Does My Business Need a Cookie Banner?
A plain-language breakdown of when cookie consent banners are legally required, based on where your visitors are and what your site actually does.
If you’re asking this question, you’ve probably noticed a cookie banner on someone else’s site and wondered whether you’re supposed to have one too. The short answer: probably, if you have any visitors from the EU, UK, or a growing list of US states, and you use analytics, ads, or embedded third-party content.
The longer answer depends on three things: where your visitors are located, what your site does with their data, and which specific cookies your site sets. Here’s how to work through it.
Start with where your traffic comes from
Cookie consent law is triggered by the visitor’s location, not your business’s. If any meaningful share of your traffic comes from the following regions, you’re in scope for a consent mechanism:
- European Union / EEA — ePrivacy Directive plus GDPR. Consent must be opt-in, specific, and as easy to reject as to accept.
- United Kingdom — UK GDPR and PECR, functionally similar to the EU rules.
- California, and a growing set of other US states — CCPA/CPRA and similar state laws require a way to opt out of the “sale” or “sharing” of personal data, which most analytics and ad cookies count as.
If you have zero visitors from these regions today, you’re lower-risk, but most small businesses underestimate how quickly they pick up traffic from somewhere they didn’t intend to serve.
Then look at what your site actually sets
Not all cookies require consent. A rough breakdown:
| Cookie type | Typical examples | Consent required? |
|---|---|---|
| Strictly necessary | Session/login, cart contents, security | No |
| Analytics | Google Analytics, Plausible (in some configs) | Usually yes |
| Advertising / retargeting | Meta Pixel, Google Ads remarketing | Yes |
| Embedded third-party content | YouTube embeds, some chat widgets | Often yes |
A purely brochure-style site with no analytics and no embeds may not need a banner at all. Add a single Google Analytics snippet or a Facebook pixel, and you’ve crossed the line for EU/UK visitors.
What “having a cookie banner” actually requires
A compliant banner isn’t just a popup with an “Accept” button. Regulators have penalized sites for:
- Not offering an equally easy “Reject” option next to “Accept.”
- Loading analytics or ad scripts before the visitor makes a choice.
- Pre-ticking consent checkboxes.
- Making it hard to withdraw consent later.
This is where a dedicated consent management platform earns its keep — it blocks scripts until consent is given, logs the consent event for your records, and gives visitors an easy way to change their mind.
Enzuzo
For most small and mid-size sites, Enzuzo is the fastest way to get a compliant banner running correctly — including script-blocking before consent, which is the part most DIY banners get wrong.
The practical checklist
- List every third-party script running on your site (analytics, ads, chat, embeds).
- Confirm whether you have EU, UK, or relevant US-state traffic in your analytics.
- If yes to any tracking + relevant traffic, install a consent banner that blocks scripts until consent is given.
- Make “Reject” as easy to find as “Accept.”
- Keep a record of consent events in case you’re asked to demonstrate compliance.
If you’re still unsure, treat “probably yes” as the safe default — the cost of a properly configured banner is far lower than the cost of a complaint or fine.
This guide is educational and not legal advice. For your specific situation, consult a privacy attorney.