Compliance guide

Do I Need a Cookie Consent Banner?

Short answer: if your site is accessible to EU or UK visitors and uses any non-essential cookie — Google Analytics, advertising pixels, Hotjar, social widgets — you need prior consent before those cookies fire. Here's the exact rule, what counts as essential, and what valid consent actually requires.

• Which laws apply
• Essential vs. non-essential
• What valid consent requires
• Patterns that fail
• US-only sites
• What the banner must contain
• Generate a compliant banner free
• FAQ

Which laws govern cookie consent

Cookie consent is primarily governed by two overlapping frameworks in the EU and UK — the ePrivacy Directive (the "Cookie Law") and GDPR. In the US, there is no federal cookie consent law, but California's CPRA creates related opt-out obligations when advertising cookies are in play.

The practical upshot: if your site is publicly accessible — which means EU and UK visitors can reach it — both the ePrivacy rules and GDPR apply to how you set cookies on those visitors' devices. Non-EU companies are not exempt; the rules apply based on where the user's device is located, not where your server or company is.

Essential cookies vs. non-essential cookies

The single most important distinction is between cookies that are strictly necessary for a service the user has explicitly requested (no consent needed) and cookies that serve any other purpose (consent required). Here is how to tell them apart:

The "strictly necessary" test is stricter than most people assume. A cookie is not essential just because your site uses it heavily — it is essential only if removing it would prevent the user from receiving the service they came to use. Analytics, by definition, serves the site owner's purpose (measuring traffic), not the user's purpose (using the tool). It is never essential.

What valid consent requires under GDPR

Under GDPR Article 4(11), consent must be freely given, specific, informed, and an unambiguous indication of the data subject's wishes. The European Data Protection Board (EDPB) has clarified each of these requirements in enforceable guidelines. Here is what each means in practice:

• Freely given — The user must have a real choice. Consent is not free if refusing means being denied access to your site (a "cookie wall"), if there is a power imbalance (employer requiring consent from employees), or if refusing cookies has any negative consequence. A clearly labeled "Reject all" option that still lets the user use the site is required.
• Specific — Consent must be given per purpose, not bundled. If your site uses both analytics cookies (to measure traffic) and advertising cookies (to serve targeted ads), a single "Accept all" button — with no way to consent to analytics but not advertising — does not satisfy specificity for advertising. Users must be able to make separate choices per category.
• Informed — Before consenting, the user must be told: what categories of cookies are being set, who the data controllers and processors are (e.g., "Google Analytics — Google LLC"), what the cookies do and why, and how long they persist. A generic "we use cookies to improve your experience" does not meet this standard.
• Unambiguous — positive opt-in — Consent must come from a clear affirmative action: clicking an "Accept" button, toggling a switch to "on." Pre-ticked checkboxes, inactivity, and scrolling are explicitly ruled out. The action must be clearly distinguishable from other site interactions.
• Withdrawable — Users must be able to withdraw consent at any time, and it must be as easy to withdraw as to give. A "Change cookie preferences" link in the footer, accessible on every page after the initial banner is dismissed, is the standard implementation. Consent that cannot practically be withdrawn is not valid consent.

Before consent is given, non-essential cookies must not fire. This means your analytics, advertising, and session recording scripts must be blocked until the user actively accepts — not loaded on page start and then retroactively disclaimed.

Common patterns that fail — and why

These are the implementations regulators have specifically ruled against. Each one is still widely deployed, which is why enforcement actions keep citing them:

• "This site uses cookies" notice with only a Close or Got It button Dismissing a banner is not an affirmative action and does not constitute consent. Loading non-essential cookies on page load before any interaction occurs — while displaying this banner — violates ePrivacy regardless of what the banner says. Regulators from the ICO, CNIL, and German DPAs have fined this pattern.
• Pre-ticked analytics or advertising checkboxes GDPR Article 7(2) states that if consent is given in a written declaration covering other matters, the request for consent must be clearly distinguishable; recital 32 explicitly rules out pre-ticked boxes. A checkbox that is checked by default, requiring the user to actively uncheck it, does not constitute freely given consent.
• Implied consent through scrolling or continued use The EDPB Guidelines 05/2020 on Consent explicitly state: "Scrolling or swiping through a webpage or similar user activity will not under any circumstances satisfy the requirement of a clear and affirmative action." A banner that says "By continuing to browse, you consent to cookies" and then sets analytics cookies does not satisfy GDPR.
• Cookie wall — access denied unless cookies are accepted GDPR requires consent to be freely given. Access to a site conditioned entirely on accepting advertising or analytics cookies is not freely given consent, according to EDPB Guidelines 05/2020. The European Court of Justice affirmed this principle in the Planet49 ruling. A paid, cookie-free alternative may create a compliant alternative, but a simple accept-or-leave wall does not.
• Accept button visually prominent, Reject buried or absent Dark patterns — making the Accept button large and green while making Reject a small grey link, or requiring extra clicks to reject — have been the subject of substantial fines (the French CNIL fined Google €150M and Facebook €60M in 2022 specifically for this pattern). The two options must be equally prominent and require the same number of clicks.

US-only sites: what actually applies

If your site serves only US visitors and has no EU or UK traffic, the ePrivacy Directive and GDPR do not apply. There is no US federal cookie consent requirement. However, two California-specific obligations are worth understanding:

CCPA/CPRA "sharing" opt-out: California's CPRA (effective 2023) created a right for California residents to opt out of the "sharing" of personal data for cross-context behavioral advertising. Using a Facebook Pixel, Google Ads remarketing tag, or similar advertising cookie that passes identifiers to an ad network likely qualifies as "sharing" even if you never receive payment for the data directly. If you use advertising cookies, you need a "Do Not Sell or Share My Personal Information" link in your footer that provides an opt-out mechanism — not a prior consent banner, but an ongoing opt-out right.

Analytics cookies without advertising: If your US-only site uses only analytics cookies (no advertising pixels) from a provider that does not sell the data, there is currently no US legal requirement for a consent banner or an opt-out link. A simple cookie disclosure in your privacy policy (what cookies you set, why, and how long they last) is sufficient.

The practical problem: Most public websites are accessible to EU and UK visitors, even if you never intended to serve them. A developer in Chicago with a tool indexed by Google can receive EU traffic within hours of launch. If you are not IP-blocking EU/UK access, the conservative and common approach is to implement a consent banner for all visitors.

What a compliant cookie banner must contain

A banner that satisfies GDPR and ePrivacy requirements needs the following elements — in the banner itself, not buried in a linked policy:

• A plain-language explanation of why you use cookies and what they do — not legal boilerplate, something a non-technical user can understand in 20 seconds
• Cookie categories with per-category consent toggles — at minimum: Essential (always on, not toggleable), Analytics, Advertising/Marketing. Users must be able to consent to analytics without consenting to advertising.
• Accept All and Reject All buttons at equal visual weight — the same click distance from the user, no color or size differential that pushes toward acceptance
• A link to your full cookie policy — the banner is a summary; the policy is where cookie names, durations, and third-party processor details live
• Evidence of consent stored server-side or in localStorage — you need to be able to demonstrate, if asked by a regulator, that a specific user consented on a specific date to specific categories; a preference cookie alone is often insufficient
• A "Change preferences" link on every page after the banner is dismissed — so users can modify or withdraw consent at any time without clearing their browser

One thing the banner does not need to contain: a list of every individual cookie name and duration. That level of detail belongs in the full cookie policy linked from the banner, not in the banner itself. The banner needs the category and purpose — the policy provides the inventory.

Generate a working cookie consent banner free with ComplyKit

ComplyKit generates a cookie consent banner from a short questionnaire — including the JavaScript that blocks non-essential scripts until the user consents, per-category toggles, a "Change preferences" footer link, and consent preference storage. It runs entirely in your browser; no data is sent anywhere.

The generated banner handles the three requirements that most template banners skip: (1) non-essential scripts are not loaded until consent is given, not just after; (2) Accept All and Reject All are at equal visual weight; (3) a preferences link is included for every page so users can withdraw consent without clearing cookies manually.

Generate my cookie consent banner free →

Frequently asked questions

Also in the Copper Bay Labs ship-safety suite

Cookie consent is one piece of a pre-launch compliance checklist. These free tools cover the other gaps — security headers, exposed secrets, accessibility, and privacy policies: