Do you need a cookie banner? Usually only because of tools you could remove

When you actually need one — and when you don’t

The rule underneath all the noise is simple. Under the ePrivacy Directive and the GDPR, you need consent — and therefore a banner — whenever your site stores or accesses information on a visitor’s device beyond what’s strictly necessary, which in practice means any analytics, advertising or third-party tracking (Cookie Banner, 2026). That covers the tools most sites reach for by habit: Google Analytics or GA4 (even a “basic” setup), the Facebook pixel, marketing platforms, social media buttons, and embedded videos or maps that carry trackers (Secure Privacy, 2026).

The part that gets far less airtime is the flip side. If your site does nothing beyond strictly necessary functions, a consent banner may genuinely not be required (GDPR Advisor, 2026). A site built with only first-party, functional cookies and no outside tracking has nothing to gate behind consent, so the banner simply isn’t needed — though you should still describe your cookie use in a privacy or cookie policy for transparency (Flow Consent, 2026). This is the practical, at-the-page version of the argument our pillar on respecting visitor privacy makes: the obligations follow the tracking, so the tracking is where to look first.

What counts as “strictly necessary”

Because the whole question turns on this exemption, it’s worth being precise about how narrow it is. The ePrivacy Directive’s Article 5(3) exempts only cookies essential to a service the user explicitly requested, and the recognised examples are a short list: authentication and login cookies, security cookies, a session or shopping-cart cookie that holds items while someone shops, and a cookie remembering a language preference (iubenda, 2026). These are first-party and functional, and they don’t need consent.

What falls outside the exemption is everything added to improve the experience or the business rather than to deliver the requested service — analytics, personalisation and marketing all require consent even when they’re genuinely useful (Cookie Banner, 2026). The distinction is the whole game: a cookie that lets a shopper keep items in a cart is necessary; a cookie that profiles that shopper across the web is not. And one caveat applies to both sides — even where a cookie is exempt from consent, you still have to inform visitors of it in a cookie policy, because transparency is a separate obligation from consent (iubenda, 2026).

Analytics is where it gets decided

For most ordinary business sites, the entire banner question comes down to one tool: analytics. Google Analytics 4 sets cookies tied to user identification and behavioural tracking and transfers data to US servers, which places it firmly outside the strictly necessary exemption no matter how you configure it (GDPR Advisor, 2026). Regulators don’t fully agree on whether any analytics can be exempt: the UK, Belgian and Irish authorities treat analytics cookies as always requiring consent, while the French, German, Dutch and Italian authorities allow a narrow exemption for first-party, anonymised measurement with no cross-tracking and no third-party transfer — conditions GA4 doesn’t meet (iubenda, 2026). Since the rules genuinely vary by country, this is a place to check your specific jurisdiction rather than assume, and — the honest caveat throughout — none of this is legal advice.

Here’s the move that dissolves the problem, though. A cookieless analytics tool such as Plausible or Fathom measures traffic without storing or accessing anything on the visitor’s device, so under Article 5(3) it requires no consent — which means no banner (Plausible, 2026). The blunt way privacy engineers put it is that consent banners largely became necessary because Google Analytics was found to violate privacy law, and the obligation was quietly passed to the sites that use it — so dropping Google Analytics is often all it takes to drop the banner (Plausible, 2026). For most sites, the numbers you actually use — visitors, popular pages, referral sources — are exactly what cookieless tools provide.

If you do need a banner, it has to actually work

Suppose you genuinely run advertising or behavioural tracking and a banner is unavoidable. Then it has to do the technical job, not merely appear. A compliant 2026 banner offers four clearly visible choices — accept all, reject all, customise (granular consent by category), and a close control that doesn’t imply acceptance — with reject given the same prominence as accept, not buried behind a “manage preferences” link (My Agile Privacy, 2026). Consent must be granular, so a visitor can accept analytics while rejecting advertising, and the whole thing rests on prior blocking: non-essential scripts must not fire until a valid choice is made (GDPR Advisor, 2026).

Two details cut against the complexity the consent industry sells. First, dark patterns — pre-ticked boxes, hidden reject buttons, an “X” that secretly accepts, cookie walls — invalidate consent and are exactly what regulators now target (Cookie Banner, 2026). Second, documenting consent does not require an elaborate database logging every visitor’s IP; a first-party technical cookie that stores the person’s preference is sufficient, a point the Italian authority has confirmed directly (My Agile Privacy, 2026). A banner is a real engineering responsibility, but it’s a smaller one than the vendors imply — and still larger than not needing one.

The two-minute test

You can settle whether your current setup is compliant faster than you can read its privacy policy. Open your site in a fresh browser with cookies cleared, open developer tools, go to the Network tab, and watch for requests to tracking domains — google-analytics.com, facebook.net, doubleclick.net and the like — before you touch the banner. If those requests fire before you’ve made any choice, your site is in breach of the ePrivacy Directive: the banner is decorative and tracking has already begun, and this is the single most important test, the one enforcement investigators run first (GDPR Advisor, 2026).

There’s a companion check for after the choice. Click reject, wait about thirty seconds without navigating, then open the Application tab in Chrome or Storage tab in Firefox and look at what cookies exist — anything beyond session identifiers, login tokens and cart cookies means non-essential cookies survived a rejection, which is its own violation (GDPR Advisor, 2026). The reason this matters is that visual compliance and technical compliance are different things: a banner can look perfect and fail both tests, and looking compliant while leaking is arguably worse than an honest absence, because it signals to a regulator that you knew and didn’t deliver.

Why our sites usually don’t need one

Stated plainly as our position: the sites we build typically need no cookie banner, and that’s by design rather than luck. Because we self-host assets, carry no third-party trackers, and use cookieless analytics that stores nothing on a visitor’s device, there are no non-essential cookies to consent to — so there’s nothing for a banner to gate. The visitor gets a page that doesn’t interrupt them, and the owner skips four costs at once: the annoyance that suppresses engagement, the roughly 55% of analytics data that consent banners lose to rejections, the recurring consent-platform subscription, and the standing compliance risk of a banner that might be misconfigured tomorrow (Plausible, 2026). A short, honest cookie or privacy policy still explains what the few functional cookies do, which is the transparency side of the obligation.

The honest gate holds firmly here, and it has two edges. We’re not lawyers, and the exemption rules — especially around analytics — vary enough by country that your specific obligations deserve a professional’s read. And minimalism isn’t universal: if your business genuinely runs behavioural advertising, cross-site retargeting or detailed attribution, you will need a properly configured consent setup with real prior blocking, and we’ll tell you that plainly rather than pretend a cookieless build covers it. What we won’t do is bolt a decorative banner onto a leaking site and call it compliance. For the large majority of businesses whose site informs and converts rather than running an ad operation, the best banner is the one you engineered away.

The banner is a symptom; treat the cause

Step back and the cookie banner turns out to be a symptom of a choice made upstream. Every requirement it carries — prior blocking, granular consent, equal-prominence reject buttons, renewal, documentation — exists to manage tracking you decided to add. Remove the tracking and the requirement dissolves; keep it and you own the whole apparatus, done properly, forever. Framed that way, “which cookie banner should I buy” is often the wrong first question, and “do I actually need to track this at all” is the right one.

So the useful way to approach it is to audit what your site loads before shopping for a consent tool: run the two-minute network test, identify the non-essential trackers, ask which genuinely earn their place, replace analytics with a cookieless tool, and add a banner only for whatever tracking truly remains. Do that and the banner stops being an unavoidable tax on visiting your site and becomes what it should be — a rare exception for sites that genuinely need it, not a reflex — which is the same “do it right once” logic that runs through our pillar on respecting visitor privacy and the self-hosting choices that keep a site’s data to itself in the first place.