Cookie banners: what a small business website needs

Most small business websites get cookies wrong in one of two ways. Either there is no banner and analytics cookies land on every visitor's device, or there is a banner that makes accepting easy and refusing hard. This is what we put on the sites we build, including this one. It is general guidance, not legal advice, so check anything important with your own lawyer.

Do you need a banner at all?

You need one if your site stores or reads anything on a visitor's device that is not strictly necessary, and you have visitors from Europe. In the EU and the wider EEA, the ePrivacy rules require consent for analytics and advertising cookies. The UK changed its rules in 2025: the Data (Use and Access) Act added an exception for analytics used only to produce aggregate statistics that help you improve your site, under conditions the ICO sets out in its guidance. Advertising cookies, including ad measurement, still need consent in both.

What counts as strictly necessary

Cookies that make something the visitor asked for work can be set without consent: remembering their cookie choice, keeping a cart or a login working, or protecting a form from abuse. Analytics, advertising pixels, heatmaps and most embedded social media are not strictly necessary, so they wait for a yes where consent is required.

Make refusing as easy as accepting

Put Reject all next to Accept all, the same size and weight, on the first screen of the banner. In January 2023 the EDPB's Cookie Banner Taskforce reported that a vast majority of European data protection authorities treat a banner that offers accept without a reject option on the same layer as an infringement. A reject link buried in the text does not fix it either.

• Accept all and Reject all, with equal prominence.
• A Preferences view: Necessary always on, Analytics and Marketing off until switched on.
• A short, plain description and a link to the cookie section of your privacy policy.
• A Cookie settings link in the footer, so people can change their mind later.
• The choice remembered for a sensible period, then asked again. We use six months.
• No optional cookies or tags set before the choice where consent is required.

Where Google Consent Mode v2 fits

If you use Google Analytics or Google Ads, the banner should also send consent mode signals. Google added two signals in late 2023, ad_user_data and ad_personalization, alongside ad_storage and analytics_storage, and from March 2024 features such as audiences only include EEA visitors when those signals are in place.

Consent mode runs in one of two ways. In basic mode, Google tags do not load until the visitor makes a choice. In advanced mode, the tags load straight away with consent denied by default and send measurements without cookies, then full data once the visitor agrees. Either way, set the default before any Google tag on the page. Defaults can be scoped by region, so visitors in the EEA, the UK and Switzerland start with everything denied.

When someone presses Reject all, consider not loading the Google tag on their next pages at all. That is what most visitors expect a no to mean, and it costs you very little data.

Do you need a paid consent platform?

Not for a small site with two or three tags. A lightweight banner built into the site can do everything above in a few kilobytes and keep your page speed intact. A consent management platform earns its cost when you run many advertising tags or need the IAB Transparency and Consent Framework. If you show AdSense, Ad Manager or AdMob ads to visitors in the EEA or the UK, Google requires a Google-certified one.

Cookieless analytics is a real option

If you only want to know which pages work, a cookieless analytics tool such as Plausible or Fathom can be enough. They report less detail than GA4 and have no ad integrations, which for many service businesses is a fair trade. Whether you still need consent for them depends on how they work and where your visitors are, so check before you drop the banner.

Where to start

Open your site in a private window, then look in your browser's developer tools under Application, then Cookies, before you click anything. Anything there beyond strictly necessary cookies needs a consent default and a banner. If you would like it handled properly, a website review covers cookies, analytics and consent alongside speed and SEO, and our SEO, speed and AI search service includes the full setup.

Questions we hear about this

Do visitors outside Europe need to see the banner?

Rules differ by country, so many sites show the same banner to everyone and set consent defaults by region. Visitors in the EEA, the UK and Switzerland start with analytics and advertising off, while visitors elsewhere can start with analytics on and switch it off at any time.

How long should a cookie choice be remembered?

The law does not set one number. France's data protection authority, the CNIL, recommends keeping a visitor's choice for six months before asking again, and six to twelve months is common practice. Always offer a Cookie settings link so people can change their mind sooner.

Will a cookie banner slow my website down?

A small banner built into the site adds very little. Some third-party consent platforms load far more script than the banner needs, so compare the network panel and your Lighthouse results before and after you add one.