Yes, you need a cookie consent banner if, on the devices of EU or UK visitors, your site stores or reads anything that is not strictly necessary or otherwise exempt. The UK exempts some statistics and appearance cookies. The ePrivacy Directive and the UK Privacy and Electronic Communications Regulations (PECR) require consent before a site stores or reads information on a device. The General Data Protection Regulation (GDPR) sets what counts as consent: a clear action by the visitor, after clear information. A notice that only announces tracking does not meet that standard, so the site needs a tool to ask first and hold the optional scripts until the answer.

TermsFeed Free Cookie Consent is a free consent banner script that asks first. It shows the consent banner to every visitor, because it has no location rules.

The consent rule comes from the ePrivacy Directive in the EU and from PECR in the UK, and both cover any storage on the device, not only cookies. Article 5(3) of the ePrivacy Directive allows storing or reading information on a device only where the user consents after clear and comprehensive information. The rule covers localStorage, sessionStorage, and scripts that read data already stored on the device. A tracking script that does not set cookies still needs consent when it stores or reads something.

The GDPR decides what valid consent is. Article 4(11) and Article 7 of the GDPR require consent that is freely given, specific, informed, and unambiguous, given by a clear affirmative action. Article 7(3) requires withdrawal to be as easy as giving consent, and Recital 32 states that silence, pre-ticked boxes, or inactivity is not consent. The GDPR reaches a site outside the EU that offers goods or services to people in the EU or monitors their behavior there, according to Article 3(2).

The requirement differs by region for a site that runs analytics or advertising scripts.

Region Law What the law asks for storage that is not strictly necessary
EU and the European Economic Area (EEA) ePrivacy Directive, Article 5(3), as each country applies it, with the GDPR for the meaning of consent Consent before the storage, with clear information first
United Kingdom PECR, regulation 6, with the UK GDPR for the meaning of consent Consent before the storage, except where an exception applies, such as the statistics and appearance exceptions under their conditions
Switzerland Telecommunications Act, Article 45c, and the Federal Act on Data Protection (FADP) Clear information and a way to refuse, with consent first where the processing is high-risk or unexpected
United States State privacy laws, such as the California Consumer Privacy Act (CCPA) A way to opt out of the sale or sharing of personal data and of targeted advertising, in the states with such a law

The UK exceptions for statistics and appearance

The UK lets a site run some analytics without consent, under conditions that most third-party analytics setups do not meet. Schedule 12 of the Data (Use and Access) Act 2025 added 3 exceptions to PECR, in force since 5 February 2026. The 3 exceptions cover statistics that improve a service, a look adapted to what the visitor prefers, and emergency assistance. The statistics exception requires clear information, a simple and free way to object, aggregate figures only, and no advertising use, according to the ICO guidance on the exceptions.

Read the conditions before you leave an analytics tool untagged for UK visitors. A provider that uses the data for its own purposes, or links it to advertising, takes the tool outside the exception. An analytics tool left untagged runs before consent for EU visitors as well.

Switzerland and the right to refuse

Swiss law asks you to tell visitors about cookies and let them refuse, and asks for consent first only in higher-risk cases. The Federal Data Protection and Information Commissioner (FDPIC) reads Article 45c of the Telecommunications Act that way in its guidelines on data processing using cookies. Compare the Swiss rules with the GDPR in GDPR and Switzerland. In express mode, Cookie Consent asks for consent before optional tagged scripts run, which is stricter than the Swiss rule. Google requires a certified consent platform for personalized ads to Swiss visitors. Read the requirement in Google AdSense and the IAB TCF before you show Google ads there.

US state privacy laws

The US has no federal law that requires a cookie consent banner, and the state privacy laws mostly ask for an opt-out instead of consent first. A state with a comprehensive privacy law gives residents the right to opt out of the sale or sharing of their personal data. California requires businesses to honor opt-out preference signals such as Global Privacy Control (GPC), a browser signal that tells the site the visitor opts out. The California law applies only above thresholds, such as an annual revenue of $26.625 million or buying, selling, or sharing the personal information of 100,000 California residents or households. Read the opt-out and GPC rules in The California Privacy Rights Act (CPRA).

Cookie Consent does not offer a "Do Not Sell or Share" link and ignores the GPC signal. A US site that falls under a state law handles the opt-out link and the GPC signal outside Cookie Consent.

Storage that is strictly necessary for a service the visitor asked for needs no consent, and Cookie Consent runs scripts tagged strictly-necessary on every page. Article 5(3) of the ePrivacy Directive exempts storage used only to transmit a communication and storage strictly necessary to provide a service the user explicitly requested. The Article 29 Working Party Opinion 04/2012 on cookie consent exemption, adopted on 7 June 2012, gives the examples the EU regulators still cite.

The opinion names these exempt uses, each for a limited lifetime.

  • Login cookies that keep a visitor signed in, for the duration of a session.
  • Shopping cart and form cookies that keep what the visitor entered while moving between pages.
  • Security cookies that detect abuse of a login, such as repeated failed attempts.
  • Load balancing cookies that send each request of a visit to the same server.
  • Language and display preference cookies that the visitor sets by choosing an option, for a session or a little longer.

The same opinion states that first-party analytics cookies are not exempt. It adds that third-party advertising cookies are never exempt, including for frequency capping, click fraud detection, and other operational uses.

Cookie Consent writes 3 first-party cookies that record the answer, and needs them to stop asking on every page. The French data protection authority (CNIL) lists trackers that keep the choice a user makes about trackers as exempt, in paragraph 49 of its guidelines on cookies and other trackers. The ICO gives cookies that remember the cookie preferences a user sets as an example of the strictly necessary exception, in its guidance on the exceptions. Find the names and contents of the 3 cookies in the 3 cookies Cookie Consent writes.

Analytics, advertising, and most embedded services need consent, and each goes into one of the 4 Cookie Consent categories. Common tools take the category of the purpose they usually serve on a site.

The category is the purpose the visitor agrees to, so pick it from what the tool does with the data on your site.

Tool What it stores or reads Category
Google Analytics 4, Microsoft Clarity, HubSpot Visitor and session identifiers for usage analysis tracking
Meta Pixel, Google Ads, TikTok Pixel, LinkedIn Insight Tag Identifiers for ad measurement and targeting targeting
YouTube embeds, Calendly Identifiers and preferences of the embedded service functionality

Choose the category of a CAPTCHA service from what its provider does with the data too. The CNIL exempts trackers that only secure a login, for example by limiting automated access attempts, so tag such a CAPTCHA strictly-necessary. A CAPTCHA whose provider uses the data for other purposes needs consent, so tag it with the category of those purposes. Choose the category for every script on your site with the 4 cookie categories, then add the tags with Block Scripts Until Consent.

An analytics tool that does not set cookies still falls under Article 5(3) when it reads information from the device, and the GDPR applies to the data it collects. The European Data Protection Board (EDPB) states that JavaScript which instructs the browser to send information falls within Article 5(3). Tracking based only on the IP address falls within it too where the address comes from the device. The EDPB sets this out in its Guidelines 2/2023 on the technical scope of Article 5(3), adopted on 7 October 2024. A cookieless tool still receives the IP address of each visitor, which is personal data, so name the tool and the legal reason you use it in your Privacy Policy.

Some regulators exempt analytics that does set cookies, under strict conditions. The CNIL accepts audience measurement without consent when the tool serves one publisher, informs visitors, keeps cookies 13 months at most, and lets visitors object. Those conditions come from its sheet on analytics. The same CNIL page warns that most large audience measurement offerings do not qualify.

Whether an analytics tool needs consent depends on what it stores or reads on the device and on the exemptions the regulator for your visitors grants. Tag an analytics tool with tracking unless it meets such an exemption, following the rules in Block Scripts Until Consent.

A cookie consent banner does not stop Google from indexing your pages, because Googlebot renders each page as a first-time visitor and your content stays in the page. Google states that its renderer clears cookies across page loads and declines permission requests, in its guide to fixing Search-related JavaScript problems. Googlebot therefore sees the consent banner on every page, and in express mode it does not run any optional tagged script.

Google exempts mandatory interstitials from its guidance on intrusive interstitials. The guidance names content-based gates such as age verification and does not mention cookie consent. The default headline layout of Cookie Consent sits in the page flow and pushes the content down when it appears, while the interstitial and standalone layouts cover the page. Google does not say whether a consent banner that covers the page counts as exempt, so the headline layout avoids the question. Compare the 4 layouts in consent banner layouts.

Cookie Consent asks, stores the answer, and holds the optional scripts you tag, and every other decision about compliance stays with you. Cookie Consent handles these parts by default.

  • Express consent. Of the scripts you tag, only strictly-necessary ones run before the visitor answers, unless you list more optional categories in page_load_consent_levels.
  • Equal choices on the first layer. In express mode, the "I agree" and "I decline" buttons sit on the first layer of the consent banner, with the "Change my preferences" button.
  • Script holding. Cookie Consent holds inline tagged scripts and tagged scripts with src alike, and runs each one without a page reload once its category is accepted.
  • A stored answer. The answer stays in the browser for 365 days by default, so the consent banner does not return on every page.
  • A way back. The Preferences Center reopens from a link on your page, with one switch per category in use.

These decisions stay with you.

  • Which laws apply. Your visitors, your business size, and your scripts decide the answer.
  • Which scripts to tag. An untagged script runs before consent, and Cookie Consent never finds it for you.
  • Which category each script takes. Cookie Consent never picks a category for you.
  • What your policies say. Your Privacy Policy and Cookies Policy name the tools, the cookies, and the purposes.
  • Whether to keep a record. Cookie Consent does not keep a record on a server.
  • What runs outside your templates. A platform or a tag manager that adds scripts by itself needs its own handling.

Some obligations need features Cookie Consent does not have. Check what is left after these decisions in Limits of Free Cookie Consent: What It Does Not Do, and keep evidence of each answer with proof of consent.