What it does
Whether you need a cookie banner depends on what your site does on the visitor's device. In the EU and UK, the ePrivacy rules require consent before you store information on a device or read it back, unless it's strictly needed for a service the visitor asked for. Analytics usually isn't.
Answer three questions and this explainer summarises how the rules usually treat your setup. It's a plain-language starting point, not legal advice. Ask a lawyer about your own site.
How to use it
- 1Under How does your analytics identify visitors?, choose No cookies or storage, or Cookies or local storage.
- 2Under Where are most of your visitors?, choose EU or UK, United States, or Elsewhere.
- 3Under Do you run ad pixels or marketing tags?, choose Yes or No.
- 4Read the points below. Each is marked Fine, Note or Consent, and they update as you change an answer.
Two sets of rules, not one
The ePrivacy rules (PECR in the UK) are about the device: storing or reading cookies, local storage and similar identifiers needs consent unless strictly necessary. The European Data Protection Board reads this broadly, so it can reach tracking pixels too.
GDPR is about the personal data, wherever it's kept. Analytics that stores nothing on the device still handles data such as IP addresses. You still need a lawful basis, a privacy policy naming the tool, and a processing agreement with the provider.
What usually needs a banner
A banner should make Reject as easy as Accept, and the tags should load only after Accept.
- Analytics that sets cookies or a local storage identifier, for EU and UK visitors.
- Ad pixels and marketing tags from Meta, Google Ads, LinkedIn and similar, whatever your analytics does.
- Embedded content that sets its own cookies, such as some video players.
Outside the EU and UK
Most US state privacy laws don't require opt-in for analytics. They focus on selling or sharing data for advertising. California and several other states give an opt-out right and expect sites to honour signals such as Global Privacy Control. Elsewhere, such as Brazil and Canada, expect clear notice and often consent for tracking.
Questions
Does cookieless analytics need a cookie banner?
Often not in the EU and UK, because the ePrivacy consent rule is triggered by storing or reading on the device. GDPR still applies to the data, so name the tool in your privacy policy. This is not legal advice.
Does Google Analytics need a banner?
It sets cookies by default, so for EU and UK visitors it needs consent before it loads. Google's Consent Mode changes what's sent when someone declines, but doesn't remove the need to ask.
Are strictly necessary cookies exempt?
Yes: a shopping cart, a login session or the consent choice itself. Advertising cookies never qualify. Analytics cookies usually don't, though some regulators, such as France's CNIL, exempt tightly limited audience measurement.
Does this explainer scan my site?
No. It works only from your three answers. To see what your pages load, check cookies, storage and network requests in your browser's developer tools.