Do I need cookie consent on my website?

The short version

• If EU or UK rules apply to you (you offer services to people there or track their behavior, not just an occasional visit): ask before any cookie, pixel or similar tracking that isn’t strictly necessary.
• Strictly necessary covers things like a shopping basket, a login or security. Those don’t need consent, but you still explain them.
• UK only, since 2025: analytics used only to improve your own site, and remembering a visitor’s settings, no longer need consent. You must explain them and offer an easy way to object.
• Advertising never fits an exception. Ad pixels and remarketing need consent in the EU and UK.
• US visitors: most state laws want an opt-out from selling, sharing and targeted ads, not a consent banner.

This isn’t legal advice. Rules differ by country and change often.

How do I work out whether I need consent?

Diagram: the EU and UK opt-in model next to the US state opt-out model, simplified. Based on ICO, EDPB, California, Colorado and Connecticut guidance (October 2026). Not legal advice.

Step 1: Do people in the EU or UK use your site?

The European Commission says EU law can cover a business outside the EU. That happens when it offers goods or services to people in the EU or monitors their behavior. A local service business that never serves Europe is in a different spot. A shop that ships there, takes bookings from tourists or runs ads aimed at Europe is not. Your analytics country report gives a rough idea of where visitors come from.

Step 2: List everything that stores or reads data on a visitor’s device

Cookie rules aren’t just about cookies. The EDPB’s guidelines on the technical scope of the EU rule treat tracking pixels and tracking links as covered too. That’s version 2.0, from October 2024. On a typical small business site, look for:

• analytics (Google Analytics, Microsoft Clarity, stats plugins);
• ad tags (Meta pixel, Google Ads, LinkedIn);
• embeds (YouTube, Google Maps, social feeds, booking and chat widgets);
• the site’s own cookies (logins, shopping basket, form security).

Step 3: Sort each item

The UK column comes from the ICO’s list of exceptions. The ICO is clear that the analytics exception only fits when the sole purpose is improving your site. If the same data also feeds ads, you need consent. An outside analytics provider only fits if it works for you alone and doesn’t use the data for itself.

The EU column is a general picture; each EU country’s regulator applies the rule. France’s CNIL, for example, exempts audience measurement only when it’s for the site’s own use, produces anonymous statistics, isn’t combined or shared with others and doesn’t track people across sites. Standard ad-linked analytics setups usually don’t meet those conditions.

Step 4: If anything needs consent, set up a real banner

Under the ICO’s consent guidance:

1. Nothing that needs consent loads before the visitor chooses.
2. Refusing is as easy as accepting.
3. Optional categories are off by default.
4. People can change their mind later as easily as they agreed.

Our guide to accessible consent banners covers the design, and Google Consent Mode v2 covers passing the choice to Google tags.

Step 5: For US visitors, check the opt-out rules

Most US state privacy laws, such as the CCPA, let people opt out of the sale or sharing of their data. They don’t require consent first. If one applies to you and you run ad tracking, you’ll need an opt-out link and to honor Global Privacy Control. See which US state privacy laws apply.

Why does it matter?

Google’s own policy requires consent for European visitors where the law requires it, and Microsoft Clarity now enforces consent signals for European traffic. A banner that doesn’t actually block tags can also make your analytics wrong: it records visitors who said no.

What are the common mistakes?

• A banner that’s just a notice. “By using this site you accept cookies” isn’t consent. The ICO says continuing to use a site doesn’t count.
• Tags firing before the choice. Check by opening the site in a private window and looking at cookies before you click anything.
• No Reject button on the first screen. The EDPB’s taskforce report recorded that most European regulators see that as invalid.
• Calling analytics “essential.” It isn’t strictly necessary. In the UK it may fit the new exception, but only with notice and a way to object.
• Asking again on every visit. The ICO suggests waiting around six months after a refusal before asking again.

What if I’m still not sure?

• Mostly local US customers, no ad tracking: a banner may not be required, but an accurate policy is. Consider measuring with fewer cookies.
• Any ad pixels, and EU or UK rules apply to you: you need consent before they load.
• Serving many countries, or health, finance or children’s data: ask a privacy lawyer.

How much does it cost, and how long does it take?

Many consent tools offer a free tier for small sites; limits and prices vary by vendor. Setting one up and testing it takes a few hours for a typical site. Many embeds take longer.

How does E-3 handle this?

We don’t decide which laws apply to you. As part of website care, we can list what sets cookies on your site and remove what nobody uses. We can also install a consent tool that holds tags back until a visitor chooses. We can test it in a private browser window, and you decide whether it goes live.

Related questions

• How do I make a cookie banner accessible?
• What is Google Consent Mode v2?
• Can I measure my website with fewer cookies?
• What is Global Privacy Control?
• Back to the complete privacy and cookies guide

Sources

1. What are the exceptions? (ICO storage and access technologies guidance)
2. Guidance on the use of storage and access technologies (ICO)
3. How do we manage consent in practice? (ICO)
4. Guidelines 2/2023 on the technical scope of Art. 5(3) of the ePrivacy Directive, version 2.0 (EDPB, October 2024)
5. Report of the work undertaken by the Cookie Banner Taskforce (EDPB, January 2023)
6. Who does the data protection law apply to? (European Commission)
7. Cookies: solutions pour les outils de mesure d'audience (CNIL)
8. California Consumer Privacy Act (CCPA) (California Attorney General)