Do I need a cookie banner on my website? A plain-English answer

You need a cookie banner if your site uses analytics, ad pixels or other tracking tools and people from the EU or the UK visit it. There, those tools must wait until the visitor agrees. If your site only uses cookies it needs to work, such as a login or a shopping cart, you usually don't need to ask for them. This is not legal advice. The check below shows in ten minutes what your site actually uses.

What a cookie banner is for

A cookie is a small note a website saves in the visitor's browser. Some notes are needed for the site to work: they keep you logged in or remember what's in your cart. Others are there to follow what you do: which pages you read, which ad brought you, whether you came back.

In the EU, the rule is that the second kind needs the visitor's permission first. The EU's official business guide, Your Europe, says some cookies need consent before you use them, and names tracking cookies from social media buttons and cookies used for advertising as examples. Cookies that are strictly necessary for something the visitor asked for, such as a login or a form, don't need it.

The same rule covers similar tricks that aren't technically cookies, like small invisible images that report a visit. So "we don't use cookies" isn't always the end of the question.

A banner is simply the way to ask. It's not a decoration you add to look professional. If it doesn't actually stop the tracking until someone clicks Accept, it doesn't do its job.

Three questions that decide it

1. Who visits your site? The strictest rules are in the EU and the UK. The UK has its own, similar rules, and its regulator, the ICO, explains them in its guidance on cookies and similar technologies. Other countries have their own privacy laws. If you sell to people abroad or your site is open to everyone, assume some visitors are from the EU.

2. What does your site load? This is the question most owners can't answer, because tools get added along the way. A typical list:

• visitor statistics, such as Google Analytics;
• ad tracking, such as the Meta Pixel or a TikTok pixel;
• recordings of how people move around the page, such as Hotjar;
• a chat bubble, an embedded video or a map from another company.

The first three are there to follow visitors and normally need consent. Widgets from other companies often bring their own cookies too.

3. If you have a banner, does it work? Many sites built quickly have a banner that shows up and remembers the click, but the tracking starts before anyone clicks. That's the same as having no banner, plus a promise you don't keep.

If your answer to question 2 is "only what the site needs to work", you probably don't need a banner. You still need to explain your cookies in your privacy policy.

Check what your site uses in 10 minutes

You don't need any technical tools for this. A computer with Chrome is enough.

1. Open a private window. In Chrome that's "New Incognito window". It starts with no cookies, like a first-time visitor.
2. Open your site by typing its real address. Don't click anything on the page, and don't touch the banner if there is one.
3. Click the icon to the left of the address. It looks like two small sliders or a padlock. Choose "Cookies and site data", then "Manage on-device site data".
4. Read the list. It shows every website that saved something in your browser while your page loaded. Your own domain is expected. Names like google-analytics.com, googletagmanager.com, facebook.com, hotjar.com or doubleclick.net mean tracking tools are already running.
5. Write down the names and whether you had clicked anything. If you have a banner, those names appeared before you said yes.
6. Ask whoever built the site what tools they added. Compare their answer with your list. A tool on your list that nobody remembers adding is worth asking about.
7. Look at your footer. Is there a link to a privacy policy? It's where you tell visitors what you collect, and payment providers often check for it too.

If step 4 shows only your own domain and you haven't added any statistics or ad tools, you're probably in the "no banner needed" group. If it shows tracking names before any click, you have something to fix. Developers can find the technical steps in our guide to making Google Analytics wait for consent.

What to ask your developer or AI tool

If a developer or an AI tool such as Lovable, Cursor or Replit runs your site, send this message. Fill in the brackets from your notes.

I'm not technical. My site is [your address].

When I open it in a private window without clicking anything,
these sites store data in my browser: [names from your list].

Please:
1. Tell me in plain language every tool on the site that tracks
   visitors (statistics, ads, recordings, chat, videos, maps).
2. If any of them need consent, add a cookie banner with equal
   "Accept" and "Reject" choices, and make those tools load only
   after the visitor clicks Accept.
3. Keep the site working for visitors who click Reject.
4. Add a link to a privacy policy in the footer that lists these
   tools.
5. Tell me how I can check that nothing tracks before Accept.

A ready-made banner service or plugin is usually easier than a banner built from scratch, because it connects to the common tools for you. Whoever sets it up still needs to switch on the part that blocks scripts before consent. Showing the banner alone doesn't block anything.

When the change is done, repeat the check above. The list should show only your own domain until you click Accept, and the tracking names should appear after.

What exactly your banner has to say, and whether your business has extra duties, depends on your country and what you do with the data. For that, ask a lawyer or your local data protection authority.

Keep it working after changes

Banners break quietly. Someone adds a new chat widget, connects an ad account or copies a tracking snippet from a tutorial, and the new tool loads before consent. Nothing on the page looks different.

The free check at ScanYourSite looks at your site the way a first-time visitor sees it, before anyone clicks. It needs no sign-up: enter your address, or open https://scanyoursite.app/?check=yourdomain.com with your own domain in it. It reports:

• analytics or ad trackers running with no recognised consent tool on the page;
• cookies your server sets on the very first visit while no consent tool is there;
• a missing link to a privacy policy or terms;
• which trackers it saw, so you know what your privacy policy has to mention.

It doesn't click Accept, and it doesn't check cookies that scripts set later in the visit, so the browser check above is still worth doing once. It's a technical check, not legal advice.

A free account watches one site: a check every week and a weekly email summary, with three findings explained with fixes. Pro ($19 a month, three sites) checks every day and tells you as soon as a check finds trackers running without a consent tool.