What EU law says
The rule comes from article 5(3) of the EU ePrivacy Directive, which every member state wrote into its own law. It covers anything a site stores on or reads from a visitor's device: not only cookies, but also local storage, tracking pixels and fingerprinting. If that is not strictly necessary for the service the visitor asked for, you inform them and get their consent first. The GDPR sets what valid consent is: free, specific, informed and as easy to withdraw as to give. A banner is the usual way to ask.
Strictly necessary is narrow: a shopping cart, a login session, the language someone chose, the banner choice itself. Measuring how visitors use your site does not count for most regulators. What you do with the data belongs in your privacy policy; which cookies you set, in a cookie policy, like our own. Google adapts its tags to the choice with Consent Mode; what is changing there is in Consent Mode and Google Analytics. What your own site loads before anyone says yes shows in the cookie scanner.
What else a site needs beyond the banner is set out in GDPR compliant website.
Not sure what your site loads? Open it in a private window, open your browser's developer tools and look under Storage before you click anything. If a Google or Meta cookie is already there, your banner is not working, however neatly it shows two buttons. The UK rules changed in 2026, see UK cookie law, and France enforces its own reading strictly, see CNIL cookie rules.
What a regulator wants on your first screen
Rejecting must be as easy as accepting.
A banner, or measuring without cookies
The Belgian publisher Roularta was fined 50,000 euro in 2022 because cookies ran before anyone said yes and boxes were ticked in advance. The GDPR allows fines up to 20 million euro or 4 percent of worldwide turnover, though it usually starts with a complaint and an order to fix it. Set that against what a banner costs you in measurement:
| Item | With banner | Without cookies |
|---|---|---|
| Visitors a month | 2,000 | 2,000 |
| Who you measure, if half decline | 1,000 | 2,000 |
| Advertising pixels possible | yes, after consent | no |
| Risk when scripts load too early | yes | no |
| Work for every new tool | update the cookie list | none |
Half is an example; how many decline depends on your audience and your banner. If you run ads on Meta or Google and want to know what they bring in, you need a banner: see Facebook ads cost. If you only want to know how many visitors come and from where, you can do without. Fewer scripts also make your site faster; check it with the website speed test.
What is moving in Europe
The EU is negotiating a package that could make measurement without consent easier. On 21 October 2026 the Council agreed its position, Parliament has not yet; see what the EU digital omnibus means for cookies. Until a new rule applies, everything above stands. A banner is not the only rule for your site either: selling online to EU consumers, check the European Accessibility Act website requirements, and on WordPress every plugin may bring scripts of its own: see is WordPress safe.
Consent Mode and plugins
Does Google's Consent Mode replace a banner?
No. Consent Mode adapts how Google tags behave to the choice made in your banner. You still need the banner to ask for that choice.
My developer installed a cookie plugin. Am I compliant?
Not necessarily. A plugin draws a banner but does not tell you whether the site follows it. Check in a private window whether cookies are set before you choose.