Skip to content
← Home
Discuss your task

Blog · · 9 min read

Cookie banner for a small business website in the EU: when you need one, what it must offer and the usual mistakes

Whether you need a cookie banner under the GDPR comes down to one question: does your site store or read anything on the visitor's device that it doesn't strictly need in order to work? A visit counter and an advertising pixel do. A basket cookie in a shop does not. If you run the first two, the cookie consent banner has to hold them back until the visitor clicks, offer "reject" as plainly as "accept", and let people change their mind later. If everything on your site is strictly necessary, there is nothing to ask consent for.

What the rule says

The rule behind the banner is Article 5(3) of the ePrivacy Directive. The European Data Protection Board reads it as covering any storing of information on a visitor's device, or reading of what is already stored there, and it applies to pixels and other "similar technologies", not only cookies. Both are allowed with the visitor's consent, or when they are strictly necessary to provide a service the visitor asked for. Consent here means the GDPR kind: a clear, affirmative act, freely given, specific and informed. Each country put the directive into its own law and regulators differ on details, so check your case with a lawyer where you operate.

Which parts of your site need consent

What the site doesConsent needed?Why
Keeps a basket or a login session in a shopUsually noFalls under the exemption for what a service the visitor asked for strictly needs, such as a functioning website
Remembers the visitor's banner choiceUsually noThe EDPB taskforce report recalls an older opinion that cookies holding a user's preferences about a service count as essential
Visit counter or analytics toolYes, in most casesThe exemption is narrow and most large products fall outside it
Advertising pixels and conversion tagsYesThe EDPB's 2024 guidelines apply Article 5(3) to tracking pixels
Embedded video, map, booking widgetCheck each oneIf it sets or reads anything beyond what the widget needs to run, treat it as a yes

The analytics row is where small sites get caught. The French regulator, the CNIL, does exempt a narrow kind of audience measurement: one site only, no matching with other data, a shortened IP address, trackers kept for at most 13 months. It also says that most large analytics products fall outside the exemption, however you configure them. So for a mainstream tool, plan on asking for consent, and look at what the provider says about your country.

If you are weighing up a free booking system for a small business, ask what its widget loads on your page, not only what it does.

The most useful short read is the 2023 report of the EDPB's cookie banner taskforce, which records what the national authorities agreed on. In plain terms:

  • Nothing that needs consent is set or loaded until the visitor clicks. Silence and inactivity are not consent.
  • The reject option sits on the same layer as accept. A vast majority of the authorities in the taskforce saw a first screen with "accept" and "settings" but no reject as an infringement.
  • Boxes for categories start unticked.
  • Reject is easy to see. If the only alternative to accept is a refusal link buried in a paragraph of text, with no visual support to draw attention to it, it does not pass. Neither does a reject button whose label is practically unreadable against its background. The authorities did not set a colour standard; they judge each banner on its own.
  • The visitor can keep browsing without accepting. The page is not locked behind the banner.
  • Withdrawing is as easy as agreeing. The report suggests a small permanent icon or a link placed in a visible, standard place.
  • "Legitimate interest" is not a back door around the click for cookies.

Where small sites usually slip

The banner is real and the scripts ignore it. The counter is pasted straight into the page template, the banner is a plugin, and nothing connects the two. A visitor clicks reject and the counter loads anyway. Whether a banner plugin on WordPress or a site builder actually holds the counter back is a setting you have to test, and the test below takes ten minutes.

The second slip is the pile-up. A pixel from a campaign that ended two years ago, a heat-map trial somebody forgot, a map on the contact page. Each one is one more line the banner has to list correctly and one more thing you must be able to explain.

Then there is the banner text copied from another site. It names services you don't use and misses the ones you do. The same taskforce report notes controllers labelling cookies "essential" that were not strictly necessary, and it discusses the owner's responsibility to keep a list of cookies and show why each one is essential if an authority asks.

Last, the choice that isn't remembered. The visitor rejects, opens the next page, and the banner comes back. The answer itself has to live on the visitor's device, usually as a small cookie or local-storage entry set by the banner tool. The preferences opinion mentioned in the table is why the answer itself is normally not the issue. Ask your banner provider what it stores, and keep your privacy policy in line with that.

How to see what your site loads before consent

  1. Open your site in a private window and do not touch the banner.
  2. Open the browser's developer tools (F12 on most systems, Cmd+Option+I on a Mac) and go to the Network tab. Reload the page.
  3. Group or sort the requests by domain. Your own domain is fine. Look for analytics, advertising and social domains. The Application tab in Chrome, or Storage in Firefox, shows the cookies and local storage that were set.
  4. Click reject, reload, and look again. The list should be the same as in step 3, with nothing extra.
  5. Open a fresh private window, click accept, and look once more. The extra requests should appear only now.

Cookie scanners exist, but the taskforce report points out that such tools only list what was placed and cannot judge its nature. You still have to know why each item is there.

An example: a flower shop in Gdańsk

Take the Florysta demo from our portfolio, a flower shop in Gdańsk. The site is in Polish. A visitor picks a bouquet size, chooses a two-hour delivery window, types a card message and sees it previewed, and later follows the order from collected to delivered.

DELKIND work, demo data. Florysta, a flower shop in Gdańsk; the site is in Polish.

Everything in that list is the shop doing its job. The banner question starts when the owner adds a visit counter to see which bouquets get looked at, and an advertising pixel to see which Instagram post brought the orders. Those two additions are exactly the rows in the table that ask for consent. The shop can run them behind a proper click, or leave them out and have nothing to ask for. You can open the Florysta demo and click through it yourself.

What to do today

  1. Run the five-step test above on your own site and write down what loads before the click.
  2. List every outside service on the site next to the name of the person who reads its numbers. If nobody reads them, remove the service.
  3. Click reject in a fresh private window and repeat the test. If anything from the list reappears, fix that first.
  4. Check that a "Cookie settings" link in the footer reopens the choices and that withdrawing takes about as many clicks as accepting did.
  5. Read what your privacy policy says about the counter and the pixels, compare it with your list from step 2, and take the gaps to a lawyer.

If you'd rather we do it for you

If you don't have a site yet, or the current one is a pile of pixels nobody remembers adding, we build landing pages from €380 in 3–7 days and company websites from €580 in 2–3 weeks. Prices exclude VAT. We work with AI tools, and experienced specialists work faster with them, which is why our prices are lower than those of studios and agencies.

In the price: design around your brand, a call before we start, copy written for you and sent for your review, a layout checked separately on phone and laptop, SEO basics, a visit counter and the pixels of your ad accounts connected, requests delivered to WhatsApp, email, a spreadsheet or your CRM, publishing on your domain, and free revisions until you accept. Code, domain and access are registered in your name. A consent banner is not named in that list, so raise it on the call: what is included is written down, with the price and timeline, before we start.

Tell us on WhatsApp what you run today, and read more about our websites and landing pages. For context on prices, see what a landing page costs in 2026.

Discuss your task

Sources

← All articles