Do you need a cookie banner? Consent rules by region

Check the site before installing a banner. The decision depends on what the technologies do, which rules apply to your visitors, and whether a specific exemption fits the configuration. A tool labelled “analytics” is not automatically exempt, and a banner that appears while trackers already run does not collect prior consent. Work through this sequence:

1. List every cookie and storage item your site sets, and every third-party request it makes before you click anything.
2. Classify each one: strictly necessary, preferences, analytics, advertising, or embedded content.
3. Check where your visitors are. If you have EU or UK visitors, consent rules apply to the non-exempt items. If you only serve the US, focus on opt-out rights and disclosures.
4. Apply the exemptions honestly. In the UK, check the statistical and appearance conditions. In EU countries, check national guidance on analytics.
5. Decide. If anything non-exempt remains for EU or UK visitors, you need a consent banner that blocks it until people agree.
6. Update the privacy policy so it describes the cookies, the consent behavior, and how to change choices.

If the list is short, consider removing tools rather than adding a banner. Self-hosted fonts, click-to-load embeds, and dropping unused pixels can leave you with only essential cookies. For the policy itself, see how to create a privacy policy for a website.

The strictly necessary exemption is narrower than many banners claim. Ask whether the service the user requested would break without the cookie, from the user's point of view, not the business's.

Usually exempt:

• Session cookies that keep someone logged in or remember a shopping cart.
• Security cookies that prevent fraud or protect login forms.
• Load balancing cookies that route requests.
• A cookie that remembers the visitor's consent choice.
• Preferences the user actively set for the current service, such as language, in some regulators' readings.

Usually not exempt:

• Advertising, retargeting, and social media pixels.
• Most third-party analytics.
• Embedded videos and social posts that set their own cookies.
• A/B testing and personalization tools.

Some regulators recognize narrow middle ground. France's CNIL, for example, accepts that audience measurement can be exempt when it is strictly limited to measuring the site for the publisher, produces anonymous statistics, and does not track people across sites, with conditions on cookie lifetime and data retention. Check the guidance in each country you target before relying on such an exemption.

If you need consent, the banner has to collect it properly. European regulators have been clear about the common failures. The European Data Protection Board's Cookie Banner Taskforce report found that most authorities consider a banner without a reject option on the same layer as the accept option to be an infringement, and it criticized deceptive button designs and cookies wrongly labelled as essential.

A practical checklist:

• Block before consent: non-essential cookies and scripts must not load until the visitor agrees.
• Reject as easily as accept: offer a reject or decline button alongside accept on the first layer.
• No pre-ticked boxes: categories start switched off.
• Granular choices: let people accept analytics without accepting advertising.
• Clear information: name the purposes and the third parties involved, and link to your privacy policy.
• Easy withdrawal: a persistent link such as Cookie settings lets people change their mind as easily as they consented.
• Records: keep evidence of consent where you rely on it.

European guidance also says cookie walls, which block access unless people accept, generally do not produce valid consent. A banner that only says “by using this site you accept cookies” fails nearly every point on this list.

The EU rule comes from Article 5(3) of the ePrivacy Directive, not from the GDPR itself. It says that storing information, or gaining access to information already stored, on a user's device is only allowed if the user has given consent after receiving clear and comprehensive information. Each EU country implements the directive in its own law, so details vary slightly.

There are two exemptions:

1. Storage or access whose sole purpose is carrying out the transmission of a communication over a network.
2. Storage or access that is strictly necessary for the provider to deliver a service the user explicitly requested.

Three points surprise many site owners:

• It is not only cookies. Local storage, pixels, SDKs, and device fingerprinting techniques can all fall under the rule.
• It applies whether or not the data is personal. The trigger is accessing the device.
• Consent follows the GDPR standard. It must be freely given, specific, informed, and unambiguous, given by a clear affirmative action. In the Planet49 case, the EU Court of Justice held that a pre-ticked checkbox does not create valid consent.

Often yes, but the UK rules changed. The UK equivalent of the ePrivacy rule is regulation 6 of the Privacy and Electronic Communications Regulations. The Data (Use and Access) Act 2025 amended it, and the relevant provisions came into force on 5 February 2026.

The ICO's guidance now describes five exceptions to the consent requirement:

1. Communication: solely to transmit a communication.
2. Strictly necessary: essential to provide the service the user requests.
3. Statistical purposes: solely to collect statistical information about how your service is used, with a view to improving it.
4. Appearance: solely to adapt the appearance or functionality of the service to the user's preferences.
5. Emergency assistance: solely to locate a device to provide emergency help.

The statistical and appearance exceptions come with conditions. You must give clear and comprehensive information and a simple, free way to object. For analytics, the ICO says data must be aggregated, must not be used to track or profile people or for advertising, and any third-party provider may only act on your behalf, not use the data for its own purposes. Online advertising never qualifies. So a UK site using only first-party, aggregated analytics may avoid a consent prompt, but most advertising setups still need one.

There is no general US law requiring opt-in consent before setting cookies. The US model focuses on notice and opt-out, so a European-style banner is often not legally required, though many US businesses use one to manage choices.

What US laws do expect:

• California CCPA: businesses that meet its thresholds and sell or share personal information, including for cross-context behavioral advertising, must offer an opt-out, typically a Do Not Sell or Share My Personal Information link, and must honor opt-out preference signals such as Global Privacy Control.
• Other state privacy laws: many give consumers the right to opt out of targeted advertising, and several require businesses to honor universal opt-out mechanisms. Some require opt-in consent for sensitive data.
• CalOPPA: requires your privacy policy to say how you respond to Do Not Track signals and whether third parties may collect information about visitors' online activities across sites over time.
• COPPA: sites directed to children under 13 generally need verifiable parental consent before collecting persistent identifiers for behavioral advertising.

See the US state privacy laws overview for which states apply and how their opt-out rules differ.

Google adds contractual requirements on top of the law. Its EU user consent policy applies to end users in the European Economic Area, the UK, and Switzerland. If you use Google products such as Google Analytics, Google Ads, or AdSense, you must obtain legally valid consent for cookies or other local storage where the law requires it and for the collection, sharing, and use of personal data for ad personalization. You must also keep records of consent, give clear instructions for revoking it, and identify each party that may collect, receive, or use personal data.

Two practical consequences:

• Publishers: Google requires publishers using AdSense, Ad Manager, or AdMob to use a Google-certified consent management platform when serving ads to users in the EEA and UK.
• Advertisers and analytics users: Google's consent mode lets your banner pass consent states for storage, ad user data, and ad personalization to Google tags, which adjust their behavior accordingly.

Describe whatever you implement in your privacy policy. The Google Analytics privacy policy guide and analytics privacy disclosures explain the related policy wording.

Yes, in most cases, because they do different jobs. The banner collects or records choices at the moment someone arrives. The privacy policy explains your processing in full: what each tool collects, why, who receives it, how long it is kept, and how people can change their mind.

The two must agree. If your policy says analytics only run after consent, the banner must actually block them until then. If tags fire before a choice, your policy should not claim otherwise.

Legal Policy Generator writes the policy side, not the banner. It does not provide a cookie banner or a consent management tool. Its questionnaire asks which tracking technologies you use, whether non-essential tracking starts only after consent or before consent with an opt-out, and how people can change their preferences, then selects matching clauses for the regions you serve. You can start with the Privacy Policy Generator and pair the result with a consent tool of your choice.

If you also want a separate cookie document, read privacy policy vs cookie policy to decide whether it adds value for your site.