Nearly every website has a cookie banner. A surprising proportion of them provide no legal protection whatsoever, because they ask for permission after already doing the thing they are asking permission for.
Cookie consent is one of those areas where the appearance of compliance and actual compliance diverge sharply, and the gap is easy to test.
The test that reveals it
Open your own site in a private window. Before clicking anything on the banner, open your browser's developer tools and look at the Network tab or the stored cookies.
If analytics, advertising or tracking scripts have already loaded, your banner is decorative. You have notified people about tracking that was already happening.
Consent means asking first. A banner that appears while the tracking runs behind it is a notice, not a consent mechanism.
This single test fails on a large share of small business websites, usually because the banner was installed as a separate plugin from the analytics, and nobody connected them.
What actually needs consent
Not everything. The distinction matters because over-asking annoys visitors for no benefit.
Essential cookies need no consent. Session cookies keeping someone logged in, the shopping cart, security tokens, and the cookie recording their consent choice. These are necessary to deliver a service the visitor asked for.
Everything else needs consent before it loads: analytics, advertising and remarketing pixels, social media embeds that track, heatmaps and session recording, and A/B testing tools.
Analytics is the one people argue about. In most European jurisdictions, standard analytics does require consent. Some regulators take a softer line on genuinely anonymised, first-party analytics — but assume consent is needed unless you have specific advice otherwise.
What a compliant banner does
Blocks non-essential scripts until consent is given. This is the part that matters most and the part most often missing
Makes rejecting as easy as accepting. A prominent "Accept all" beside a buried "Manage preferences" is a recognised dark pattern and regulators have acted on it
Uses unticked boxes by default. Pre-ticked consent is not consent
Offers granular choice by category — analytics, marketing, functional
Allows withdrawal as easily as it was given, via a persistent link
Records what was consented to and when, because you may need to evidence it
Does not block the content entirely until a choice is made, in most interpretations
Why implementations fail
Three recurring causes, all fixable.
The banner and the tracking are separate systems. A consent plugin was installed, and the analytics code sits directly in the theme header where the banner has no ability to stop it. The banner records a choice that changes nothing.
Tag manager loads regardless. The container fires on page load and everything inside it runs. Consent needs to gate the tags, not just exist alongside them.
Third-party embeds ignore it. An embedded video or map sets cookies the moment the page renders, entirely outside your consent system. These need blocking until consent, with a placeholder in their place.
Doing it properly
Audit what actually sets cookies. Load your site with tools open and list everything. Most people find services they had forgotten
Categorise each one as essential or not
Choose a consent tool that genuinely blocks scripts — this is the deciding feature, not the design
Route everything through it, including tag manager and hardcoded snippets
Handle third-party embeds with placeholders
Add a persistent link so people can change their mind
Test in a private window and confirm nothing loads before consent
Retest after any site change, because new plugins add new tracking
Step seven is the one that tells you whether the previous six worked.
The awkward part: your data will change
Worth being straight about this, because it surprises people and prompts them to undo the work.
When tracking genuinely waits for consent, your analytics numbers drop. Depending on your audience, somewhere between 10% and 50% of visitors will decline, and those sessions disappear from your reports.
Your traffic has not fallen. Your measurement has become accurate about what you are permitted to measure.
Two sensible responses: mark the date in your analytics so you do not misread the drop as a traffic collapse, and consider server-side or privacy-preserving measurement for aggregate figures that do not depend on consent.
What good looks like commercially
A well-implemented banner is small, clear, and quick to dismiss either way. Sites with genuinely easy rejection often see higher acceptance rates than sites using dark patterns, because the interaction feels honest rather than adversarial.
Making it hard to decline buys you inflated consent rates, a worse first impression, and regulatory exposure.
Where this sits in the bigger picture
Cookie consent is one component of broader obligations. It sits alongside an accurate privacy policy naming your third parties, sensible data retention, and the technical security measures required to protect the data you hold.
Our guides to GDPR website compliance and PDPL compliance cover the wider picture — including the point most checklists omit, that you are also required to be able to detect a breach within days.
If you want to know where you stand
The private-window test takes two minutes and gives you a definitive answer about your own site. If scripts load before consent, that is worth fixing regardless of how the banner looks.
We handle the technical side of this — implementing consent that genuinely blocks scripts, auditing what your site actually loads, and securing the data you collect. Send us your web address and we will tell you what is firing before anyone clicks anything.
Get Shielded
We build, host, secure and monitor business websites — cleaning up hacks and keeping sites online for clients across the UK, USA, Australia and the UAE.
