Do you need a cookie banner? Check your tools, not your cookies

The rule in one sentence

Article 5(3) of the EU ePrivacy Directive says you need consent before you store information on a visitor’s device, or read it from there, unless it’s strictly necessary to provide the service they asked for. The UK has the same rule in regulation 6 of PECR.

It isn’t only about cookies. The European Data Protection Board’s Guidelines 2/2023 confirm that local storage, tracking pixels and similar techniques count too. So “we don’t use cookies” doesn’t settle the question; what your tools do in the browser does.

12 common tools, one by one

• Google Analytics 4: Needs consent. Google’s own documentation lists the _ga cookie, kept for two years by default to tell visitors apart. Consent Mode changes what Google receives, not whether you need to ask. Check what your tags report with our Consent Mode v2 checker. The difference between basic and advanced mode is explained in our next post.
• Google Tag Manager: Doesn’t set cookies on its own, but everything it loads counts. If it fires analytics or ad tags before a choice, that’s tracking before consent.
• Meta Pixel: Needs consent. Meta describes it as code that tracks visitor activity to measure ads, and it collects the Facebook cookie.
• TikTok, LinkedIn, X and Pinterest pixels: Need consent, for the same reason as the Meta Pixel.
• Hotjar, Microsoft Clarity and other session recorders: Need consent. They record how people move and click, and store identifiers in the browser.
• YouTube and Vimeo embeds: Need consent for the player’s cookies and storage. YouTube’s privacy-enhanced mode (youtube-nocookie.com) means, in Google’s words, that views aren’t used to personalise YouTube, which isn’t the same as storing nothing. Show a placeholder and load the player on click.
• Google Maps embeds: Load Google content and can set Google cookies. Use a static map image or load the map on click.
• Google Fonts from Google’s servers: No cookie, but every page view makes the visitor’s browser contact Google. The Munich Regional Court ruled on 20 January 2022 (3 O 17493/20) that a site embedding Google-hosted fonts broke the GDPR. Host the font files yourself and the question goes away.
• Live chat widgets: Usually need consent if they set cookies before anyone opens the chat. Load the widget when the visitor clicks “Chat”.
• Stripe, Paddle and other payment pages: Cookies used for fraud checks on the checkout a visitor started are generally treated as strictly necessary. Keep payment scripts on payment pages, not on every page.
• Login, cart and security cookies: No consent needed. They’re strictly necessary for what the visitor asked for. The cookie that remembers a visitor’s consent choice is exempt too.
• Cookie-free analytics: Tools that store nothing on the device don’t trigger the consent rule. Cloudflare, for example, says its Web Analytics uses no cookies or local storage. Check your own tool’s documentation.

If you need a banner, it has to work

A banner that only says “we use cookies” isn’t consent. Regulators check what happens around it, and most fines in our fines tracker hit sites that had one. A working banner:

• Loads nothing optional until the visitor chooses. See tracking before consent.
• Offers “Reject all” on the first layer, as easy to see as “Accept all”. See no reject option and unequal choice.
• Really stops trackers after “Reject”. See tracking after reject.
• Remembers the answer instead of asking on every page. See reject not remembered.
• Lets people change their mind later, as easily as they agreed. See no easy withdrawal.

How to check your own site

Open your site in a private window, open your browser’s developer tools and look at the Network tab and the cookies before you click anything. Our 10-minute guide walks through every step.

Or run a free scan: untick loads your page as a first-time visitor, clicks “Reject” and shows every tracker, cookie and signal it sees, with screenshots and fixes.

To test only the reject button, use the free reject-all test. Shops can run the store test, which adds dark patterns, the EU withdrawal button and accessibility.