Disclosure: Some links are sponsored. We may earn a commission if you sign up or buy through them, at no extra cost to you. This is general information, not legal advice.
Last reviewed: by the Smart Savings Guides editorial team. How we research and update articles.
Not legal advice: this is a plain-English summary to help you ask the right questions. Which laws apply depends on where you and your visitors are, what data you collect and how big your business is. For anything high-stakes, talk to a lawyer licensed where you operate.
Quick answer
- EU and UK visitors + non-essential cookies = consent first. Analytics, advertising and many social or video embeds typically need opt-in consent before they run.
- Strictly necessary cookies don't need consent, such as a shopping cart, login session or load balancing. You should still mention them in your privacy or cookie policy.
- US-only sites have no general federal cookie-consent law, but some state laws (including the CCPA for businesses it covers) require ways to opt out of the "sale" or "sharing" of data, which can include ad cookies.
Where the EU rule comes from
The EU ePrivacy Directive (Article 5(3)) requires consent to store or read information on a user's device unless it's strictly necessary for a service the user asked for. GDPR then sets what counts as valid consent: freely given, specific, informed and unambiguous. In the 2019 Planet49 case, the EU Court of Justice ruled that a pre-ticked box is not valid consent. The UK has similar rules under PECR, enforced by the Information Commissioner's Office, and the UK has been adjusting some exemptions, so check the ICO's current guidance.
What a good banner does
- Blocks non-essential scripts until the visitor agrees.
- Makes "Reject" as easy as "Accept". European regulators have criticized banners that hide the reject option.
- Lets people choose by category and change their mind later (a link in the footer works).
- Links to a cookie policy listing what's used and why.
- Keeps a record of consent.
Do you need one at all?
Make a list of everything your site loads: analytics, ad pixels, chat widgets, embedded videos and maps, fonts from third-party servers. If none of it sets non-essential cookies or similar trackers, you may not need a banner. That's why some small sites choose cookie-free analytics, or no analytics at all.
If you run Google ads or analytics for European visitors, Google also requires consent signals (Consent Mode) for some features in the EEA and UK.
Options
Many website builders include a basic banner. Consent management platforms (CMPs) such as Termly, CookieYes and Cookiebot scan your site, categorize cookies and block scripts until consent, and most have free tiers with limits on traffic or features.
Sources
Official sources this article relies on, checked October 15, 2026. Rules and prices change, so confirm details at the source.
A consent banner with a free tier: Termly
We may earn a commission if you buy through these links, at no extra cost to you. This is a sponsored link.
Termly walks you through a questionnaire and builds a privacy policy (plus cookie, terms and other policies on paid plans) from your answers. Its free plan covers one basic policy and a cookie consent banner with up to 10,000 banner views a month. Paid plans are billed per website and add more policies, editing and automatic updates when laws change. Termly offers a 30-day money-back guarantee on paid plans.
Opens Termly's privacy policy generator. The free plan covers one basic policy; paid plans are listed on Termly's Pricing page (Starter from $10 and Pro+ from $15 per website a month, billed annually, checked October 15, 2026). A generator only reflects your answers and isn't legal advice.
The honest catch: a generator only describes what you tell it, so the policy is only as accurate as your answers, and it isn't a lawyer reviewing your business. Free alternatives exist too; see our generator vs lawyer guide. Our Termly partner link is set up for readers in the US. If you're outside the US, you can go to Termly's website directly.
Using Google Analytics? See what Google requires in your privacy policy, including Consent Mode v2.
More guides
- How to Start a Small Business Website, Step by Step
- Does My Website Need a Privacy Policy? GDPR, CCPA and CalOPPA Explained
- Terms of Service Basics for Small Business Websites
- Small Business Website Legal Checklist
- Privacy Policy Generator vs Lawyer: Which Do You Need?
- Termly Review: What the Free Plan Covers, Pros and Cons
- Does GDPR Apply to a US Small Business?
- Does a Shopify Store Need a Privacy Policy?
- Google Analytics and Your Privacy Policy: What Google Requires