Cookie Consent Banners: What Businesses Need to Know
Which cookies need consent, regional rules in the UK, EU, US, Canada and Australia, compliant banners, Consent Mode and common mistakes.
On this page
A cookie consent banner asks website visitors for permission before setting cookies or similar technologies that are not strictly necessary, such as analytics and advertising trackers. Whether you need one, and how it must work, depends on where your visitors are. For businesses with UK or EU visitors, consent is generally required before non-essential tracking. In the US, requirements vary by state and focus more on notice and opt-out rights. Getting consent right also affects your analytics and advertising data.
This article provides general information, not legal advice. Check requirements with a qualified adviser for your business.
What cookies need consent
Strictly necessary cookies, such as those for shopping carts, logins and security, usually do not require consent.
Analytics cookies, such as Google Analytics, generally require consent under UK and EU rules.
Advertising and tracking cookies, such as the Meta Pixel and Google Ads tags, generally require consent under UK and EU rules.
Functional cookies for preferences and embedded content may require consent depending on their purpose.
Regional overview
UK and EU: the ePrivacy rules (PECR in the UK) and GDPR require prior, informed, freely given consent for non-essential cookies. Pre-ticked boxes and “by continuing to browse you accept” approaches are not valid consent. Rejecting should be as easy as accepting.
United States: there is no single federal cookie consent law. State privacy laws, such as California’s CCPA as amended by CPRA, give consumers rights to know about and opt out of the sale or sharing of personal information, including for cross-context behavioural advertising. Several other states have similar laws. Some require honouring Global Privacy Control signals.
Canada: PIPEDA and provincial laws, such as Quebec’s Law 25, require meaningful consent, with Quebec having stricter requirements.
Australia: the Privacy Act applies to many businesses, with reforms under way that may strengthen requirements.
What a compliant banner usually includes
- Clear explanation of what cookies are used for.
- Accept and reject options with equal prominence, where consent is required.
- Options to choose categories, such as analytics or marketing.
- A link to a cookie or privacy policy.
- Blocking of non-essential cookies until consent is given.
- Easy ways to change preferences later.
- Records of consent.
Consent and your marketing data
When visitors decline cookies, analytics and ad platforms receive less data. Google’s Consent Mode allows Google tags to adjust behaviour based on consent and use modelling to estimate some conversions. Google requires Consent Mode for advertisers using its ad services with users in the European Economic Area. Meta and other platforms have their own consent requirements.
A properly implemented consent setup protects data quality as well as compliance. See our guides to GA4 conversion tracking and the Meta Pixel.
Consent management platforms
Consent management platforms (CMPs), such as Cookiebot, CookieYes, OneTrust, Complianz and others, scan your site for cookies, display banners, block scripts until consent and record choices. Many integrate with Google Consent Mode and Tag Manager. Choose a CMP certified by Google if you advertise in the EEA. See our guide to Google Tag Manager for how tags connect to consent.
Common mistakes
- Banners that inform but do not actually block cookies.
- No reject option, or reject hidden behind extra clicks.
- Tracking scripts hard-coded outside the consent system.
- Outdated cookie lists after adding new tools.
- Banners that cover content or break mobile layouts.
Design considerations
A consent banner should be clear and unobtrusive. Avoid designs that obscure the page on mobile. Use plain language. Keep branding consistent so the banner does not look like a third-party pop-up.
Compliance that protects your data too
Cookie consent is a legal requirement in many markets and a practical factor in how accurately you can measure marketing. Setting it up properly once, and reviewing it when you add tools, avoids both risk and data problems.
If you are unsure whether your site handles consent correctly, our website design and development service can implement a consent platform and connect it properly to your analytics and ad tracking.