Cookie Banners, Done Properly

The cookie banner is the most-seen and least-loved element on the European web. It is also, on most small business sites, wrong — not through bad intent, but because it was installed as a plugin and never checked against what it is supposed to do.

What consent actually has to be

Under the GDPR, consent must be freely given, specific, informed and unambiguous. Translated into a banner, that means four concrete things.

It has to be a real choice. Refusing must be as easy as accepting. One click to accept, one click to reject, both visible without scrolling, both looking equally like buttons. The pattern of a bright "Accept all" next to a grey text link saying "Manage preferences" is the single most common violation in Europe, and the Dutch DPA has said so plainly.

Nothing may fire before the choice. This is the part plugins get wrong most often. If your analytics script is in the page head, it has already loaded, set an identifier and sent a request before the banner rendered. The banner is then decoration on top of a decision already made.

It has to be specific. One box for "analytics", one for "marketing" — not a single switch labelled "cookies" that covers everything.

Withdrawing must be as easy as giving. There has to be a way to change your mind later. A small link in the footer is enough; having no way at all is not.

Two more things that follow from the same rules: pre-ticked boxes are not consent, and neither is continuing to scroll. Silence is not agreement.

What does not need consent

This is the part that saves you the most work, and it is widely misunderstood.

Strictly necessary cookies do not need consent. That means the ones without which the service cannot work: a session identifier so a logged-in user stays logged in, a shopping basket, a security token that prevents form abuse, a load balancer cookie, and — pleasingly — the cookie that remembers the visitor's cookie choice.

You still have to be transparent about them in your privacy statement. You just do not have to ask permission.

What does need consent: analytics, advertising and remarketing tags, embedded video that sets tracking cookies, social media widgets, heatmaps and session recorders, and A/B testing tools.

The best banner is a smaller one

Here is the thing almost nobody tells you: the amount of banner you need is determined by how much tracking you do. Reduce the tracking and the problem shrinks.

Most small business websites run three or four third-party scripts, and if you ask why each one is there, the honest answer for at least half is "it came with the theme" or "we set it up years ago and never look at it".

There is a well-trodden route out. Privacy-friendly, cookieless analytics tools measure page views, referrers and rough geography without identifying individuals or storing anything on the device. Several are designed specifically so that no consent is required. Swap to one of those, drop the tags you do not read, self-host your fonts, and replace the auto-loading video embed with a click-to-load thumbnail, and a surprising number of small sites end up needing no consent banner at all.

That is a better outcome than a compliant banner. It is faster, it is less annoying, and — the part that persuades most owners — your analytics stop being a sample of only the people who clicked accept. If 40 percent of visitors refuse, your numbers were never real.

Since June 2025, the banner must also be accessible

The European Accessibility Act now applies to the banner like everything else on the page. In practice:

• Every control reachable by keyboard, in a sensible order.
• A visible focus indicator on each one.
• Announced properly to a screen reader, with the dialog role and label it needs.
• Focus moved into the banner when it appears and returned sensibly when it closes.
• Text contrast meeting 4.5 to 1 — including that grey "Reject" link, which usually does not.

A great many banners fail these, and that includes some sold specifically as compliance products. Worth testing yours with the Tab key for thirty seconds.

How to check yours in five minutes

1. Open your site in a fresh private window. Do not click anything.
2. Open the developer tools network tab and reload.
3. Look at what has already been requested. Anything going to a third party before you consented is a problem.
4. Now look at the banner itself: can you reject in one click, from the first screen?
5. Press Tab a few times. Can you reach and activate both buttons without a mouse?
6. Find the way to change your choice later. If there is not one, that is the next job.

The honest summary

A cookie banner is not a compliance product you install; it is the visible part of a decision about how much you track. Most sites can shrink that decision until the banner is small, honest and rarely resented — or gone entirely.

If you do need one, the rules are not complicated: ask before you act, make refusal as easy as acceptance, be specific, and let people change their mind. Everything else is dark patterns, and those are exactly what the regulators are looking at.

This is a practical guide, not legal advice. In the Netherlands, cookies fall under both the AVG and the Telecommunicatiewet; check the Autoriteit Persoonsgegevens guidance for your situation.