Do I Actually Need a Cookie Banner on My Website?

Nearly every small business website has one: a grey box at the bottom of the screen asking visitors to accept cookies, with a second button that is usually smaller and harder to find. Most owners did not choose it. It arrived with the website template, or the agency added it in the last week of the build, or a customer mentioned they'd seen one somewhere and it felt safer to have it. Nobody has looked at it since.

The honest answer to whether you need one is: it depends entirely on what your website stores on a visitor's device, and almost nobody has ever told you what your website stores on a visitor's device. That is the gap this post is trying to close. I am not a solicitor and this is not legal advice — if you handle sensitive data or operate at scale, get a professional to look at it. But you can understand the shape of the question in about ten minutes, and that is usually enough to know whether you have a problem or just a habit.

A cookie is a small text file that a website asks your browser to keep. The next time you visit, the browser hands it back. That is the whole mechanism. It is how a shopping basket remembers what you put in it when you navigate to a different page, and how a site remembers you ticked "keep me logged in".

Cookies are not inherently sinister. The reason they became a legal matter is that the same mechanism works across websites. An advertising network with code on ten thousand sites can drop a cookie on your device at site one and read it at site two thousand, building a picture of where you have been. That is the behaviour the rules were written to address — persistent identification of a person across time and across sites, for purposes they did not ask for.

The important thing for you is this: the law in the UK and EU is not really about cookies as such. It is about storing or reading information on someone's device. A cookie is the most common way to do that, but local storage, device fingerprinting and a few other techniques count too. Renaming the technique does not change the obligation, which is why "we don't use cookies, we use local storage" is not the clever escape hatch some tools imply it is.

The general position in the UK and EU is that you need informed consent before you store or read information on a visitor's device. Consent means a genuine choice, made before the storage happens, with refusing being as easy as accepting. A banner that only offers "Accept" and loads everything regardless is worse than no banner, because it documents that you knew and proceeded anyway.

The exception is the one that matters for most small sites. Storage that is strictly necessary for a service the visitor actively asked for does not require consent. A shopping basket on an online shop qualifies. A login session qualifies. A cookie that remembers the visitor already dismissed the banner qualifies. Note the wording: necessary for the thing the visitor asked for, not necessary for your marketing. Analytics has historically not been treated as strictly necessary, which is why Google Analytics on a site aimed at UK or EU visitors is generally understood to need consent. If you are weighing that up, our comparison with Google Analytics goes into what changes when you move off it.

There is a second regime worth knowing about: rules in parts of the United States, California being the best-known, lean more towards giving people a way to opt out of their data being sold or shared, rather than requiring a tick before anything happens. If you sell internationally, the two approaches sit side by side. We keep a plain-English summary in the GDPR and CCPA notes.

This is the part most owners skip, and it is the only part that gives you a real answer. Your website is almost certainly loading things from other companies, and each of those is a potential piece of storage on your visitor's device that you are responsible for.

The usual culprits on a small business site, roughly in order of how often I see them:

You do not need a developer for this. Open your website in Chrome, press F12 to bring up the developer tools panel, click the Application tab, and look at the Cookies list on the left. It will show you every cookie set, which company set it, and when it expires. A cookie that expires in two years was not set to help someone finish a booking.

Do this twice: once before clicking anything on your consent banner, and once after. If the list before you consent is identical to the list after, your banner is decorative. It is asking permission for something that already happened. That is the single most common failure I see on small business sites, and it is worse than having no banner at all, because the banner makes a claim about your behaviour that is not true.

While you are in there, note how many of those cookies you recognise as serving a purpose you still care about. The dormant chat widget and the pixel from the campaign you stopped running are pure liability — storage you are accountable for, generating no value. Deleting them is the fastest consent work you will ever do.

There is a second route, and it is the one we took. If your analytics never stores anything on the visitor's device and never collects data that identifies a person, the consent question largely falls away for that piece of the puzzle. Instead of giving each visitor a persistent identifier to carry around, the measurement works out whether two page views belong to the same visit using information the browser sends anyway, combined into a one-way hash that cannot be reversed into a person and is rotated so it does not persist across days. We describe the mechanism in more detail in how session identification works without cookies and the broader approach in privacy-first analytics.

I want to be straight about what you lose, because the industry tends not to be. You lose reliable returning-visitor counts over long periods. If someone reads your blog in March and comes back to book in June, cookieless measurement will see two separate visitors, not one person on a long journey. You lose cross-device stitching entirely — the customer who browses on their phone at lunch and books on a laptop that evening is two people in your numbers. And you lose long attribution windows, the ability to say definitively that a visit in week one caused a sale in week six.

What you keep is most of what actually drives decisions: how many people came, which pages they landed on, where they came from, which pages they left from, how far down they scrolled, and which of them completed the thing you wanted them to complete. For a bakery, a solicitor or a plumber, that is the entire useful set. The lost precision is mostly precision you were never going to act on.

Here is something rarely mentioned by the companies selling consent tools. A banner does not just annoy people. It punches a hole in your data. Everyone who ignores it, dismisses it, or declines simply does not appear in your analytics at all.

Across the small sites I have seen, the share of visitors who actively accept tends to land somewhere in the broad region of half to three-quarters, and it varies enormously with how the banner is designed and what kind of audience you have. Treat that as a rough impression rather than a figure to quote. The point stands regardless: a meaningful slice of your traffic is invisible, and it is not a random slice. People who decline skew towards the more privacy-conscious, which in some trades correlates with exactly the customers you most want to understand.

So you end up making decisions from partial data, while also showing every visitor a box that gets between them and your content on the first screen they see. If you were never going to use the behavioural targeting that the cookies enable, you have paid both costs and collected neither benefit. That trade is worth examining before you accept it as permanent — and if the question is simply whether cookieless measurement is affordable for a business your size, the pricing page answers it in about twenty seconds.

Start by removing what you no longer use. The expired advertising pixel, the chat widget nobody answers, the review plugin from a platform you left. Each one removed is one less thing to disclose, one less thing to slow your pages down.

Next, look at what remains and sort it into two piles: things the visitor is actively asking for, and things that serve you. Embedded video and maps usually sit in an awkward middle — the visitor did come to see where you are, but the embed hands data to a third party as a side effect. Many platforms now offer a click-to-load version that shows a static image until the visitor chooses to interact. That is often the cleanest resolution.

Then choose your analytics deliberately rather than inheriting it. If your measurement tool does not store anything on devices and does not collect personal data, you may find the remaining list is short enough that your banner requirement changes shape considerably. And if you are excluding your own visits from the numbers along the way, IP exclusion handles that without needing a cookie to remember who you are.

Finally, if you do still need a banner, make it honest. Load nothing before the choice is made, make declining as easy as accepting, and say in plain words what each category does. A banner that works properly is a smaller imposition than one that lies politely.

Crafty Meerkat is website analytics with a built-in AI advisor: it measures without storing anything on your visitors' devices, and once a week it sends you a short, ranked list of specific things worth changing on your site, with the numbers behind each one. No banner required for the analytics itself, and no dashboard full of metrics you have to interpret alone.

If you would like to see what your own site's numbers look like under that approach — and what the weekly advice actually says, rather than what a marketing page claims it says — book a demo. We will walk through a real account, show you exactly what is and is not collected, and you can judge whether the trade-offs described above are ones you are happy to make.