Most consent banners on small business websites are decorative. They appear, the visitor clicks accept, and the tracking scripts that were already running carry on running. That arrangement provides no protection and irritates every visitor.
This is a summary for site owners rather than legal advice, and the rules differ by country. If you are unsure where you stand, ask somebody qualified.
Whether you need one at all
The trigger is not having a website. It is storing or reading anything on the visitor's device that is not strictly necessary to deliver what they asked for.
- A brochure site with no analytics and no embeds usually needs no banner.
- Anything with analytics, advertising pixels or embedded video normally does, for visitors in the EU and UK.
- Strictly necessary cookies - a session, a cart, a security token - do not require consent, but should still be explained in your privacy page.
Which of those apply depends on what you have switched on, and the tags a published site can load are listed in analytics dashboard.
What a working banner actually does
The critical part is the order of operations. Nothing non-essential may load until the visitor has said yes.
A banner that fires the tracker on page load and then asks permission has already done the thing it needed permission for. That is the single most common implementation error, and it is the one an auditor looks for first.
The other requirements are unglamorous: refusing must be as easy as accepting, the choice must be remembered, and there must be a way to change it later.
Sites published here default to denied
The published-site analytics integration registers tags as loaders rather than running them inline, and sets the consent state to denied by default. Nothing is granted until a visitor accepts, at which point the state is updated and the tag loads.
That is the arrangement you want, but it only covers the tags added through the platform. Anything you paste into a custom code block runs on your terms, not the platform's, so an embedded map, chat widget or pixel added that way is yours to gate.
Do not collect what you do not use
The cheapest compliance strategy is having less to consent to. Most small sites run several tags nobody has looked at in a year: an old advertising pixel, a second analytics tool, a heat-map trial.
Removing them makes the banner simpler, the site faster (see website speed for small business owners), and the privacy page shorter. It is worth doing before writing a word of policy.
Write the privacy page in plain language
It should say what you collect, why, who else sees it, how long you keep it and how somebody asks for their data. Customers rarely read it, but regulators and prospective business clients do, and the exercise usually reveals a tag you had forgotten.
Data requests from customers of a published site are handled through the flow described in customer data requests.
FAQ
Does a small local business really need a cookie banner?
If the site loads analytics or third-party embeds and receives EU or UK visitors, yes. If it loads neither, usually not.
Is "by using this site you accept cookies" enough?
No. Implied consent of that kind has not been sufficient in the EU or UK for years. Consent must be an affirmative action.
Can I make rejecting harder than accepting?
No, and doing so is one of the patterns regulators have specifically acted against. The two choices should be equally easy.
Do I need consent for a contact form?
Not for processing the enquiry itself, which is the service the visitor asked for. You do need to say what you do with the data afterwards.
What about analytics that claims to be cookieless?
It may reduce the obligation, but "cookieless" does not automatically mean "no consent needed" - it depends on what is stored or read on the device. Check the specific tool rather than the marketing copy.