Do I need a cookie banner? A plain answer

You need a cookie banner if two things are true at once: your website stores or reads something on the visitor's device that is not strictly necessary to deliver what they asked for (an analytics cookie, an advertising pixel, an embedded video player), and some of your visitors are in a place where the law requires consent for that, which includes every EU and EEA country and the UK, while other countries have rules of their own. If your site only sets cookies it cannot work without, you do not need a banner, but you still need to tell people about those cookies in a policy.

Where the rule comes from

The rule is older than the GDPR. Article 5(3) of the ePrivacy Directive (2002/58/EC, as amended in 2009) says that storing information, or gaining access to information already stored, in a user's terminal equipment is only allowed if the user has given consent, after receiving clear and comprehensive information. The only exceptions are storage needed to transmit a communication and storage that is strictly necessary to provide a service the user explicitly requested. Each EU country transposed this into its own law, which is why the CNIL enforces it in France under article 82 of the French Data Protection Act, and the ICO in the UK under regulation 6 of PECR.

Consent itself is defined by the GDPR, article 4(11): freely given, specific, informed and unambiguous, given by a statement or a clear affirmative action. The Court of Justice of the EU confirmed in Planet49 (case C-673/17, 1 October 2019) that a pre-ticked checkbox is not consent, that this applies whether or not the stored information is personal data, and that the information given to the user must include how long the cookies operate and whether third parties can access them.

The EDPB's guidelines on consent (05/2020, adopted 4 May 2020) close two doors that older banners used: scrolling or swiping through a page "will not under any circumstances satisfy the requirement of a clear and affirmative action", and making access to a site conditional on accepting cookies (a cookie wall) does not produce freely given consent.

When you do not need a banner

You do not need a banner when everything your site stores on the device is strictly necessary. Typical examples:

• a session cookie that keeps a visitor logged in or keeps a shopping cart together;
• the cookie that remembers the visitor's cookie choice itself;
• security cookies used to prevent fraud or to balance load;
• a preference the visitor explicitly set, such as the language they picked.

Two narrower exemptions exist for analytics. In France, the CNIL exempts audience measurement from consent when the tool only produces anonymous statistics for the publisher, with no cross-site tracking and no sharing with third parties, under conditions explained in our article on analytics without consent. In the UK, the ICO's guidance on storage and access technologies describes a "statistical purposes" exception and an "appearance" exception: the sole purpose must be statistics or adapting the appearance of the service, you must give clear information and a simple, free way to object, and any third party involved must be a processor, not a joint controller.

Advertising never qualifies. The ICO's wording is blunt: there are "no advertising purposes that meet the strictly necessary exception".

A quick test for common tools

If you are not sure what your site loads, open the browser's developer tools on a fresh private window, look at the Application tab for cookies and the Network tab for third-party requests, or run the free cookie scanner, which lists scripts, iframes and cookies on up to five pages without an account.

What about visitors outside Europe?

The consent model is European. California's CCPA and CPRA use an opt-out model instead: you may set trackers, but you must offer a "Do Not Sell or Share My Personal Information" link and honor the Global Privacy Control signal. Brazil's LGPD, South Africa's POPIA and Quebec's Law 25 each have their own rules. A site with a worldwide audience usually shows the consent banner only where it is required and an opt-out notice in US states that have a privacy law, which is what geo-targeting is for.

What a banner must do to count

A banner that only informs is not enough. For consent to be valid, the banner must:

1. block every non-necessary script and embed until the visitor chooses (a banner over a page that already fired the pixels is the most common reason for fines);
2. offer a way to refuse that is as easy as the way to accept, which in practice means a Reject all button on the first screen next to Accept all;
3. have no pre-ticked optional category;
4. explain the purposes, name the third parties, and say how long cookies last;
5. let the visitor withdraw later, as easily as they consented;
6. record each choice so you can prove it.

The details of each point are in the Reject all guide and the script blocking guide.

Deciding in practice

Most sites that use any analytics or embed need the banner. The decision that takes judgment is the sorting of each tool into "strictly necessary" or not. Be strict: the EDPB taskforce on cookie banners noted in January 2023 that many sites label cookies as "essential" that serve purposes nobody would call essential, and that website owners are responsible for maintaining the list of their cookies and for demonstrating why each one is essential.

If you decide a banner is needed, the setup is short: one script tag loaded before everything else, trackers marked so they wait for consent, and a cookie policy that matches what the site actually does. Cookiequiet does this with a free plan for one website, a Reject all button by default and a scanner that fills in the cookie table; the pricing page has the details.