Do I need a cookie banner? Check your site's tools

When is a cookie banner legally required?

In the EU, the rule comes from Article 5(3) of the ePrivacy Directive (2002/58/EC), implemented in each member state's law: storing information on a user's device, or reading it, requires the user's consent unless it is strictly necessary to provide a service the user explicitly requested. GDPR then defines what valid consent is — freely given, specific, informed, unambiguous, and as easy to withdraw as to give. The Court of Justice confirmed in Planet49 (2019) that pre-ticked boxes don't count, and regulators such as France's CNIL have fined major sites for making "Reject" harder than "Accept". In the UK the equivalent is PECR regulation 6, as amended by the Data (Use and Access) Act 2025.

How to use the checker

1. 1.Tick where your visitors are. If you have any EU traffic, the EU rules apply to those visitors regardless of where your company is.
2. 2.Tick every tool that runs on your site. Not sure? Open your site in a private window, then DevTools → Application → Cookies and Local Storage, and the Network tab: every third-party domain that loads before you click anything is a candidate.
3. 3.Read the per-tool verdicts and fixes. Many "consent likely needed" items can be reconfigured — click-to-load embeds, chat that loads on click, self-hosted fonts — so they no longer need a banner.
4. 4.If anything still needs consent, use a consent tool that blocks those scripts until opt-in and offers Reject as prominently as Accept.

Three example setups

• SaaS marketing site with GA4, Meta Pixel and an Intercom widget: banner required. GA4 and the pixel need opt-in; Intercom should load on click.
• Indie product with cookieless analytics, Stripe Checkout and self-hosted fonts: no banner likely needed for analytics. Keep a privacy policy naming the analytics vendor and Stripe.
• UK-only blog with first-party cookie analytics: under the 2026 UK exemption, a clear notice and an easy opt-out can replace the consent banner — but the moment you add ads or serve EU visitors, the stricter rules come back.

Common cookie-consent mistakes

• Loading tags before consent. A banner that appears while GA4 and the pixel have already fired doesn't make them compliant.
• No equal Reject button. Burying Reject in a second layer is the most-fined dark pattern in the EU.
• Treating Consent Mode as consent. Google Consent Mode adjusts tag behavior based on the user's choice; you still need the banner that collects it.
• Calling analytics "strictly necessary". Regulators have consistently said it isn't, outside narrow national exemptions.
• Assuming cookieless means no GDPR. The IP address and user-agent are personal data while they're processed; you still need a privacy policy and a DPA.
• Forgetting embeds. A single YouTube video on the homepage can be the only reason a site needs a banner.

Analytics without a cookie banner

If analytics is the only thing forcing a banner on your site, a cookieless tool removes it. VisitTrack's cookieless mode stores and reads nothing on the visitor's device: it derives a daily-rotating visitor ID from a one-way hash of the site, IP and user-agent with a salt that changes every day, and never stores the IP. The trade-off is that a visitor returning after 24 hours counts as new. A hybrid mode applies this only to EU, UK and Swiss visitors and uses a first-party ID elsewhere. VisitTrack's own docs are explicit that standard (cookie) mode should be loaded after consent in the EU. See also cookieless tracking in the glossary and how it compares with Google Analytics.