Do I need a cookie banner?

  • cookies
  • privacy
  • gdpr
  • ccpa
  • cookie-banner

Updated

You need a cookie banner that asks for consent if your site uses non-essential cookies or trackers (analytics, ad pixels, embedded social media) and you serve visitors in the EU or UK. US law mostly works the other way: no consent banner is required, but larger businesses must let visitors opt out of having their data sold or used for targeted ads. A site with no tracking beyond what it needs to work may not need a banner at all. This isn't legal advice.

Europe and the UK: consent first

  • The EU's ePrivacy rules require consent before a site stores or reads non-essential cookies or similar data on a visitor's device. Cookies the site strictly needs to work, such as a shopping cart, are exempt. Source: ePrivacy Directive, Article 5(3).
  • The GDPR sets what valid consent means: freely given, specific, informed, and an active choice. Pre-ticked boxes and "by using this site you agree" don't count. It applies to organizations outside the EU when they offer goods or services to people in the EU or monitor their behavior. Source: GDPR, Articles 3 and 4.
  • The UK has its own similar rules. See the ICO's guide to cookies and similar technologies.

In practice: if you market to people in Europe, the tracking has to wait for their click, and regulators expect declining to be as easy as accepting.

The United States: opt-out, above a size threshold

There's no federal cookie consent law. About 20 states have comprehensive consumer privacy laws, and more take effect each year. See the IAPP's US state privacy legislation tracker for the current list.

These laws mostly share a pattern:

  • They apply above a threshold. California's CCPA, for example, covers for-profit businesses doing business in California with gross annual revenue over $26,625,000 (adjusted for inflation from $25 million), or that buy, sell, or share the personal information of 100,000 or more California residents or households, or that make half their revenue from selling it. It generally doesn't apply to nonprofits, but some other states' laws do. Sources: California Attorney General, CCPA, CPPA, updated thresholds.
  • They're opt-out, not opt-in. Covered businesses must let people opt out of the sale or sharing of their data and of targeted advertising, for example with a "Do Not Sell or Share My Personal Information" link. Ad pixels that follow visitors across sites can count as sharing.
  • Some honor browser signals. California and several other states require covered businesses to treat a browser's Global Privacy Control signal as an opt-out.

Most small businesses and nonprofits fall below these thresholds. Check each state where you have customers anyway, since thresholds differ.

Whatever the law, have a privacy policy

A privacy policy that says what you collect, why, and who you share it with is expected almost everywhere, and California's online privacy law requires one for commercial sites that collect personal information from California residents. Write it from what your site actually does: forms, analytics, newsletter signups, payments, embedded maps and videos. WordPress has a starting template under Settings → Privacy.

So, do you need one?

Your site What to do
No analytics, ads, or third-party embeds that set cookies No banner needed. Keep a privacy policy.
Analytics or ad pixels, visitors mostly in the US, below state thresholds A banner is optional. Keep a privacy policy, and consider one anyway if you use ad pixels.
Covered by a US state law Offer the required opt-out links and honor Global Privacy Control.
You market to people in the EU or UK Use a consent banner that holds tracking back until visitors accept.

If your site runs on Dirigible

  • Dirigible's GDPR Banner, under Appearance → Customize → Scripts & Embeds, holds back Google Analytics, Tag Manager, Meta Pixel, and the other tracking ID fields until a visitor accepts, and can show a decline button. Code pasted into Custom Embeds doesn't wait. See Set up a GDPR cookie consent banner.
  • Dirigible Analytics (in Dirigible Optimize) waits for consent before setting its cookie, and counts visitors who haven't accepted without storing anything on their device. See Dirigible Analytics.
  • YouTube videos load nothing from YouTube or Google until a visitor presses play. See Click-to-Load YouTube Videos.

If you sell to customers in several states, run ads with tracking pixels, or market in Europe, have a privacy lawyer confirm which laws apply before you choose a banner setup. This isn't legal advice.