Cookie banners: how to do them without ruining the site
When a website needs a consent banner, what a lawful and tolerable one looks like, and how to need less of it.
The short answer
A cookie banner exists to obtain consent before a site stores or reads non-essential information on a visitor’s device: analytics cookies, marketing identifiers, embedded third-party trackers. A site that does none of that needs no banner. The best way to improve a banner, therefore, is to need less of it: analytics that work without cookies, fonts served from your own domain, video and map embeds that load only when clicked, and no marketing tags until the visitor agrees. Many business sites could remove their banner entirely by changing what they load, and most could shrink it to a single, honest choice. Where a banner is needed, it must offer reject as prominently and easily as accept, load nothing non-essential until consent is given, remember the choice and let the visitor change it later. Banners that block the page, pre-tick boxes or hide the reject option are not only irritating; regulators across Europe have fined sites for them.
What needs consent and what does not
| What the site does | Consent needed? | Alternative that removes the need |
|---|---|---|
| Session cookie for a logged-in area | No; strictly necessary | None needed |
| Remembering the consent choice itself | No | None needed |
| Cookie-based analytics with identifiers | Yes | Cookieless, aggregate analytics |
| Real-user performance monitoring without identifiers | Generally no, if configured without storing identifiers | Keep it that way |
| Marketing and advertising tags | Yes | Load only after consent, or not at all |
| Third-party fonts | No cookie, but a data transfer to cover | Self-host |
| Video and map embeds from third parties | Often yes, because they set cookies | Load on click with a placeholder |
| Chat widgets | Usually yes | Load on interaction; or offer email and phone |
| A/B testing with identifiers | Yes | Server-side or cookieless approaches |
Making the banner small or gone
- Inventory every cookie and script the site sets or loads, in a private window, before consent.
- Replace cookie-based analytics with a cookieless service.
- Self-host fonts and any other static third-party resources.
- Gate embeds behind a click: a placeholder image with a play button that loads the third party only when chosen.
- Move marketing tags behind consent through the consent tool, and verify in the browser that they wait.
- Re-inventory: if nothing non-essential remains before consent, remove the banner and update the privacy statement.
- If a banner remains, make it honest: equal reject and accept, categories explained, choice remembered and revisitable, no page blocking.
Designing a banner people can live with
Small, at the bottom or as a compact card, not a wall. One sentence saying what is asked and why. Two equal buttons: accept and reject, with a link to choose by category. No page blocking, no countdown, no nudging colours. Remembered for a sensible period. Revisitable from the footer. And honest: if the site only needs analytics consent, the banner asks only for that.
What this means for you
Need less consent and the banner shrinks or disappears: cookieless analytics, self-hosted resources, click-to-load embeds and marketing tags that genuinely wait. Where a banner remains, make reject as easy as accept, load nothing non-essential first, remember the choice and let visitors change it. Verify it in the browser, because a banner that controls nothing is a promise the site is breaking on every visit.
Frequently asked questions
Does every website need a cookie banner?
No. The obligation is to obtain consent before storing or reading non-essential information on a visitor's device, such as analytics or marketing cookies. A site that uses only strictly necessary cookies, such as a session for a logged-in area or a consent preference, and cookieless analytics needs no banner, only an honest privacy statement. Many business sites could remove their banner entirely by changing what they load.
What makes a banner lawful?
Consent that is freely given, specific, informed and unambiguous: reject as prominent and easy as accept, no pre-ticked boxes, nothing non-essential loaded until the visitor agrees, the choice remembered and changeable later, and clear information about what each category does. Regulators in several European countries have fined sites for banners that make rejecting harder than accepting, so the design is a compliance matter, not only a courtesy.
How do we know what our banner is actually controlling?
Open the site in a private window with the browser's developer tools showing storage and network, before touching the banner. Anything set or loaded at that point is happening without consent. Then reject, and check again. Then accept, and check what appears. The test turns up scripts firing before consent, which means the banner is decoration. The test takes five minutes and should be repeated after any change to tags.
Sources
- Autoriteit Persoonsgegevens: Cookies (accessed 2026-09-12)
- European Data Protection Board: Guidelines 05/2020 on consent under Regulation 2016/679 (accessed 2026-09-12)