The short version: you need a banner if your site sets cookies that aren’t strictly necessary and you have visitors in the EU or UK. You can often avoid needing one at all.
This is a practical guide, not legal advice. If real money, health data, children or a regulator’s letter is involved, talk to a lawyer.
Which cookies need consent
The rule comes from the EU’s ePrivacy Directive and the UK’s PECR, not the GDPR itself. It covers anything stored on a visitor’s device, so it includes localStorage and tracking pixels as well as cookies.
- No consent needed: keeping someone logged in, a shopping cart, security and CSRF tokens, load balancing, and remembering the consent choice itself.
- Consent needed: analytics that identify visitors, advertising and retargeting pixels, session recording, most A/B testing tools, and embedded content that sets its own cookies, such as standard YouTube embeds.
What a valid banner looks like
- Nothing non-essential loads until the visitor says yes. A banner that appears while Google Analytics is already running is the most common failure.
- Rejecting is as easy as accepting. Regulators have fined sites for burying “Reject” behind a second screen.
- No pre-ticked boxes, and scrolling doesn’t count as agreement.
- The choice is remembered, and there’s a link to change it later, usually in the footer.
How to not need one
Use analytics that don’t set cookies or identify visitors, such as Plausible, Fathom or Vercel Analytics. Self-host your fonts. Use youtube-nocookie.com for video, or a preview image that loads the player on click. With only strictly necessary cookies left, you don’t need a banner, which is why this site doesn’t have one.
Check what your site really does
What your code says and what your site does can differ: a tag manager or a chat widget can add cookies you never wrote. Open your site in a private window, click nothing, and look at DevTools, Application, Cookies. Or scan it: vibeliq opens your site in a real browser and lists every cookie and tracker that fires before consent.