Do I need a cookie banner on my website?
The short answer
Only if you set non-essential cookies — analytics, advertising, embedded content that tracks. If your site sets nothing beyond what is strictly necessary to function, you generally do not need one. The most effective fix is not a better banner: it is collecting less, so there is nothing to ask permission for.
On this page
What actually triggers it
Not "having a website". The requirement comes from setting cookies or similar storage that are not strictly necessary for the site to work.
Strictly necessary — generally no consent needed:
- Keeping someone logged in
- Remembering what is in a basket
- Security and fraud prevention
- Remembering a language or accessibility preference they chose
Not strictly necessary — generally consent needed:
- Analytics
- Advertising and remarketing
- Social media embeds and share buttons that track
- Embedded video from a platform that sets cookies
- Chat widgets, in many cases
The last three catch people out. A single embedded video or a share button can set third-party cookies, which means a site with no analytics at all can still trigger the requirement.
What a banner has to do to be valid
This is where most banners fail, and where the legal exposure actually sits.
In several jurisdictions — the EU and UK most strictly — consent must be:
Given, not assumed. "By continuing to browse you agree" is not consent. Neither is a banner with only an "OK" button.
As easy to refuse as to accept. A prominent "Accept all" beside a buried "Manage preferences" link is a common pattern and a non-compliant one.
Obtained before the cookies are set. Many banners appear while the tracking has already fired, which makes the banner decorative.
Withdrawable. People must be able to change their mind later, which means a persistent link somewhere.
A banner that fails these is arguably worse than none — it demonstrates awareness of the obligation while not meeting it.
The simplification worth considering
Collect less.
If you drop behavioural analytics, or use a tool that avoids personal identifiers and cookies entirely, the consent requirement often falls away. Same for hosting your own fonts instead of loading them from a third party, and linking to videos rather than embedding them.
For most small businesses, the analytics that matter are: how many people visited, which pages, and where they came from. Several tools provide that without setting cookies, and without a banner.
This is the only option on the page that reduces work instead of adding to it.
What most small businesses should actually do
- Find out what your site sets. Your browser's developer tools will list cookies for a page, or use a free scanner. Most people are surprised by what is there.
- Remove what you do not use. An analytics tool nobody reads, a chat widget nobody staffs, a share button nobody clicks. Deleting them removes the obligation entirely.
- If anything non-essential remains, use a consent tool that genuinely blocks it until consent is given, with equally weighted accept and reject options.
- Describe it in your privacy policy, specifically — naming what you use rather than describing categories.
The honest caveat
Rules differ significantly by jurisdiction and they change. This is a general orientation, not legal advice, and if you handle sensitive data or operate across several regions it is worth a professional opinion.
But the practical guidance holds everywhere: fewer trackers means less obligation, less to explain, and a faster site. Nobody has ever regretted removing the analytics tool they were not reading.
The analytics question, which is usually the whole question
Read back over the rules and notice what actually triggers a banner for a typical small business. It is almost never something you deliberately chose. It is the analytics.
Google Analytics sets cookies and sends data to a third party, and that is what puts you into consent territory. Remove that one thing and most small business sites have nothing left that requires a banner — the site itself sets no tracking cookies, and a session cookie whose only job is keeping a login working is exempt.
Worth knowing, because it reframes the banner as a consequence of a tool choice rather than a law you cannot escape. Helm's analytics is built the other way round: no cookies are used for tracking identity at all — the session lives in the browser's own session storage and disappears when the tab closes — and visitor IP addresses are hashed rather than stored. You still get the entry pages, sources, devices and countries described in how do I track if my website is working, without the cookie that creates the obligation.
None of which is legal advice, and if you run advertising pixels or embed third-party video you are back in banner territory regardless of your analytics. But the common case — a small business that just wanted to know which pages people land on — does not have to look like a compliance project.