The short answer
A cookie banner is a message on a website that tells visitors the site uses cookies or similar technologies and, in many places, asks them to make a choice. Its purpose is to give people information and control before certain kinds of tracking begin. Whether you need one, and what it must do, depends on the country, the audience and the type of cookies. This article is general information, not legal advice. Check the rules that apply to you, because they vary and change.
What cookies are, briefly
Cookies are small files that a website asks a browser to store. They can hold a setting, a session identifier or a unique ID. Similar technologies such as local storage, scripts and pixels do comparable work, and rules often cover them together.
It helps to split cookies into broad groups:
- Strictly necessary. Needed to deliver what the visitor asked for, such as keeping items in a basket or maintaining a secure login. Rules in many places allow these without asking for consent.
- Preferences. Remember choices such as language or layout.
- Analytics. Count visits and show how people use the site.
- Advertising and marketing. Measure ad performance or build audiences, sometimes via third-party cookies.
How each group is treated differs by jurisdiction. Some places require prior consent for anything not strictly necessary, others rely on notice and an opt-out, and some have few specific rules. The categories also blur in practice, so do not rely on labels alone.
Why banners exist
Many websites run several outside services, so a visitor’s browser may be contacting companies they have never heard of. Privacy rules in various places try to make that visible and give people a say. A banner is the usual way to deliver this:
- Information. It tells visitors that tracking exists and points to details.
- Choice. It lets them accept, decline or customise.
- Evidence. It gives the site owner a record that a choice was offered and made.
The underlying idea is the same as for any marketing consent: people should not be surprised by how their information is used.
What a well-made banner does
Good practice is generally described in similar terms by privacy regulators, though specifics differ locally.
It is clear. The wording explains what is happening in everyday language, not jargon. “We use cookies to measure visits and show relevant ads. You can choose which to allow.” is better than a vague “We value your privacy” with a single button.
It offers real choice. Accepting and declining should be equally easy to find and use. If “Accept” is a bright button and “Decline” is a faint link buried in a menu, many regulators regard that as a poor design. Pre-ticked boxes for optional categories are likewise frowned upon in many places.
It works as described. If a visitor declines, non-essential tags should not run. A banner that records a choice while the tags fire anyway is worse than none, because it misleads.
It lets people change their mind. A visible link or icon that reopens the settings makes withdrawing consent about as easy as giving it.
It does not trap visitors. Blocking the whole site until someone accepts is discouraged in many regions, though views on this vary.
It is accessible. Keyboard users and screen reader users should be able to operate it, the text should have enough colour contrast, and buttons should have clear labels. An accessibility check is part of building one properly.
It links to more detail. A cookie policy or a section of your privacy notice should list what is used, why, and for how long, and name the main providers.
Common mistakes
- Using a banner that only says “OK” while many tracking tags load regardless.
- Using confusing language, such as “legitimate interest” without explanation.
- Making rejection take several clicks while acceptance takes one.
- Forgetting to update the banner when new tags are added.
- Treating the banner as a complete solution while the privacy notice is outdated.
- Copying another site’s wording without checking that it matches your own cookies.
Practical steps
- Audit what runs. List the cookies and tags on your site and what each is for. A scanner or browser developer tools can help, but check the results against what you know.
- Decide what is necessary. Be conservative; analytics and advertising are normally not strictly necessary.
- Pick a tool or build one carefully. Many consent management tools exist. Check what each one does in its current documentation, and test that it genuinely blocks tags before consent where that is required.
- Write plain text. Short sentences, accurate categories and no pressure.
- Test regularly. Visit your site in a clean browser session, make different choices and verify what loads.
- Keep records. Many tools log consent choices; consider how long you keep these.
- Review after changes. New plug-ins, ad platforms or embedded videos can add cookies without anyone noticing.
Banners and your data
Analytics numbers will usually be lower when some visitors decline cookies, so treat reports as estimates. This affects marketing analytics and how you read conversion data, but it is not a reason to hide choices or nudge people unfairly.
Banners also sit within a wider picture, including the move away from third-party cookies and the pixels your marketing tools install. A banner is one tool for transparency, not a substitute for collecting less, explaining honestly and respecting what people say.
If your site serves several countries, or you handle sensitive subjects, consider getting advice from a qualified professional on what your banner must do.