Cookie consent that holds up – legally and practically

The cookie banner has become the web’s most disliked box – and at the same time, one of the most common reasons a site breaks the rules without the company knowing it. The problem is rarely bad intent, but a banner the agency set up once that nobody has reviewed since. Here’s a look at what actually requires consent, how the banner must behave, and how you keep useful analytics even when a large share of visitors say no.

Necessary versus tracking cookies

All cookie handling starts with a split. Necessary cookies are required for the site to function: keeping you logged in, remembering what’s in the cart, or balancing load between servers. These don’t require consent, since the visitor has actively asked for the service they enable.

Tracking and analytics cookies are a different matter. They measure behavior, build audiences for ads, or recognize you across visits. They aren’t necessary for the site to function – they serve the company, not the visitor’s immediate need – and therefore require active, informed consent before they can be set.

The line isn’t always obvious, and a common mistake is classifying convenience features or analytics as “necessary” to avoid asking. Take the visitor’s perspective: would the service have worked without the cookie? Then it’s probably not necessary in the legal sense. A rule of thumb that holds up: if the cookie exists so you can learn something about the visitor, rather than so the visitor can do something, it requires consent.

How the banner must behave

A valid cookie banner follows a few principles that are easy to state and easy to violate by accident.

• Just as easy to decline as to accept. The buttons should have equivalent placement and visibility. A prominent “Accept all” next to a tucked-away decline link doesn’t hold up.
• No default yes. Boxes for non-essential cookies must be unchecked from the start – consent has to be an active action.
• No scripts before consent. Tracking scripts may load only after the visitor has said yes. If they load at page load, the consent is meaningless.
• The ability to change their mind. The visitor should be able to withdraw their choice as easily as it was given, for example via a link in the footer.
• Choice per category. Statistics and marketing should be selectable separately, not just as an all-or-nothing toggle.

A simple test: click around your own site as a visitor would. Is it faster to say yes than no? Do any cookies get set before you’ve had a chance to answer? If the answer to either question is yes, the banner needs adjusting.

Keep measuring without relying on consent

The uncomfortable truth is that a correctly built banner often leads to a large share of visitors declining – and then the numbers in classic analytics tools become thin and skewed. The answer isn’t to make it harder to say no, but to move part of the measurement away from cookies.

Server-based, cookie-free measurement collects aggregated statistics on the server side instead of in the visitor’s browser. You see traffic, popular pages, and trends without identifying individuals, and this kind of aggregated measurement generally doesn’t require consent. The combination is powerful: cookie-based analytics for the visitors who say yes, and a cookie-free foundation that covers everyone. Always check the specific setup against the data protection rules, but the principle substantially lowers your dependence on third-party data.

The point is that compliant cookie handling and useful analytics aren’t opposites. Most sites can have both – it just requires designing the measurement for a world where many visitors say no, instead of assuming everyone says yes.

Getting started

Start with an inventory: which cookies does your site set today, and why? Many are surprised by how many third-party scripts have crept in via plugins and tools. If you want help making your measurement cookie-free and your banner compliant, our services look at the whole picture, from technology to compliance. Feel free to get in touch with your current setup, and we’ll give you an assessment.