Skip to main content
Get a site assessment

Do I need a cookie banner?

Last reviewed
2026-10-16

You need consent before storing or reading information on visitors' devices for a purpose outside the legal exceptions, if you have visitors in the EU or UK. Advertising tags need prior consent in both. The UK lets analytics run without consent if visitors are told and can object for free. In US states with privacy laws, targeted advertising generally needs an opt-out.

The longer version

A banner is one part of the implementation. The important questions are what the site stores or accesses, which vendors receive information and what happens before and after the visitor makes a choice.

EU, UK and US requirements differ. The EU allows two exceptions: transmitting a communication, and storage strictly necessary for a service the visitor asked for. Since February 5, 2026, the UK also exempts analytics used only to improve the site, preference settings for appearance and functions, and locating a user who asks for emergency help, each with conditions. Test whether the site follows the chosen configuration.

Next steps

  1. Inventory cookies, tracking tools and relevant external services.
  2. Remove tools the business no longer uses.
  3. Review the applicable consent, exception and opt-out requirements.
  4. Test choices, refusal and withdrawal against actual network and storage behavior.

Related guides

Sources

  1. Directive 2002/58/EC (ePrivacy Directive) (opens in a new tab)EUR-Lex, Publications Office of the European Union
  2. The Privacy and Electronic Communications (EC Directive) Regulations 2003, Schedule A1 (opens in a new tab)legislation.gov.uk, The National Archives
  3. Guidelines 05/2020 on consent under Regulation 2016/679 (opens in a new tab)European Data Protection Board

This page provides general information. Your obligations depend on your business and jurisdiction. Consult a qualified adviser about your circumstances.