Do I need a cookie banner on my website?
You need a consent banner if your site stores or reads anything on a visitor's device that isn't strictly necessary for what they asked for, and in the UK isn't covered by one of the narrow newer exemptions. If your pages set no such cookies and load no third-party trackers, you don't need one. Find out by checking what your pages actually do. This is practical guidance, not legal advice.
The rule in one paragraph
In the EU and the UK, the rule comes from the ePrivacy Directive and, in the UK, the Privacy and Electronic Communications Regulations (PECR). It covers storing information on a visitor's device or reading it back, whatever the technology: cookies, local storage, tracking pixels, fingerprinting. Consent is needed unless the storage is strictly necessary for a service the visitor requested. The ICO's cookie guidance gives examples such as a shopping basket or a security cookie. The EDPB's guidelines on the technical scope of Article 5(3) explain how widely "storing or accessing" reaches.
The UK has since added exceptions. The Data (Use and Access) Act 2025, in Schedule 12, allows some storage without consent for collecting statistics to improve a site, for adapting how a site looks or works for the visitor, and a few other purposes, each with conditions. The statistics exception needs clear information and a simple, free way to object, and the data can't be shared except to make those improvements. The EU has no equivalent exemption for analytics, so EU visitors still need consent for analytics cookies.
Work it out from your own pages
- Open your site in a private window and your browser's developer tools. Under Application (Chrome, Edge) or Storage (Firefox), look at Cookies, Local storage and Session storage for your domain.
- Clear everything and reload each kind of page: home, a product, the contact page, checkout. Note what appears.
- Check third parties. In the Network panel, filter by domain. Anything loaded from another company's server, such as analytics, chat widgets, embedded video, maps, social buttons or advertising pixels, may set its own cookies or identifiers.
- Sort what you found into the three groups below.
- Decide: if everything is in the first group, no banner. If anything is in the third, you need consent before it runs.
| Group | Examples | Consent? |
|---|---|---|
| Strictly necessary | Basket contents, a signed-in session, load balancing, a security token on a form, remembering a cookie choice | No, but describe them in your privacy information |
| Exempt in the UK only, with conditions | First-party statistics to improve the site with an opt-out; remembering a visitor's display preferences | Not in the UK if the conditions are met; usually yes for EU visitors |
| Everything else | Third-party analytics, advertising and retargeting pixels, social widgets, most embedded video and maps | Yes, before it runs |
How to avoid needing a banner
- Count visits on the server instead of with a script. Server-side counting stores nothing on the device. See tracking traffic without cookies.
- Link to videos and maps rather than embedding them, or use a click-to-load placeholder that loads the embed only when the visitor asks.
- Drop social share widgets. Plain links to share pages do the same job without loading anyone's code.
- Use payment links that open the provider's checkout on its own site, so its cookies are set there under its own terms.
- Host fonts and files yourself where you can, so pages don't contact other servers on every visit.
Mistakes to avoid
- A banner that sets cookies before anyone clicks. If trackers load on page view, the banner doesn't help.
- "By using this site you agree" notices. Continuing to browse isn't consent; it needs a clear positive action.
- A big Accept button and a hidden Reject. Refusing should be as easy as accepting.
- A banner on a site that doesn't need one. It adds friction, signals tracking that isn't there, and trains visitors to click Accept without reading.
- Forgetting local storage. It's covered by the same rule as cookies.
Check your conclusion
Repeat the developer-tools check after every change that adds a widget, an embed or a script, and after any builder or theme update. Make sure your privacy policy lists what remains, including strictly necessary items. If you decided you need consent, test that nothing in the third group loads until a visitor accepts.
Anticode sites and cookie banners
Pages from Anticode's design engine run no scripts at all, carry no third-party trackers, and count analytics without cookies. Because their Content-Security-Policy blocks frames, there are no embedded videos or maps to set cookies either; you link to them instead. Payments go through payment links that open the provider's own checkout. For most design-engine sites, that leaves nothing that needs a consent banner, though you should still run the check above on your published pages.
Apps are different: an app build can save data in the visitor's own browser with local storage, for example a game's scores or a tracker's entries. Storage the visitor relies on for the app to work, like the entries they typed, is generally strictly necessary. If you ask for anything beyond that, think about consent. For the wider picture, see the GDPR checklist for a small website.
Questions people ask
Do I need a banner if I only use Google Analytics?
For EU visitors, yes: third-party analytics cookies need consent. In the UK, the new statistics exception has conditions, including that the data isn't shared beyond improving the service, so check carefully whether a third-party tool meets them.
Is a privacy policy enough without a banner?
If everything your site stores is strictly necessary or exempt, a clear privacy policy describing it is what you need. It doesn't replace consent for anything that requires it.
Does local storage count?
Yes. The rule covers storing or reading information on the device by any means, not only cookies.