Cookie banners and GDPR: what the law actually wants from your site
A cookie is a tiny note a website stores in your browser — useful for remembering your login, but also usable to track you across the web. That second use is why European law (GDPR, applied in France by the CNIL and in the UK by the ICO) requires sites to ask permission first.
The three rules most sites break
- Nothing tracks before consent: analytics and ad scripts must stay off until the visitor says yes — not load first and apologise later.
- 'Reject all' must be as easy as 'Accept all': one click each, same prominence. Hiding the refuse button is a sanctionable dark pattern.
- The choice must be changeable: a visitor who said yes in January can say no in March, from a link in your footer.
Compliance is a trust signal, not a tax
Visitors notice when a site respects them. A clean, honest consent banner — and analytics that work without invading privacy — read as professionalism. There are even consent-free analytics tools that count visits without identifying anyone; we pair one with consent-gated Google Analytics on every site we build.
The banner is the first promise your site makes. Keep it honest and keep it small.
If your current banner loads trackers before anyone clicks, or has no visible 'Reject' button, you're carrying legal risk you don't need. It's one of the things we check — and one of the easiest to fix properly.