Cookie consent under ePrivacy: when a banner is required and how to avoid one

Cookie consent is the permission a website must obtain before it stores or reads non-essential information on a visitor's device. The rule comes from Article 5(3) of the ePrivacy Directive (2002/58/EC, as amended by Directive 2009/136/EC), implemented in each EU country's national law and, in the United Kingdom, in the Privacy and Electronic Communications Regulations (PECR). The standard for valid consent is taken from GDPR.

The rule covers any storage or access on the device, not only cookies: local storage, tracking pixels, SDKs and device fingerprinting are treated the same way. This guide is general information, not legal advice.

The two exemptions

Consent is not needed where the storage or access is either for the sole purpose of carrying out the transmission of a communication over a network, or strictly necessary to provide a service the user has explicitly requested. In practice, the second exemption covers the cookies that make a site work as the visitor expects. It does not cover things that are useful to the business but not to the visitor's request, such as measuring traffic or retargeting.

What usually needs consent and what does not

When you do need a banner: what makes consent valid

• Nothing non-essential is set or read before the visitor chooses.
• Refusing is as easy as accepting; regulators, including the European Data Protection Board's cookie banner taskforce in its 2023 report, have objected to banners with no reject option on the first layer.
• No pre-ticked boxes; under the Court of Justice's Planet49 judgment (2019), pre-ticked consent is not valid.
• Choices are specific: visitors can accept analytics but refuse advertising, for example.
• The banner names the purposes and the third parties involved, in plain language.
• Withdrawing consent is as easy as giving it, through a link available on every page.
• Consent is recorded so you can show what was agreed and when.
• Access to the site is not made conditional on accepting tracking; the EDPB's consent guidelines state that such cookie walls do not produce valid consent.

How to run a site without a banner

If your site uses only strictly necessary storage, you need no consent banner. You still have to explain those cookies, usually in the privacy notice. For many business websites, removing the non-essential items costs little:

• Replace cookie-based analytics with server-side log analysis or a tool configured not to store anything on the device. Check the rules in each country you target before assuming an exemption.
• Host fonts on your own server instead of loading them from a third party. A German regional court in Munich ruled in 2022 that passing visitors' IP addresses to Google through remotely loaded fonts, without consent, breached GDPR.
• Use click-to-load for maps and videos: show a static image with a notice, and load the embed only when the visitor clicks.
• Link to your social profiles rather than embedding feeds or share buttons that load third-party scripts.
• Avoid advertising pixels unless you actively run campaigns that need them.
• Review plugins and themes; some add tracking without saying so.

Our own sites use no advertising or analytics cookies, so they do not need consent for tracking.

A ten-minute audit

1. Open your site in a private browser window.
2. Open the browser's developer tools and look at the storage panel for cookies and local storage.
3. Note each cookie's name and domain; third-party domains are the first suspects.
4. Check the network panel for requests to analytics, advertising or social domains on page load.
5. For each item, decide: strictly necessary, replace, load on click, or remove.
6. Repeat after any new plugin, embed or marketing tool is added.

The trade-off

Going banner-free means accepting less detailed visitor data and giving up retargeting audiences. For a business that gets most enquiries from search, referrals and direct contact, that is often a reasonable price for a cleaner site and less compliance work. A business that relies on paid social campaigns may genuinely need tracking pixels; in that case, implement a proper consent tool rather than a banner that only looks compliant. Whichever route you choose, make sure your privacy notice matches what the site actually does.

We build websites with no default tracking, so many clients need no banner at all. The wider data protection picture is in our GDPR basics for business websites.

Questions and answers