If your website uses analytics, advertising, or social media tracking cookies and can be reached by visitors in the EU, the UK, California, or most other US states with a comprehensive privacy law, then yes, your website needs a cookie consent banner or an equivalent opt-out mechanism. If it uses only the cookies required to make the site function, you generally do not. Everything else is detail about which type of banner and how it has to behave.
The Deciding Factor: Essential vs. Non-Essential Cookies
Every major privacy framework draws the same line, and it is the fastest way to figure out your own obligations.
Strictly necessary cookies keep the site working: login sessions, shopping cart persistence, security tokens, load balancing. Privacy laws exempt these from consent requirements because the site cannot deliver the page the visitor asked for without them.1Your Europe. Online Privacy
Non-essential cookies are everything else. Google Analytics tags, advertising pixels, social media widgets, personalization trackers, A/B testing scripts. The moment one of these is on your site, consent obligations attach somewhere.
So the first honest question is what your site actually loads. If you run a plain brochure site with no analytics and no embeds, you likely need nothing beyond a privacy policy explaining the essential cookies you use. If you have ever pasted a tracking snippet into your site’s header, assume you need a banner and read on.
Where Your Visitors Are Changes What You Need
Cookie consent obligations follow the visitor, not the business. A site hosted in Ohio with a US-based owner is still subject to EU rules the moment an EU resident loads it, because GDPR’s Article 3 extends the law to any organization outside the EU that offers goods or services to people in the EU or monitors their behavior there.2GDPR-info.eu. Art. 3 GDPR – Territorial Scope
EU and UK Visitors: Opt-In Before Anything Fires
The EU has the strictest regime. The ePrivacy Directive prohibits storing or accessing information on a user’s device without consent, with an exception only for storage strictly necessary to provide a service the user explicitly requested.3European Data Protection Board. Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive GDPR then defines what that consent has to look like: freely given, specific, informed, unambiguous, and shown through a clear affirmative action.4European Commission. When Is Consent Valid? Pre-checked boxes, implied consent from continued scrolling, and language buried inside terms of service all fail.
You also have to be able to prove consent later. Controllers must demonstrate that a user agreed, which in practice means keeping a log of when and how each visitor’s consent was captured.5GDPR-info.eu. Art. 7 GDPR – Conditions for Consent “We had a banner” is not proof.
California Visitors: Opt-Out and a Do-Not-Sell Link
California takes a different approach. The CCPA, as amended by the CPRA, lets businesses set cookies first and then gives users the ability to opt out afterward. It applies to for-profit businesses that do business in California and meet one of three thresholds: gross annual revenue over $25 million, buying or selling the personal information of 100,000 or more California consumers or households, or deriving 50% or more of annual revenue from selling personal information.6State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA)
If your business hits any of those thresholds, you must display a “Do Not Sell or Share My Personal Information” link and must honor Global Privacy Control signals, which are browser-level opt-out preferences the California Attorney General has confirmed count as valid opt-out requests.7State of California – Department of Justice – Office of the Attorney General. Global Privacy Control (GPC)
The opt-out model flips to opt-in for minors. Users between 13 and 15 must affirmatively authorize any sale or sharing of their data, and for children under 13 a parent or guardian must do so. Consumers of any age also have the right to limit how a business uses sensitive personal information, a category that includes Social Security numbers, financial credentials, precise geolocation, biometric data, health information, and genetic data.8California Privacy Protection Agency. What Is Personal Information?
Other US States
By 2026, roughly 20 US states had comprehensive consumer privacy laws in effect, including Virginia, Colorado, Connecticut, Texas, and Indiana. Most follow the Virginia model: an opt-out approach for targeted advertising and data sales rather than EU-style upfront opt-in. Virginia’s Consumer Data Protection Act, for example, requires controllers that sell personal data or process it for targeted advertising to disclose that clearly and give consumers a way to opt out, and it defines “targeted advertising” as ads selected based on personal data gathered from a consumer’s activity across different websites over time. That definition captures most third-party ad cookies.9Virginia Code Commission. Virginia Code Title 59.1 Chapter 53 – Consumer Data Protection Act
The Practical Test
Put the two axes together and you get a straightforward answer for most sites.
- Only strictly necessary cookies: no banner required. Describe them in your privacy policy.
- Analytics, ads, or social tracking, plus any EU or UK visitors: opt-in banner that blocks non-essential cookies until the visitor agrees.
- Analytics, ads, or social tracking, plus California visitors and CCPA thresholds met: a “Do Not Sell or Share” link and GPC signal handling. No need to block cookies at page load, but the opt-out must actually work.
- Global traffic: the safest route is an EU-style opt-in, since meeting the strictest standard covers the others.
Any site running Google Analytics, display ads, or embedded social widgets falls into this bucket. That is most commercial websites.
What a Compliant Banner Has to Do
Having a banner and having a compliant banner are not the same thing. Regulators have fined companies whose banners existed but failed the standard. The elements a banner needs are consistent across frameworks.
It has to explain, in plain language, what cookies your site uses, what each category does, and who operates them, particularly third parties.1Your Europe. Online Privacy
It has to capture a positive act. Under GDPR, consent means clicking “Accept,” toggling a switch, or checking an unchecked box. Scrolling or continuing to browse does not count.4European Commission. When Is Consent Valid?
It has to offer real granular choice. Users need to be able to accept analytics but reject advertising if they want, not just an all-or-nothing button.1Your Europe. Online Privacy
It has to make “Reject All” as prominent and easy to click as “Accept All.” Burying reject behind extra clicks, or styling it smaller and grayer, is one of the most heavily enforced compliance failures.
It has to let people change their minds later. Withdrawing consent must be as easy as giving it, which in practice means a persistent settings icon or footer link that reopens the preferences panel.10Information Commissioner’s Office. What Is Valid Consent
Finally, under EU law, non-essential cookies must not fire before consent. The banner appearing while tracking scripts have already loaded in the background is where many implementations quietly fail.
Designs That Void Consent Even If You Have a Banner
Regulators have specifically targeted manipulative banner designs. Under California’s CPRA, a dark pattern is a user interface designed to subvert or impair a user’s decision-making, and any agreement obtained through one does not count as valid consent.
The patterns drawing enforcement are predictable: a bright green “Accept” next to small gray “Reject” text, confusing double negatives, five clicks to reject versus one to accept, and cookie walls that block the whole site unless the visitor agrees to everything. The European Data Protection Board’s guidance holds that users must have a fair alternative to accepting non-essential cookies. France’s data protection authority fined Google €150 million and Facebook €60 million specifically because rejecting cookies required more steps than accepting them.
The safest layout is “Accept All” and “Reject All” side by side with identical styling, with a third option for granular preferences.
What Non-Compliance Costs
Fines under GDPR can reach €20 million or 4% of global annual turnover, whichever is higher, for the most serious violations, and up to €10 million or 2% of turnover for lesser ones.11GDPR-info.eu. Fines and Penalties Cookie-specific enforcement has hit Google (€150 million), Microsoft (€60 million), Amazon (€35 million), and TikTok (€5 million), among others.
CCPA penalties are smaller per violation but scale by the number of consumers affected. The California Privacy Protection Agency can impose fines of up to $2,663 per unintentional violation and $7,988 per intentional violation or per violation involving a minor’s data, adjusted for inflation as of January 1, 2025 and recalculated every two years.12California Privacy Protection Agency. 2025 Increases for CCPA Civil Penalties A violation touching 50,000 consumers can compound into serious exposure. Sephora’s $1.2 million settlement in 2022 was the first public CCPA enforcement action, in part for failing to honor Global Privacy Control signals.
Most state privacy laws outside California do not create a private right of action, so enforcement comes from state attorneys general rather than individual lawsuits. A single investigation can cover an entire company’s practices.
Browser Cookie Blocking Doesn’t Get You Off the Hook
Safari and Firefox have blocked third-party cookies by default for years. Chrome shifted from a universal phase-out to a user-choice model, rolling out Privacy Sandbox APIs alongside traditional cookies.
None of that changes your legal obligation. If your site attempts to set non-essential cookies, you still need a consent mechanism even when some browsers block those cookies on their end. First-party analytics cookies, which browsers generally do not block, remain fully subject to consent under GDPR and the ePrivacy Directive. Cookie consent is a legal requirement, not a technical one, and no browser update makes it disappear.