You need a cookie banner if your website sets anything beyond strictly necessary cookies and has visitors from the EU or the UK. Session tokens and shopping carts are exempt, while analytics trackers, advertising pixels and most embeds are not. US visitors bring a different duty, an opt-out link, and the checklist below covers both.
Most websites set more than their owners think, and the list grows every time a new script is added. So the useful question is not whether your site uses cookies, but whether the law requires you to ask before they fire.
What counts as a cookie under privacy law
Article 5(3) of the ePrivacy Directive does not mention "cookies" by name. It covers "the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user". That covers HTTP cookies, but also local storage, session storage, tracking pixels, fingerprinting scripts and any similar technology that reads from or writes to a visitor's device.
The European Data Protection Board adopted Guidelines 2/2023 on the technical scope of Article 5(3) in October 2024, confirming this broad reading. Tracking pixels, tracking links and IoT devices that report data all fall within scope. If a technology stores or accesses data on someone's device, the consent rule applies.
Two exemptions let you skip consent
Under the ePrivacy Directive, only two narrow categories are exempt from the consent requirement. The first covers storage whose sole purpose is carrying out the transmission of a communication over a network, such as load-balancing cookies that route traffic between servers. The second covers storage strictly necessary to provide a service the user explicitly asked for, such as a shopping cart cookie or an authentication token for a signed-in session.
Everything else needs informed, prior consent in the EU. That includes analytics cookies, marketing cookies, social media embeds and A/B testing scripts. Preference cookies are a grey area: the CNIL, France's data protection authority, treats cookies that remember a choice the visitor made, such as their language, as exempt from consent.
Your cookie banner checklist
Work through each question below. If you answer "yes" to any of the first seven, your site needs a cookie banner or an opt-out mechanism for at least some visitors.
| Question | If yes |
|---|---|
| Does your site use Google Analytics, Matomo with cookies or any other analytics tool that sets cookies? | Banner required for EU visitors (for the UK, see the 2026 exception below) |
| Do you run Google Ads, the Meta Pixel, the TikTok Pixel, the Pinterest Tag or any other advertising tracker? | Banner required for EU and UK visitors, opt-out duties in many US states |
| Do you embed YouTube videos, social sharing buttons or third-party chat widgets? | These typically set third-party cookies, so a banner is required |
| Do you use a CRM that sets tracking cookies (HubSpot, Salesforce, ActiveCampaign)? | Banner required |
| Do you use session replay tools such as Hotjar or Microsoft Clarity? | Banner required |
| Do you sell personal data to, or target advertising at, California residents? | Opt-out mechanism required under the CCPA |
| Does your website serve visitors in Brazil, Canada or South Africa? | Check the LGPD, PIPEDA or POPIA rules for those visitors |
| Does your site use only strictly necessary cookies (session sign-in, shopping cart, CSRF tokens)? | No banner required, but a cookie policy explaining these cookies is still good practice |
Plausible Analytics is missing from the first row on purpose: it sets no cookies.
A quick way to check your site: open your browser's developer tools, clear all cookies, then load your site without touching the banner. If cookies appear from domains other than your own, or analytics cookies such as _ga, _fbp or _hjSessionUser are already set, those trackers are firing before consent.
Three questions that decide what your site needs
Which laws apply and what they require
Cookie consent rules vary by jurisdiction, and regulators in Europe enforce them actively.
EU and EEA (GDPR and ePrivacy Directive)
The GDPR and the ePrivacy Directive together form the strictest cookie regime. Non-essential cookies must be blocked until the visitor gives informed, freely given, unambiguous consent through a clear affirmative action. Pre-ticked boxes, scrolling and vague "OK" buttons do not count. The banner must offer granular category choices and a "Reject all" option as easy to use as "Accept all".
The CNIL enforces this hard. On 1 September 2025 it fined Google €325 million for ads inserted between Gmail emails without consent and for advertising cookies at Google account creation, where consent was neither free nor informed. The same day it fined Shein €150 million for advertising cookies set as soon as a visitor arrived, before any choice.
United Kingdom (UK GDPR and PECR)
The UK GDPR and PECR follow the EU approach, with one important change. Since 5 February 2026, the Data (Use and Access) Act has added Schedule A1 to PECR, which lets a site use storage without consent when its sole purpose is collecting statistics to improve the site, or adapting the site's appearance or functions to the visitor's preferences. Both exceptions apply only if visitors get clear information and a simple, free way to object. The Data Use and Access Act also raised the maximum PECR fines.
The ICO keeps checking. It wrote to the operators of 134 of the top 200 UK websites in January 2025, and reported in December 2025 that 979 of the top 1,000 sites were compliant, with 17 preliminary enforcement notices issued.
United States (CCPA and other state laws)
No US federal law requires a GDPR-style opt-in cookie banner. The CCPA, as amended by the CPRA, works on an opt-out model: if cookies are used for targeted advertising or data "sales", you must provide a clear "Do Not Sell or Share My Personal Information" link. As of October 2026, 19 US state privacy laws are in force and four more have been enacted, most with similar opt-out rules. Twelve of the laws in force, including California, Colorado, Connecticut and Texas, expect you to honour Global Privacy Control (GPC) signals sent by the browser.
No US state law technically mandates a pop-up banner, but a consent tool has become the usual way to manage opt-out obligations across several states.
Brazil (LGPD)
The LGPD requires a lawful basis before processing personal data, including data collected through cookies. Consent is one of ten legal bases, and it must be free, informed and unambiguous. A cookie banner that explains purposes and collects opt-in consent is the most straightforward route for non-essential cookies.
Canada (PIPEDA)
PIPEDA requires meaningful consent for the collection, use and disclosure of personal information. For tracking cookies that collect browsing data, this generally means opt-in consent or, at minimum, clear notice with a genuine opt-out before cookies are set.
What an EU banner needs on its first layer
Regulators across the EU have converged on a clear set of requirements for cookie banners. A banner missing any of these elements is the kind regulators write to.
The first layer, what visitors see immediately, should include a brief explanation of what cookies are used and why, an "Accept all" button, a "Reject all" button with equal visual prominence and a "Manage preferences" option. The Dutch Data Protection Authority warned 50 organisations in April 2025 about missing "Reject all" buttons, pre-checked boxes and designs that made rejection harder than acceptance.
Behind the first layer, visitors must be able to turn individual cookie categories on or off. The banner should not block the website if the visitor refuses: the EDPB considers consent behind a cookie wall not freely given, though a few national authorities accept walls with a real alternative. Consent records must be logged with a timestamp and kept as evidence. Closing the banner without choosing must not count as consent.
Common mistakes that trigger enforcement
The CNIL's Shein decision found advertising cookies set the moment a visitor landed on the site, before any choice. The site had a "Reject all" button, but refusing did not stop the cookies. Other frequent problems include unequal button design, scripts firing before the consent tool loads and marketing cookies labelled as "functional" to avoid consent.
If your site only uses strictly necessary cookies
If your website genuinely sets no analytics, marketing or other non-essential cookies, you do not need a consent banner. A static HTML site with no third-party scripts and no analytics falls into this category.
Most real websites do not fit that description. Even a basic WordPress installation with a contact form plugin and Google Analytics triggers the consent requirement. A cookie scan shows what your site actually sets, and the results often surprise owners who assumed their site was "cookie-free".
Google Consent Mode and advertising requirements
If your site uses Google advertising or analytics products and has visitors from the EEA or the UK, Google Consent Mode v2 is a practical necessity. Consent Mode passes your visitors' choices to Google's tags, which then decide whether to collect or model data. Without it, Google Ads loses measurement and audience features for those visitors.
Consent Mode does not replace a cookie banner. It sits behind one, translating the visitor's choices into signals that Google's tags understand.
Quick answers on cookie banners
Can I use a "This site uses cookies" notice instead of a full banner?
Not if you set non-essential cookies and have EU visitors. A notice with no way to refuse does not meet the GDPR's consent standard, which requires a genuine choice including "Reject all". In the UK, a notice with a simple way to object can cover statistics and appearance cookies since 5 February 2026, but not advertising cookies.
Do I need a cookie banner if my website only targets US visitors?
You may not need an opt-in banner, but if your site uses cookies for targeted advertising or data sharing, state laws such as the CCPA require an opt-out mechanism, usually a "Do Not Sell or Share My Personal Information" link and support for Global Privacy Control signals.
Are analytics cookies like Google Analytics exempt from consent?
In the EU, mostly not: analytics cookies such as _ga need prior consent, with narrow national exemptions for privacy-friendly first-party measurement, for example in France. In the UK since 5 February 2026, analytics used only to improve your site may run without consent if visitors are told and can object for free.
How often should I scan my website for new cookies?
At least monthly, and whenever you add a plugin, script or third-party integration. Cookies can appear without your knowledge when third-party tags load further scripts, and a scheduled scan catches them.
What happens if I ignore cookie consent rules?
Fines can be large. On 1 September 2025 the CNIL fined Google €325 million and Shein €150 million in two cases involving advertising cookies. The ICO writes to sites directly and can issue enforcement notices.
Does my cookie banner need to be accessible to people with disabilities?
If your site falls under the European Accessibility Act, which has applied since 28 June 2025 (Directive (EU) 2019/882) to services such as e-commerce and banking, the banner is part of the service and should meet EN 301 549, which builds on WCAG 2.1 Level AA. Microenterprises providing services are exempt. An inaccessible banner also risks consent that is not informed for some visitors.
Find out what your site sets before you decide
If any item on the checklist applies to your website, start with a scan to see exactly which cookies are active on a first visit. Kukie.io's cookie scanner lists them by category, and its region rules show an opt-in banner where the law asks for one and an opt-out model where it does not.
