Web Design
Do you actually need a cookie banner?
Many sites show one they do not need, and many show one that is not lawful. How to tell which you are.
Cookie banners are the most visible and least understood compliance item on the web. A large share of them are wrong in one of two directions: unnecessary, or unlawful.
When you do not need one
If your site sets only strictly necessary cookies — a session, a security token, a language preference, a CSRF token — you do not need consent for them. A site with no analytics, no embedded video, no map, no fonts loaded from a third party and no advertising pixels needs no banner at all. It still needs a privacy policy.
When you do need one
The moment you load anything that stores or reads information on the visitor's device beyond what is strictly necessary. In practice: analytics, YouTube or Vimeo embeds, Google Maps, chat widgets, remarketing pixels, A/B testing tools, and fonts loaded from a third-party server. In Germany this is § 25 TDDDG, and it applies regardless of whether the data is personal.
What a lawful banner looks like
- Reject is as easy as accept. One click, same prominence. A grey "Settings" link next to a large green "Accept all" does not qualify, and German courts have said so.
- Nothing loads before consent. If the analytics script fires as the banner appears, the banner is decoration.
- Granular categories, not a single yes.
- Consent is withdrawable as easily as it was given — a permanent link in the footer.
- Consent is logged: what was agreed, when, and to which version of the policy.
The simplest lawful path
Remove the need for a banner. Self-host your fonts. Use a privacy-friendly analytics tool that does not set cookies or track individuals. Load YouTube embeds only after a click. Many small business sites can get to zero non-essential cookies in a day of work, and it improves page speed at the same time.
Canada
The bar differs. PIPEDA works on meaningful consent, and Quebec's Law 25 has moved considerably closer to the European position, including for tracking technologies. If you serve both markets, building to the European standard covers both — the reverse does not.
Working on something like this?
Tell us what you are building — we reply to every enquiry.