Your site may not need a banner at all.

The rule behind every banner

Cookie banners exist because of Article 5(3) of the ePrivacy Directive (2002/58/EC). Storing information on a visitor’s device, or reading information already stored there, is only allowed once the visitor has consented after clear information about the purposes.

There are two exceptions. No consent is needed when the storage or access only serves to carry a communication over the network, or when it is strictly necessary to provide a service the visitor explicitly asked for. Sites without a banner rely on that second exception.

The rule applies whether or not the information is personal data. The EU’s Court of Justice said so in Planet49 (C-673/17, 2019). When personal data is involved, the GDPR applies on top.

Each EU country wrote the directive into its own law, so the details differ from country to country. More on that below.

It covers more than cookies

Article 5(3) doesn’t mention cookies. It talks about information on the device, so it covers any technique that stores or reads it. The European Data Protection Board (EDPB) worked through several of these in its Guidelines 2/2023, adopted in final form in October 2024. The Dutch Data Protection Authority (AP) says its banner rules apply to the same techniques.

Covered, according to the EDPB or the AP:

• Tracking pixels in pages and emails, which make the browser send an identifier back
• Tracking links, including affiliate links that add an identifier to the URL
• Data that isn’t essential, placed in browser storage such as localStorage
• Scripts that tell the browser to send information to a server, including information worked out in the browser itself
• Fingerprinting: recognising a device from its settings and features

What usually needs no consent

The strictly necessary exception covers what makes the service work for the visitor who asked for it. The test is the purpose. The CNIL, France’s regulator, gives the example of a login cookie: it needs no consent, while using the same cookie for advertising does.

The EDPB’s Cookie Banner Taskforce warned about sites that label cookies “essential” or “strictly necessary” when they serve other purposes. A label in your cookie list doesn’t change what a cookie does.

The CNIL lists these among the cookies and trackers that can go without consent:

• A cookie that remembers the visitor’s choice about cookies
• A login cookie, including one that protects the login against bots
• A shopping cart cookie, or one used to bill what was bought
• A language or layout setting, when it is an expected part of the service
• A cookie that spreads traffic across servers (load balancing)

What usually needs consent

Advertising, profiling and following people across sites don’t count as strictly necessary for the visitor. The Dutch AP says tracking cookies always need consent, and that legitimate interest can’t take its place.

Most banners exist because of a handful of tools like these:

• Advertising and retargeting pixels, such as the Meta pixel or Google Ads tags
• Analytics with cookies or identifiers, unless your country’s exception covers your exact setup (see the next section)
• Embedded YouTube videos and Google Maps, which load code from Google as the page opens and can store data before anyone clicks
• Chat widgets, A/B testing tools and session recordings that store their own identifiers

National rules differ

The directive sets the shared rule, and each country’s law adds its own details. The biggest differences are about analytics.

Cookieless analytics aren’t automatically outside the rule. In the EDPB’s reading, a script that makes the browser send data counts as access too. Whether it then needs consent depends on the national exception, so check each country your sites serve.

Three examples:

• Netherlands: Article 11.7a of the Telecommunicatiewet adds an exception for collecting information about the quality or effectiveness of a service, as long as it has no or little impact on the visitor’s privacy. The AP names Matomo and Plausible Analytics, set up well, as alternatives to more invasive analytics.
• Germany: §25 of the TDDDG follows the directive closely, with the same two exceptions and no separate one for analytics.
• France: the CNIL treats audience measurement as strictly necessary under strict conditions. It may only measure the site’s own audience for the publisher and produce anonymous statistics. It may not track people across sites, and the data may not be combined with other processing or passed to third parties. The CNIL recommends a cookie lifetime such as 13 months, not extended on each visit, and keeping the data for 25 months at most.

A checklist for each site

If one tool is the only reason a site needs a banner, replacing it is often less work than running one. When we checked our own 39 sites, 4 clearly needed a banner, all for Google Analytics, and a fifth stopped needing one once its videos waited for a click. Our 27 price-comparison sites are a harder case because of their affiliate links.

Run this check for every site you own, and again after you add a plugin, an embed or a tag:

• Open the site in a private window. Before clicking anything, look at cookies, local and session storage and requests to other domains in the browser’s developer tools.
• Write down what each item does and who sets it.
• Mark what is strictly necessary for something the visitor asked for: login, cart, security and the cookie choice itself.
• For analytics, check the exception in each country your site serves.
• For everything else, remove it, replace it, or block it until the visitor agrees.
• Describe what remains on a cookie or privacy page, even when nothing needs consent.