Cookie consent law: when & how

When your website needs a cookie consent banner, what it must include, and how we implement one that meets GDPR and CCPA requirements.

If you have visited a website in the past few years, you have seen a cookie banner — usually a pop-up or bar asking you to accept or decline cookies. These banners exist because of privacy laws, primarily the EU's ePrivacy rules and GDPR in Europe, PECR in the UK, and similar regulations in California and elsewhere.

A note on which law does what, because it is a common source of confusion. The rule that you need permission before storing or reading anything on a visitor's device comes from the EU's ePrivacy Directive, and from PECR in the UK. GDPR is what sets the standard that permission has to meet: freely given, specific, informed, and given by a clear positive action. In everyday conversation people say "GDPR consent" for both, which is fine as shorthand.

This guide explains when your website needs one, what it must say, and how we set it up.

This is not legal advice

Chykalophia is a design and web agency, not a law firm. This article explains cookie consent concepts and the technical best practices we follow. It is not a substitute for legal advice. Cookie and privacy laws vary by jurisdiction and continue to evolve. Please consult a qualified attorney to confirm your obligations.

Quick summary

Most websites that use analytics tools, advertising pixels, or social media trackers need a cookie consent mechanism. Under EU and UK rules, non-essential cookies must not be set until the visitor consents. Under CCPA, visitors must be able to opt out of the sale or sharing of their data. We implement compliant consent tools as part of every site build and can add one to existing sites. A cookie banner alone is not enough — it must actually block trackers until consent is given.

What are cookies?

A cookie is a small piece of data a website stores in a visitor's browser. Cookies can remember things like your login status, shopping cart contents, and preferences.

Not all cookies are the same. The key distinction is between essential cookies and non-essential cookies.

Cookie type	Examples	Needs consent?
Essential / strictly necessary	Login session, shopping cart, security tokens required for a service the visitor asked for	No — these are necessary to deliver what the visitor requested
Analytics	Google Analytics, traffic measurement	Yes, for EU and UK visitors
Marketing / advertising	Meta Pixel, Google Ads, retargeting	Yes
Social media trackers	Facebook "Like" button, embedded social feeds	Yes
Personalization	Saved preferences not strictly necessary	Yes

'Essential' is a narrow category

The ICO is explicit that the exemption is tight: "cookies that are helpful or convenient but not essential, or that are only essential for your own purposes, will still require consent." Analytics falls on the consent side of that line, however useful it is to you. Labelling a tracker "essential" to avoid the banner is one of the practices EU regulators have specifically flagged.

The short answer: if your site uses any tracking or analytics tools and you are doing anything to reach people in the EU or UK, plan on needing one.

'I don't have EU customers' is not a safe assumption

Whether the EU rules reach you depends on more than a visitor's IP address — a site merely being reachable from the EU is not, on its own, enough. But if you market to, sell to, or track people there, they do. Unless you actively block EU traffic (which is unusual and not something we recommend), the safe working assumption is that EU and UK rules apply to your analytics and tracking setup. Your lawyer can tell you whether they truly do.

Here is a quick decision guide:

Your site uses…	EU/UK consent needed?	CCPA opt-out needed (for CA)?
No tracking at all — just a contact form	No	No
Google Analytics only	Yes	Possibly — check with a lawyer
Google Analytics + Google Ads / remarketing	Yes	Yes
Meta Pixel (Facebook/Instagram ads)	Yes	Yes
HubSpot, ActiveCampaign, or similar CRMs with tracking	Yes	Yes
YouTube embeds	Yes — YouTube loads cookies	Possibly
Live chat tools (e.g., Intercom, Drift)	Yes	Possibly

This is the most important thing to understand: a cookie banner that only informs visitors is not enough under EU or UK rules. The banner must block non-essential cookies from loading until the visitor actively consents. The ICO puts it directly: "you cannot set non-essential cookies on your website's homepage before the user has consented to them."

A compliant setup:

Show the banner before any non-essential scripts load. The tracking tools must be paused until consent is given.

Offer a real choice. The visitor must be able to accept all cookies, reject all non-essential cookies, or customize their choices. Wherever there is an accept button, there should be a way to refuse alongside it: the EU data protection authorities' cookie banner taskforce found that a vast majority of them treat a banner with no refuse option on a layer that has a consent button as an infringement. "Accept" and "Reject" should be equally easy to find and click — not one big button and a tiny link.

Record and store the consent. Your tool should log what the visitor chose and when. This is your record if you are ever asked to prove compliance.

Allow the visitor to change their mind. There should be a way to update cookie preferences at any time — typically a small button or link in the footer.

Not use pre-ticked boxes. Consent must be active and unambiguous. GDPR's own wording is that "silence, pre-ticked boxes or inactivity should not therefore constitute consent," and the EU authorities' taskforce confirmed that pre-ticked opt-in boxes in a cookie banner do not produce valid consent.

The CCPA difference

Under CCPA/CPRA, the requirement is slightly different. California residents don't need to give "opt-in" consent for tracking — instead, they have the right to opt out of the sale or sharing of their personal information.

This typically means:

A "Do Not Sell or Share My Personal Information" link on your homepage, usually placed in the footer so it appears everywhere
Clicking that link activates an opt-out preference that blocks data sharing with advertising networks
Alternatively, the law lets you skip the link and instead honour an opt-out preference signal sent by the visitor's browser or extension, such as Global Privacy Control
A properly configured consent tool can handle both the EU opt-in and the CCPA opt-out simultaneously

What we use and how we set it up

We implement cookie consent using established platforms designed for legal compliance. The specific tool depends on your site platform and your needs.

When we set up your consent tool, we:

Configure it to block analytics and marketing scripts until consent is given
Categorize your cookies correctly (essential vs. analytics vs. marketing)
Match the banner styling to your brand
Set up the geo-targeting so the GDPR banner appears for EU visitors and the CCPA opt-out is available for California visitors
Link the banner to your privacy policy
Add a preference center so visitors can update their choices later

The tool must match the scripts on your site

A consent tool is only effective if it is properly connected to every third-party script on your site. If you install a new plugin, embed a new video, or add a new tracking pixel after we configure your consent tool, let us know — we may need to update the configuration.

Common pitfalls

"Dark patterns" in the banner design. Making "Accept All" bright and prominent while hiding "Reject" in small gray text is a dark pattern. The EU data protection authorities' cookie banner taskforce agreed that a site owner "must not design cookie banners in a way that gives users the impression that they have to give a consent to access the website content, nor that clearly pushes the user to give consent." Present acceptance and rejection equally.
Installing a consent tool but not blocking scripts. Some quick implementations just show a banner without actually preventing trackers from loading. This is technically non-compliant. We verify that scripts are properly gated.
Ignoring Google Analytics. Google Analytics is a common source of cookie compliance gaps. It must be behind the consent gate for EU visitors.
Set-and-forget. As you add new tools to your site — a live chat widget, a CRM tracker, a new ad platform — your consent configuration needs to be updated.
Not having a privacy policy. Your cookie banner should link to a privacy policy. If you don't have one, the banner alone is not enough.

Common questions

Yes, to some degree. Visitors who decline tracking won't be counted in Google Analytics, so your reported numbers will drop once a proper consent gate goes in. How far they drop depends on your audience and how your banner is designed, so treat the day you switch it on as a new baseline rather than comparing across it. This is the trade-off for legal compliance. Some analytics platforms are built to work without cookies or personal data, which can reduce what you need consent for — but the rules cover any technology that stores or reads information on a visitor's device, not just cookies, so confirm the specifics rather than assuming a tool is exempt. We can discuss these alternatives with you.

What the rules actually require is clear and comprehensive information about the cookies you set and why. The UK's PECR, for example, does not dictate the format: the ICO says the regulations "do not set out exactly what information you must provide or how to provide it – this is up to you." So a separate cookie policy is one common way to do it, and a dedicated section inside your privacy policy is another. A lawyer can tell you what fits your situation. We can help you document which cookies your site uses either way.

What about WordPress plugins — do they set cookies?

Yes, many do. Contact form plugins, WooCommerce, caching plugins, security plugins, and others may all set cookies. Most that are purely functional (session management, cart) are considered essential. But some plugins add analytics or marketing features. We audit cookie usage as part of our consent tool setup.

My site is brand new and I haven't launched yet. Do I need to set this up before launch?

Yes — your consent tool should be in place before your site goes live, not added later. It is much easier and cleaner to configure before the first visitor arrives.

Free tools exist, but many lack the features needed for full GDPR compliance (like proper consent logging and script blocking). We choose tools that have been verified by independent legal reviewers and that integrate well with the site platforms we use.

Need a hand?

If you're stuck, email support@chykalophia.com and we'll help. Include your website address and a screenshot if you can.