. If any of these are on your site, you need consent before they run:

• Google Analytics (GA4) — sets identifying cookies.
• Advertising pixels — Meta (Facebook/Instagram), Google Ads, TikTok, LinkedIn Insight.
• CRM and marketing trackers — HubSpot, Mailchimp site tracking, ActiveCampaign.
• Chat widgets that identify returning visitors — Intercom, Drift, most live-chat tools.
• Embedded YouTube videos in standard mode (the “privacy-enhanced” embed is better but still loads Google scripts on play).
• Embedded Google Maps, social feeds, “share” buttons from the networks themselves.

And the list that does not:

• Your own first-party session cookie, basket, login.
• The cookie that remembers “this visitor dismissed the banner”.
• A contact form that sends an email.
• Self-hosted fonts and images (fonts loaded from Google’s servers are a separate, murkier question — hosting them yourself avoids it).

The option most small businesses miss: analytics without cookies

You can know how many people visit, which pages they read and where they came from without identifying any of them. A newer class of analytics tools — Plausible, Fathom, Umami, Cloudflare Web Analytics — counts visits without cookies, without storing anything on the device, and without building a profile of the person. They report the numbers a small business actually looks at: visits, pages, sources, countries.

Because nothing is stored on the device and no individual is tracked, these tools are widely treated as not requiring a banner. Regulators have not all said so in identical words — France’s CNIL, for example, exempts audience measurement only under specific conditions, and some German authorities are stricter — so if your audience is mostly in one country, it’s worth a glance at that regulator’s own guidance. For the typical small business, cookieless analytics plus no advertising pixels means no banner and nothing to apologise for.

This is how we build client sites by default: the owner gets their numbers, the visitor gets a clean page.

When you do need the banner, do it properly

Sometimes the tool is worth it. If you run paid advertising, you need the ad platform’s pixel to measure it. If you run a CRM that tracks which pages a lead looked at before enquiring, that tracking is the point. Our sister site leavsy.com is an example: it uses HubSpot’s CRM, so it shows a consent banner, and HubSpot’s scripts don’t run until the visitor accepts. This site, by contrast, sets no cookies at all.

If that’s you, the banner has to meet the standard:

1. Nothing non-essential runs before consent. Not “we load the pixel and ask afterwards”. This is where most off-the-shelf banners fail.
2. Reject is as easy as Accept. Same size, same step, same screen.
3. It says what it’s for, in a sentence a person can read: “We use HubSpot to see which pages visitors view. Accept or decline.”
4. The choice is remembered, and can be changed later from a link in the footer.
5. Your privacy and cookie policy pages match reality — name the tools, what they store, for how long.

Done this way, a banner is a small, honest notice, not a wall. Done badly — a full-screen overlay with a hidden decline — it costs you visitors and still doesn’t comply.

What a banner costs you

There is a commercial reason to avoid an unnecessary banner, beyond the law. A banner is the first thing a new visitor sees before they see your offer. On mobile it can cover half the screen. Every tool between the visitor and your headline is a reason to leave, and a surprising number of people do. If you don’t need it, don’t show it.

The decision in one minute

• No analytics, no pixels, no embeds — no banner needed. Just a privacy policy saying you only collect what people send you through the contact form.
• Cookieless analytics only — in practice no banner for most small businesses; check your local regulator if you want to be certain.
• Google Analytics, any ad pixel, HubSpot-style tracking, standard YouTube/Maps embeds — banner required, blocking those tools until consent, with an equal Reject.

If you’re not sure which group your site is in, run it through the meter on our homepage: the request list shows every outside service the page loads. Or ask for a free 24-hour audit and we’ll tell you exactly which tools are on the page, which need consent, and what the lighter alternative would be.