Cookie Banners and Analytics Consent: The Basics

Almost every website now greets visitors with a cookie banner, and many of them are implemented badly: they appear but do nothing, or they claim to ask for permission while tracking scripts have already run. This article explains the basics in plain language so you can set one up sensibly. It is general information, not legal advice; rules differ between countries, so confirm your obligations with a qualified professional.

What the rules are about

In the European Union, the ePrivacy rules (implemented nationally) require that storing or reading information on a visitor's device, which includes cookies and similar technologies such as local storage or tracking pixels, needs the user's consent, unless it is strictly necessary to provide the service they requested. Separately, data protection law (GDPR) governs how you handle personal data that those tools collect. The UK has comparable rules. Regulators in different countries interpret details differently, so treat this as a starting point.

Which cookies need consent

Category	Examples	Consent usually needed?
Strictly necessary	Shopping cart, login session, security tokens, remembering the consent choice itself	No, but you should still inform people
Preferences	Language or layout choice that the user did not directly ask to save	Often yes; depends on the case
Analytics	Visit counting, behaviour reports	Generally yes, though some authorities accept narrow, privacy-friendly setups; check local guidance
Marketing	Advertising pixels, retargeting, social tracking	Yes

Do not guess. Find out what your site actually sets by checking the browser's developer tools or using a scanning tool, then classify each item.

What a good banner does

1. Blocks first, then loads. Analytics and marketing tags must not run until the visitor agrees. A banner that merely announces cookies while scripts load anyway is decoration.
2. Gives a real choice. Accept and reject should be equally easy to find and use. Hiding "reject" behind several clicks, or making it grey and tiny, is widely criticised by regulators.
3. Explains in plain language. State the purposes, not just "to improve your experience", and link to your cookie and privacy information.
4. Offers granularity. Let people choose by category rather than all or nothing.
5. Remembers the choice, and lets people change it later via a visible link in the footer.
6. Does not nag. Respect a refusal for a sensible period instead of asking on every page.

Keep a record

You may need to show that someone consented. Good consent tools store the time, the choices and the version of the banner text shown. If you build your own, record at least the same basics. Review it whenever you add a new tag, because each tool may add cookies in a new category.

Getting analytics right

You have a few approaches, and the best depends on your market and risk tolerance:

• Consent-based standard analytics: tags load after the visitor accepts. Your data will not include people who decline, so numbers will be lower than real traffic.
• Cookieless or privacy-focused analytics: some tools avoid cookies and personal identifiers. Whether they need consent depends on how they work and on local guidance, so read their documentation and your regulator's position, rather than assuming.
• Server-side counts: your hosting logs record requests without scripts. They are rough but useful for sanity checks.

Whatever you choose, list it in your privacy policy. Our article on analytics for beginners explains what to measure once it is running.

Common mistakes

• Tags in the theme or a plugin that fire before the banner loads.
• Marketing pixels added through a tag manager that ignore the consent state.
• Embedded videos or maps that set cookies on page load; use click-to-load placeholders instead.
• A banner that covers the content on mobile and cannot be dismissed.
• Pre-ticked boxes for optional categories.
• Copying the banner from another site without checking that your cookies match its text.

Test it yourself

Open the site in a private browser window. Before touching the banner, open the developer tools, look at cookies and network requests, and check whether analytics or advertising calls already happen. Then reject all and reload: nothing optional should load. Then accept and confirm the tags start. Test again on mobile. Repeat after each plugin update, since updates sometimes change behaviour.

Legal pages and policy alignment

The banner is only one part of the picture. Your cookie policy and privacy policy must match what the site does, and your legal pages should be linked from the banner. If your team uses marketing tools, make sure they know that adding a tag means updating consent settings and documentation. Our general guide to legal pages every website needs covers the surrounding documents.

Host where you control the setup

Because consent depends on exactly which scripts your site loads, it helps to run it on hosting where you control the configuration. Zebra Hosting provides Plesk on every hosting plan, free SSL and a team that answers questions in 17 languages. Visit the knowledgebase for setup help, and remember that your obligations as a site operator remain yours to confirm with a professional adviser; the security page covers the technical protections around your data.