Cookie consent law: when & how
When your website needs a cookie consent banner, what it must include, and how we set one up to follow GDPR and CCPA rules.
If you have visited a website in the past few years, you have seen a cookie banner, usually a pop-up or bar asking you to accept or decline cookies. These banners exist because of privacy laws, primarily the EU's ePrivacy rules and GDPR in Europe, PECR in the UK, and similar regulations in California and elsewhere.
A note on which law does what, because it is a common source of confusion. The rule that you need permission before storing or reading anything on a visitor's device comes from the EU's ePrivacy Directive, and from PECR in the UK. GDPR is what sets the standard that permission has to meet: freely given, specific, informed, and given by a clear positive action. In everyday conversation people say "GDPR consent" for both, which is fine as shorthand.
This guide explains when your website needs one, what it must say, and how we set it up.
This is not legal advice
Chykalophia is a growth partner for B2B companies and manufacturers, not a law firm. This article explains cookie consent concepts and the technical best practices we follow. It is not a substitute for legal advice. Cookie and privacy laws vary by jurisdiction and continue to evolve. Please consult a qualified attorney to confirm your obligations.
What are cookies?
A cookie is a small piece of data a website stores in a visitor's browser. Cookies can remember things like your login status, shopping cart contents, and preferences.
Not all cookies are the same. The key distinction is between essential cookies and non-essential cookies.
| Cookie type | Examples | Needs consent? |
|---|---|---|
| Essential / strictly necessary | Login session, shopping cart, security tokens required for a service the visitor asked for | No, these are necessary to deliver what the visitor requested |
| Analytics | Google Analytics, traffic measurement | Yes in the EU. In the UK, not if it qualifies for the new analytics exception (see below) |
| Marketing / advertising | Meta Pixel, Google Ads, retargeting | Yes |
| Social media trackers | Facebook "Like" button, embedded social feeds | Yes |
| Personalization | Saved preferences not strictly necessary | Yes in the EU. In the UK, preference cookies can qualify for the new appearance exception (see below) |
'Essential' is a narrow category
The ICO is explicit that the exemption is tight: "you should assess 'strictly necessary' from the point of view of the subscriber or user, not your own." Analytics isn't "strictly necessary", however useful it is to you. (The UK now has a separate, narrower exception for analytics, below.) Labelling a tracker "essential" to avoid the banner is one of the practices EU regulators have specifically flagged.
Do I need a cookie consent banner?
The short answer: if your site uses any tracking or analytics tools and you are doing anything to reach people in the EU or UK, plan on needing one.
'I don't have EU customers' is not a safe assumption
Whether the EU rules reach you depends on more than a visitor's IP address: a site merely being reachable from the EU is not, on its own, enough. But if you market to, sell to, or track people there, they do. Unless you actively block EU traffic (which is unusual and not something we recommend), the safe working assumption is that EU and UK rules apply to your analytics and tracking setup. Your lawyer can tell you whether they truly do.
The UK rules changed in February 2026
On 5 February 2026 the Data (Use and Access) Act 2025 rewrote the UK's cookie rule and added new exceptions. You can now set cookies without consent if their sole purpose is to collect statistics about how your site is used so you can improve it, or to adapt how the site looks or works to a visitor's preferences. For both, you must give visitors clear information and a simple, free way to object. The ICO says the analytics exception covers aggregate statistics only, that a third-party analytics provider may only use the data to help improve your site, and that it never covers online advertising: advertising cookies still need consent. If your analytics provider also uses the data for its own purposes, such as advertising, the exception doesn't apply, so check your Google Analytics settings with your lawyer before relying on it. The same Act raised the maximum fine for breaking the UK cookie rules to UK GDPR levels: up to £17.5 million or 4% of a business's worldwide annual turnover, whichever is higher. EU rules had not changed when we last checked, in November 2026. The European Commission proposed changes to them in November 2025, as part of its "Digital Omnibus", but they were still being negotiated in mid-2026.
Help me choose
Do you need a cookie banner?
Here is a quick decision guide:
| Your site uses… | EU/UK consent needed? | CCPA opt-out needed (for CA)? |
|---|---|---|
| No tracking at all, just a contact form | No | No |
| Google Analytics only | EU: yes. UK: yes, unless your setup qualifies for the analytics exception | Possibly: check with a lawyer |
| Google Analytics + Google Ads / remarketing | Yes | Yes |
| Meta Pixel (Facebook/Instagram ads) | Yes | Yes |
| HubSpot, ActiveCampaign, or similar CRMs with tracking | Yes | Yes |
| YouTube embeds | Yes, YouTube loads cookies | Possibly |
| Live chat tools (e.g., Intercom, Drift) | Yes | Possibly |
What a compliant cookie consent tool must do
This is the most important thing to understand: for cookies that need consent, a banner that only informs visitors is not enough under EU or UK rules. The banner must block those cookies from loading until the visitor actively consents. Where you rely on the UK's analytics or appearance exceptions instead, the ICO is just as direct about their conditions: if you don't give people the required information and an easy way to object, "you must not use the technology without the subscriber's or user's consent."
A compliant setup:
Show the banner before any scripts that need consent load. Those tracking tools must be paused until consent is given.
Offer a real choice. The visitor must be able to accept all cookies, reject all non-essential cookies, or customize their choices. Wherever there is an accept button, there should be a way to refuse alongside it: the EU data protection authorities' cookie banner taskforce found that a vast majority of them treat a banner with no refuse option on a layer that has a consent button as an infringement. "Accept" and "Reject" should be equally easy to find and click, not one big button and a tiny link.
Record and store the consent. Your tool should log what the visitor chose and when. This is your record if you are ever asked to prove compliance.
Allow the visitor to change their mind. There should be a way to update cookie preferences at any time, typically a small button or link in the footer.
Not use pre-ticked boxes. Consent must be active and unambiguous. GDPR's own wording is that "silence, pre-ticked boxes or inactivity should not therefore constitute consent," and the EU authorities' taskforce confirmed that pre-ticked opt-in boxes in a cookie banner do not produce valid consent.
The CCPA difference
Under CCPA/CPRA, the requirement is slightly different. California residents don't need to give "opt-in" consent for tracking: instead, they have the right to opt out of the sale or sharing of their personal information.
This typically means:
- A "Do Not Sell or Share My Personal Information" link on your homepage, usually placed in the footer so it appears everywhere
- Clicking that link activates an opt-out preference that blocks data sharing with advertising networks
- A business that sells or shares personal information must also honour opt-out preference signals sent by the visitor's browser or extension, such as Global Privacy Control. If you honour them in the frictionless way California's regulations describe, you can skip the link, though you still need a notice of the right to opt out
- A properly configured consent tool can handle both the EU opt-in and the CCPA opt-out simultaneously
EU and UK rules
Model
Opt-in: no non-essential cookies until the visitor consents. The UK is the same apart from its narrow analytics and appearance exceptions, which need clear information and an easy way to object instead.
On the site
A banner that blocks trackers, with Accept and Reject equally easy.
Records
Log what each visitor chose and when.
CCPA/CPRA
Model
Opt-out of the sale or sharing of personal information.
On the site
A "Do Not Sell or Share My Personal Information" link, or honouring an opt-out preference signal.
What the opt-out does
Blocks data sharing with advertising networks.
What we use and how we set it up
When we set up cookie consent, we use established platforms designed for legal compliance. The specific tool depends on your site platform and your needs.
When we set up your consent tool, we:
- Configure it to block analytics and marketing scripts until consent is given
- Categorize your cookies correctly (essential vs. analytics vs. marketing)
- Match the banner styling to your brand
- Set up the geo-targeting so the GDPR banner appears for EU visitors and the CCPA opt-out is available for California visitors
- Link the banner to your privacy policy
- Add a preference center so visitors can update their choices later
The tool must match the scripts on your site
A consent tool is only effective if it is properly connected to every third-party script on your site. If you install a new plugin, embed a new video, or add a new tracking pixel after we configure your consent tool, let us know. We may need to update the configuration.
Common pitfalls
- "Dark patterns" in the banner design. Making "Accept All" bright and prominent while hiding "Reject" in small gray text is a dark pattern. The EU data protection authorities' cookie banner taskforce agreed that a site owner "must not design cookie banners in a way that gives users the impression that they have to give a consent to access the website content, nor that clearly pushes the user to give consent." Present acceptance and rejection equally.
- Installing a consent tool but not blocking scripts. Some quick implementations just show a banner without actually preventing trackers from loading. This is technically non-compliant. We verify that scripts are properly gated.
- Ignoring Google Analytics. Google Analytics is a common source of cookie compliance gaps. It must be behind the consent gate for EU visitors.
- Set-and-forget. As you add new tools to your site (a live chat widget, a CRM tracker, a new ad platform), your consent configuration needs to be updated.
- Not having a privacy policy. Your cookie banner should link to a privacy policy. If you don't have one, the banner alone is not enough.
Common questions
Will a cookie banner hurt my analytics data?
Yes, to some degree. Visitors who decline tracking won't be counted in Google Analytics, so your reported numbers will drop once a proper consent gate goes in. How far they drop depends on your audience and how your banner is designed, so treat the day you switch it on as a new baseline rather than comparing across it. This is the trade-off for legal compliance. Some analytics platforms are built to work without cookies or personal data, which can reduce what you need consent for, but the rules cover any technology that stores or reads information on a visitor's device, not just cookies, so confirm the specifics rather than assuming a tool is exempt. We can discuss these alternatives with you.
Do I need a cookie policy in addition to a privacy policy?
What the rules actually require is clear and comprehensive information about the cookies you set and why. The UK's PECR, for example, does not dictate the format: the ICO has said the regulations "do not set out exactly what information you must provide or how to provide it", and that "this is up to you." So a separate cookie policy is one common way to do it, and a dedicated section inside your privacy policy is another. A lawyer can tell you what fits your situation. We can help you document which cookies your site uses either way.
What about WordPress plugins: do they set cookies?
Yes, many do. Contact form plugins, WooCommerce, caching plugins, security plugins, and others may all set cookies. Most that are purely functional (session management, cart) are considered essential. But some plugins add analytics or marketing features. We audit cookie usage as part of our consent tool setup.
My site is brand new and I haven't launched yet. Do I need to set this up before launch?
Yes, your consent tool should be in place before your site goes live, not added later. It is much easier and cleaner to configure before the first visitor arrives.
Can I use a free cookie consent tool?
Free tools exist, but many lack the features needed for full GDPR compliance (like proper consent logging and script blocking). We choose tools that have been verified by independent legal reviewers and that integrate well with the site platforms we use.
Related guides
Learn more
- UK Information Commissioner's Office: guidance on the use of storage and access technologiesico.org.uk
- UK Information Commissioner's Office: what are the exceptions? (the 2026 analytics and appearance exceptions)ico.org.uk
- European Data Protection Board: report of the Cookie Banner Taskforceedpb.europa.eu
- EUR-Lex: the ePrivacy Directive, which contains the consent rule for cookieseur-lex.europa.eu
- California Attorney General: California Consumer Privacy Act (CCPA)oag.ca.gov
Was this page helpful?
Go deeper on chykalophia.com
Talk it through
Want a second pair of eyes on this?
Book a free discovery call, up to an hour. Bring the question you're stuck on and we'll tell you honestly what we'd do.
Already a client? Email support@chykalophia.com.
Last updated