Do I need a cookie banner

Not always.
It depends what you load.

Yes, if your site runs ads or analytics that store an ID and you have visitors from the EU or the UK. No, if it sets only the cookies it needs to work. The US has no cookie-banner law: there the duty is to tell visitors what you use and let them opt out of ad sharing. Here is what needs a yes, the rules by place, a six-question checker for your own site, and how to set it up with Builderify Cookie Consent.

Check my site Start free
UK statistics exception In force for 266 days

By the Builderify team Not legal advice

01 The essentials ask nothing 02 Analytics change the answer 03 Ads change it most 04 Embeds depend how they load
01 / The short answer

Do you need a cookie banner
on your website?

It depends on what your site loads and where your visitors are. A site that sets only what it needs to work, such as a login, a basket or a security cookie, needs no banner anywhere. Add analytics that store an ID, an ad pixel, a recording tool or an embed that sets cookies, and visitors from the EU and the UK have to be asked first. In the US the duty is to tell visitors and let them opt out of ad sharing.

So the practical answer is three questions: what does your site load, where are your visitors, and does the “no” button really work? The rest of this page is the detail behind them.

Three questions, in orderChecked 28 October 2026
  1. 01
    What does the site load?

    A login, a basket and a security cookie need no banner anywhere. Ads, analytics that store an ID, recordings and embeds that set cookies do.

    The site
  2. 02
    Where are your visitors?

    The EU and the UK ask first. US states ask for a notice and an opt-out. Rules usually follow the visitor, so a US shop with customers in Berlin has the EU question too.

    The visitor
  3. 03
    Does the “no” really work?

    A Reject button that doesn’t stop the tags is what regulators fine and plaintiffs sue over. Test yours before anyone else does.

    The proof
The whole EU rule, in one sentence
ePrivacy Directive, Article 5(3), the “cookie rule”

“…the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information…”

That is why it isn’t really about “cookies”. Pixels, scripts, local storage and fingerprinting all count, and so does reading something already stored. The same article lets through anything strictly necessary for a service the visitor asked for.

02 / What needs a yes

Which cookies need consent,
and which don’t?

Look for what your site loads in the left column. Each place has its own answer, and the same tool can sit in a different row depending on how you set it up.

  • Essentials

    Login, cart and checkout, security, remembering a choice the visitor made

    EU
    No banner needed

    Strictly necessary for something the visitor asked for. Tell them in your policy.

    UK
    No banner needed

    The ICO lists baskets, logins, security and the cookie that remembers a banner choice.

    US
    No banner needed

    Nothing to ask. Say what you set in your privacy notice.

  • Analytics that store an ID

    Google Analytics 4 and similar

    EU
    Ask first

    France exempts tightly set up tools, but its regulator says most large ones don’t qualify.

    UK
    Conditions apply

    Since 5 February 2026, plain statistics can run if visitors are told and can object. Profiling can’t.

    US
    Tell them

    Say what you use in your privacy notice. No yes first.

  • Advertising and conversion pixels

    Meta Pixel, Google Ads, TikTok, LinkedIn

    EU
    Ask first

    The clearest case for consent. A pre-ticked box isn’t consent.

    UK
    Ask first

    The statistics exception doesn’t cover advertising, ad measurement included.

    US
    Opt-out

    Sharing data for targeted ads gives visitors a right to opt out where a state law covers you.

  • Recordings and heatmaps

    Hotjar, Microsoft Clarity

    EU
    Ask first

    Exemptions cover audience statistics, not a replay of one person’s visit.

    UK
    Ask first

    The ICO says recordings of individual visitors need consent.

    US
    Tell them

    Keep recordings off forms. Wiretap lawsuits aim at tracking tools.

  • Video, maps and social embeds

    YouTube, Vimeo, Google Maps, social posts

    EU
    Depends how it loads

    Loading with the page can set identifiers at once. Hold it until a yes, or behind a click.

    UK
    Depends how it loads

    Fine behind a click with a note under the embed. Ask first if it loads with the page.

    US
    Tell them

    Mention them in your privacy notice.

  • Analytics with no cookie and no ID

    Server logs, cookieless tools

    EU
    No banner needed

    Nothing is stored or read on the device. Check with the vendor: regulators read “access” widely.

    UK
    No banner needed

    Nothing is stored or read on the device, so there is nothing to ask.

    US
    No banner needed

    Nothing to ask or offer.

Cookieless sits at the bottom for a reason. It is the one way to measure traffic without asking. The Google Analytics alternatives guide compares tools that work without cookies, and is Google Analytics legal? covers the EU side of the biggest one.

A tag you hold isn’t lost. A visitor who says no still visits, and you can still count them: the how-to on visitors who reject cookies shows what you can measure without an ID. Meta, TikTok and Microsoft tags can be held until a yes too, as the Meta Pixel cookie consent guide shows.

03 / Rules by place

Cookie banner rules:
the EU, the UK and the US.

These are the rules that decide whether a site needs a cookie banner, checked on 28 October 2026. They change, so follow the links to the current text. Rules usually follow the visitor, not the business.

European Union

Ask first
In force. A reform is proposed (chapter 06).
ePrivacy Directive, Article 5(3), read with the GDPR
Falls on

Any site that stores or reads information on a visitor’s device. The GDPR also reaches businesses outside the EU that offer goods or services to people there or monitor their behaviour (Article 3(2)).

What it asks

A clear yes before anything beyond the strictly necessary. A pre-ticked box is not consent, the Court of Justice ruled in Planet49. Visitors must be told what each cookie is for, how long it lasts and whether others can read it. A vast majority of the authorities in the EDPB’s 2023 taskforce called a banner with “Accept” but no “Reject” an infringement.

What is at stake
€150m

The CNIL fined Shein this in September 2025, for advertising cookies set before any choice, for “Reject all” that still let new cookies through, and for incomplete banners. It fined Google €325 million the same day, partly because refusing advertising cookies was harder than accepting them when people created a Google account.

United Kingdom

Ask first, with exceptions
Exceptions in force since 5 February 2026
PECR regulation 6, as changed by the Data (Use and Access) Act 2025
Falls on

Anyone running an online service from the UK. The UK GDPR can also reach a business abroad that offers goods or services to people in the UK or monitors their behaviour there (Article 3).

What it asks

A yes first, unless one of five exceptions fits. A small site mostly meets two: “statistical purposes” (aggregate numbers about how your own site is used, A/B tests included) and “appearance” (remembering a language, fitting the screen, a dark-mode setting). Both need clear information and a simple, free way to object, and neither ever covers advertising. The ICO’s banner checks look at advertising cookies: none set before a choice, rejecting as easy as accepting, and none set after a refusal.

What is at stake
£17.5m

The most the ICO can now fine for breaking PECR, or 4% of worldwide turnover, whichever is higher, up from £500,000. In December 2025 it said 979 of the UK’s top 1,000 sites passed its banner checks, 564 of them only after the ICO got in touch. By April 2026 it put the share that pass at 99%.

United States

Notice and opt-out
State by state. No federal cookie-banner law.
State privacy laws, starting with California’s CCPA
Falls on

Businesses above each state’s size tests. California’s: $26.625 million or more in annual revenue, or buying, selling or sharing the data of 100,000 or more residents or households, or half your revenue from selling or sharing data. The IAPP counts 23 states with a comprehensive privacy law, each with its own thresholds.

What it asks

A clear privacy notice, and an opt-out of the sale or sharing of data and of targeted advertising. Most states want a yes before sensitive data is used (California, Iowa and Utah differ), and the federal COPPA rule requires a parent’s consent for under-13s. California also requires you to treat Global Privacy Control as an opt-out and, in most cases, to show a “Do Not Sell or Share My Personal Information” or “Your Privacy Choices” link. A banner is one way to deliver this, not a legal requirement of its own.

What is at stake
$632,500

California’s privacy agency settled with Honda for this in 2025, over claims that included a privacy-choices tool that didn’t offer choices equally. Todd Snyder paid $345,178, partly because its privacy portal failed to process opt-outs for 40 days. Lawsuits are a separate risk: of six September 2026 rulings in website-tracking cases, four favoured the business and two the plaintiff.

Everywhere else

Not mapped here. Brazil, Canada and South Korea, for example, have their own privacy laws, and Builderify’s “Ask where the law requires it” mode asks their visitors first. Elsewhere the rules vary: check your local regulator, and until you have, use the EU answer as your default.

Switzerland and the EEA

Norway, Iceland and Liechtenstein are in the EEA, so treat their visitors like the EU’s. Switzerland has its own approach: its Telecommunications Act asks you to tell visitors about non-essential cookies and let them object, and the FDPIC says a yes first is needed for unexpected, high-risk or sensitive uses, such as profiling for advertising. The FDPIC factsheet sets it out.

This is general information, not legal advice. It repeats each rule in plain language and nothing more. Whether a law reaches your business depends on where your visitors are and what your site does. For a decision that costs money, ask a lawyer who works on privacy.

04 / Check your site

Do you need one?
Answer six questions.

Tell it where your visitors are and what your site loads, and it gives one answer per place with the rule behind each. It runs in your browser; nothing you tick is sent anywhere.

About your site Runs in your browser
1. Where are your visitors?

Tick every place you get traffic from.

2. How do you measure your traffic?

Pick the heaviest thing you use.

3. Do you run ads or conversion pixels?

Meta Pixel, Google Ads, TikTok, LinkedIn Insight Tag, retargeting.

4. Do you embed video, maps or social posts?

YouTube, Vimeo, Google Maps, Instagram or X posts.

5. Do other tools store an ID on every page?

Live chat that tracks visitors, personalisation, lead tracking. Tools that start only when a visitor uses them don’t count.

6. Do you collect health data, or data about children?

Medical details, or sign-ups from children.

Rules checked 28 October 2026

The answer

Yes: ask first, for visitors from the EU and the UK.

Hold the tags listed below until a visitor says yes.

EU or EEA

Ask first

Show a banner and hold the tags until a visitor says yes. “Reject all” must be as easy to reach as “Accept all”.

  • Analytics that store an ID Ask first

    Needs a yes first. France’s CNIL exempts tightly set up audience measurement, but says most large offerings don’t qualify, and other EU countries differ. CNIL

  • Advertising and conversion pixels Ask first

    Need a yes first, given by a clear action. A pre-ticked box is not consent, the Court of Justice ruled in Planet49. Court of Justice, Planet49

United Kingdom

Ask first

Show a banner and hold the tags until a visitor says yes. “Reject all” must be as easy to reach as “Accept all”.

  • Advertising and conversion pixels Ask first

    The statistics exception doesn’t cover advertising, including measuring whether an ad was seen or clicked and conversions shared with advertisers. They need a yes first. ICO

  • Analytics that store an ID Tell them, let them object

    Since 5 February 2026 plain statistics can run without a yes if you tell visitors and give them a simple, free way to object. The tool must only count and aggregate for you: no profiling, no ad measurement, and a provider that acts only as your processor. Ask first if you’re unsure. ICO

United States

Offer an opt-out

Run the tags, tell visitors, and give them an easy way to opt out of sharing for advertising, by browser signal too where the law requires it.

  • Advertising and conversion pixels Offer an opt-out

    Sharing visitor data for targeted advertising gives visitors the right to opt out wherever a state privacy law covers you. California also requires you to treat a Global Privacy Control signal as that opt-out. CalPrivacy

  • Analytics that store an ID Tell them

    State privacy laws ask for a clear privacy notice that says what you collect and use. They don’t ask for a banner, or a yes first, for analytics. Legal 500

Hold until a visitor says yes
  • Advertising and conversion pixels Meta Pixel, Google Ads, TikTok, LinkedIn
  • Analytics that store an ID Google Analytics 4 and similar

Leave running: login, cart and checkout, security, and the cookie that remembers a visitor’s choice.

In Builderify

Cookie Consent
Ask where the law requires it Smart

Opt-in for visitors in consent-first regions, opt-out for everyone else. Decided from the visitor’s time zone and, where the CDN reports it, their country; either one is enough to ask first.

Set under Rules › How consent is asked. See the steps.

The answer

Hold until a visitor says yes

Leave running: login, cart and checkout, security, and the cookie that remembers a visitor’s choice.

General information, not legal advice. It applies the rules in this guide to your answers and nothing more.

05 / What counts

Cookie banner requirements:
what makes one count?

Three things, and regulators test them the same way: nothing runs before the choice, saying no is as easy as saying yes, and nothing runs after a no. A banner that looks right but fails any of them is the one that gets fined.

The ICO runs these checks, for advertising cookies, on the UK’s top 1,000 sites, and the EU’s regulators and California’s privacy agency have acted on the same failures. You can run them yourself in two minutes, below.

Three testsWho runs them
  1. 01
    Nothing runs before the choice

    Open your site in a private window and watch the network before you touch the banner. A request to a tracking domain means a tag ran first.

    The ICO tests this on the UK’s top 1,000 sites. The CNIL fined Shein €150 million partly because advertising cookies were set as soon as visitors arrived. ICO, CNIL

  2. 02
    Reject is as easy as Accept

    Same screen, same weight, one click each. “Accept” beside “More options” isn’t a match.

    A vast majority of the authorities in the EDPB’s 2023 taskforce called a missing Reject on the first layer an infringement. California’s privacy agency settled with Honda over claims that included a privacy-choices tool that didn’t offer choices equally. EDPB, CalPrivacy

  3. 03
    Nothing runs after a no

    Click Reject all, reload, and browse a few pages with the network open. Nothing from the tags you rejected should appear.

    Shein’s “Reject all” still let new cookies through. Todd Snyder paid $345,178 partly because its privacy portal failed to process opt-outs for 40 days. In five of the six September 2026 website-tracking rulings Fisher Phillips followed, the plaintiff alleged that a Reject or opt-out button didn’t stop the tracking. CNIL, CalPrivacy, Fisher Phillips

Two-minute test

Does your banner pass?
Find out with the network tab.

A consent log shows what visitors chose. It can’t show what your tags did next, and that is the part regulators and plaintiffs test. The steps below work in Chrome and Edge.

The filter is a short list of common ad and analytics domains, so it is a quick screen, not an audit. A clean result on it doesn’t clear tools it doesn’t know. If you use Google Tag Manager, look at what it loads, not just that it loads.

Five steps About two minutes
  1. 01

    Open your site in a private window. Press F12, or Cmd+Option+I on a Mac, and open the Network tab.

  2. 02

    Paste this into the Filter box.

    /facebook|google-analytics|analytics\.google|doubleclick|googleadservices|tiktok|licdn|clarity|hotjar|bat\.bing/

  3. 03

    Reload without touching the banner. The list should stay empty. A request here means a tag ran before the choice.

  4. 04

    Click Reject all, reload, and visit two more pages. Still empty? Then a no works. A request now means the choice isn’t being respected.

  5. 05

    Open a fresh private window, click Accept all and reload. The tags you accepted should now appear. If they don’t, the banner isn’t connected to them.

Do you need a cookie policy as well?

A banner asks, and a policy tells. Where you ask for consent in the EU or UK, visitors must be told what each cookie is for, how long it lasts and whether third parties can read it, as the Court of Justice said in Planet49. The banner’s second layer or a cookie policy page is where that goes. In the US the document that matters is your privacy notice. Keep both accurate: they should match what your site really sets.

Does closing the banner count as a yes?

No. The GDPR asks for a clear affirmative action (Article 4(11)), and its recital 32 says silence, pre-ticked boxes and inactivity are not consent. A visitor who ignores or closes the banner has said nothing, so treat it as a no and keep the tags held.

06 / What is changing

Cookie banner rules are changing:
what is law, and what is a proposal?

Headlines say cookie banners are on the way out. The truth is more careful: one change is in force, one is signed, and two are proposals that don’t change what you owe today.

In force United Kingdom 5 February 2026

Plain statistics no longer need a yes

The Data (Use and Access) Act 2025 added exceptions to PECR for statistics about how your own site is used and for remembering appearance choices, as long as visitors are told and can object simply and free of charge. It also raised the maximum fine for breaking PECR from £500,000 to £17.5 million or 4% of worldwide turnover, whichever is higher. The ICO’s final guidance followed on 29 April 2026.

ICO statement The Act, Schedule 12 Final guidance

Proposed, not law United Kingdom 18 May 2026

A low-risk advertising exception is only advice so far

The ICO advised the government that regulation 6 of PECR could be changed so that certain low-risk online advertising, such as ads based on the context of the page rather than on a person’s past activity, runs without consent, while consent stays for advertising that involves intrusive tracking and profiling. In the ICO’s own words, nothing has changed at this stage: the existing rules still apply, so advertising still needs a yes today.

ICO advice Rules today

Proposed, not law European Union 21 October 2026

The Council wants fewer banners, not none

The Council of the EU agreed its position on the Digital Omnibus. Consent would stay the default for cookies, but six uses would need none: carrying a message over a network, a service the visitor asked for, anonymous audience measurement of your own site, media audience measurement, technical security, and measuring contextual ads without profiling. Refusing would take one click, and a site couldn’t ask again for the same purpose for at least four months after a refusal. It is a negotiating position: Parliament has yet to adopt its own, and the Council’s text gives countries 24 months after adoption.

Council press release Council text, ST 14756/26

Signed California 30 September 2026

One kind of lawsuit is limited. The risk is not.

From 1 January 2027, SB 690 lets only California’s Attorney General bring claims that website tracking tools are illegal “pen registers”, including pending claims filed in the two years before. Private wiretap claims aren’t touched, and the law changes who can sue, not whether the tracking is lawful, so a Reject button that doesn’t work stays a risk. From the same date, AB 566 requires browser makers to offer a setting that sends an opt-out signal. Four more states passed privacy laws in 2026 (Alabama, Louisiana, Oklahoma and Vermont), which makes 23 by the IAPP’s count.

SB 690 AB 566 IAPP on Vermont, the 23rd

What to do today: nothing here changes what you owe now except the UK statistics exception. Keep asking first in the EU and the UK, keep the opt-out in the US, and check this page again when a proposal becomes law. Last checked 28 October 2026.

07 / In Builderify

How to set up a cookie banner
in Builderify.

It holds the tags until the visitor chooses, and it keeps the proof. Cookie Consent does the asking, the holding and the logging. You decide how consent is asked and which tags wait.

  1. 01

    Pick how consent is asked

    Open the Cookie Consent widget and go to Rules, then How consent is asked. “Ask before tracking” holds everything beyond the essentials until a visitor says yes, wherever they are. “Ask where the law requires it” asks first in consent-first regions, such as the EU, UK, Switzerland, Brazil, Canada and South Korea, and lets tags run with an opt-out elsewhere. It decides from the visitor’s time zone and, where the CDN reports it, their country, and either one is enough to ask first.

  2. 02

    Connect your tags by ID

    In Connect, remove a pixel’s code from your site and paste its ID under Tracking tags instead. Thirteen tags are built in, from Google Analytics 4, Meta Pixel and TikTok Pixel to LinkedIn, Microsoft Clarity and Hotjar. Each loads only when a visitor allows the category you pick, “After Analytics” or “After Marketing”. Google Tag Manager is the exception: it loads with Consent Mode v2 already set, so the tags inside it follow each visitor’s choice.

  3. 03

    Hold the scripts you pasted yourself

    Tags already on your site can wait too, once the consent tag is first in your <head>. Change a script’s type to text/plain and name its category in data-bdf-consent, or move an embed’s src to data-src. The beta switch Block known trackers automatically holds well-known tracking services even if you pasted them yourself, and shows a click-to-load box instead of YouTube, Vimeo and Google Maps embeds. Check your site after switching it on: anything that depends on a held script waits for consent too.

  4. 04

    Make saying no as easy as saying yes

    In Banner, under “Accept & reject buttons”, “Equal weight” is the recommended style, and the default. It puts Reject all beside Accept all with the same prominence. Nothing is pre-ticked: optional categories start switched off. In Rules, a choice is remembered for 12 months unless you pick 6 or 13. Add a Cookie settings link to your footer (#cookie-settings) so a visitor can change their mind from every page.

  5. 05

    Leave the opt-out signal and the clean-up on

    In Rules, under Visitor choices, “Honour Global Privacy Control” and “Delete cookies when consent is refused” are both on by default. A visitor whose browser sends the signal has sharing for advertising switched off without a click, and the declared cookies of a refused or withdrawn category are removed, including ones another tool set before. The Global Privacy Control guide covers which states require it.

  6. 06

    Keep the proof, then test it

    Every decision is logged with its consent ID, date, choices and banner version, with the IP truncated, and kept for 24 months. Open Consent log to search by consent ID or export a CSV. The log shows what was chosen. Only the network tab shows what ran, so repeat the two-minute test from chapter 05 on your live site.

Your own analytics can wait for the answer too. User Journey has a “Wait for cookie consent” switch that records only visitors who allowed analytics, and A/B Testing can include only visitors who said yes. Using Google ads? See the Consent Mode v2 guide.

Honest limits

What it is not.

Better you read it here than find it out later.

  • Not compliance in a box

    It enforces the choice and keeps proof. What you collect, whether a UK exception applies to you, and what your policies say are still yours to decide.

  • Not a certified CMP

    It does not implement the IAB’s TCF and is not Google-certified. If you show Google ads on your own site through AdSense, Ad Manager or AdMob, Google asks for a certified one.

  • Not psychic about cookies

    The scanner sees the cookies page scripts can read. HttpOnly and third-party cookies have to be added by hand.

  • Not first unless it is first

    A tag placed above the consent tag in your head has already run. Put the consent tag first.

Consent decisions and the log, the cookie scanner and the consent tag cost 0 credits. Page loads with the widget on them cost 10 credits per 1,000, and every account gets 250 free credits a month, enough for about 25,000 page loads before any other module uses them. There is no monthly fee: one-time packs start at $9 and never expire. See the pricing page.

Start free
Questions

Cookie banners, before you ask.

Only if your site sets cookies or similar identifiers that aren't strictly necessary, such as ad pixels, analytics that store an ID, recordings or embeds that set cookies, and you have visitors from the EU or the UK. Then you must ask first and let visitors say no as easily as yes. A site that sets only what it needs to work, such as a login, a basket or a security cookie, needs no banner. In the UK, plain first-party statistics have been allowed without a yes since 5 February 2026 if visitors are told and can object simply. This is general information, not legal advice.

No federal law requires one, and state privacy laws don't require a banner as such. They ask for a clear privacy notice and an opt-out of the sale or sharing of data for targeted advertising, and most want a yes before sensitive data is used. California also requires you to honour a Global Privacy Control signal as that opt-out. A banner is one way to provide the notice and the opt-out, but one whose Reject button doesn't stop the tracking creates its own risk: in five of the six September 2026 website-tracking rulings that the law firm Fisher Phillips followed, the plaintiff alleged exactly that.

If you ask for consent in the EU or the UK, yes: visitors must be told what each cookie is for, how long it lasts and whether others can read it, and the banner's second layer or a cookie policy page is where that goes. A cookie policy alone is not consent, and a banner without that information is not valid consent. In the US the document that matters is your privacy notice. Keep both accurate, so they match what your site really sets.

Not yet. On 21 October 2026 the Council of the EU agreed its position on the Digital Omnibus, which would let six uses run without consent: carrying a message over a network, a service the visitor asked for, anonymous audience measurement of your own site, media audience measurement, technical security, and measuring contextual ads without profiling. Consent would stay the rule for everything else, refusing would take one click, and a site couldn't ask again for the same purpose for at least four months after a refusal. It is a negotiating position, not law: the European Parliament has yet to adopt its own, and the Council's text gives countries 24 months after adoption. Until a final text passes, today's rules apply.

No tool can do that alone. Cookie Consent enforces the choice: tags you connect by ID load only after the visitor allows their category, a Global Privacy Control signal is honoured, the declared cookies of a refused category are deleted, and every decision is logged for 24 months with the IP truncated. What your site sets, whether a UK exception applies to you and what your policies say are still your decisions. It is not a certified IAB TCF consent platform, so if you show Google ads on your own site through AdSense, Ad Manager or AdMob, Google asks for a certified one.

Sources

Legal facts checked on 28 October 2026. Laws change, so read the current text before you rely on a date or a figure here.

← All guides

Stop losing the visitors
you already paid for.

More leads from the traffic you already have, and follow-up that sends itself. Free to start. No card, no monthly fee.

Start free See what it does