Cookie Banner Requirements: When Your Website Really Needs One

The short answer first: a cookie banner is not a blanket requirement for every website. Under EU rules (the GDPR and the ePrivacy framework), consent is generally only needed if your website uses cookies or comparable techniques that are not technically necessary — meaning tracking, marketing pixels, or externally loaded content that transmits visitor data to third parties. If your website uses none of that, there is nothing a banner would need to ask permission for.

Many small businesses show one anyway — out of uncertainty, or because "everyone does it". In doing so, they hand the first impression of their website over to a consent window they may not even need. We have always built all our client websites without consent-requiring technology and therefore without a banner — this article shows how that works and why the approach pays off twice.

Note: This article is general guidance, not legal advice. Whether your specific website uses services that require consent can only be assessed case by case — when in doubt, ask a law firm specializing in IT law.

What consent is actually about

The basic idea behind the rules is simple: anyone who stores or reads something on a visitor's device — which is exactly what cookies do — or processes their data for tracking and advertising should ask first. Exempt is whatever is required to operate the website. The details are explained by the data protection authorities; for everyday practice, this rule of thumb is enough.

So the banner is never an end in itself. It is the tool used to obtain consent — and only needed if there is something that requires consent.

What you need consent for

On typical business websites, consent is required above all for:

• Tracking and analytics cookies: common analytics tools that build visitor profiles, recognize users via cookies, or transmit data to third-party providers.
• Marketing and advertising pixels: tracking pixels from ad networks and social networks, remarketing techniques, conversion tracking.
• External embeds that load immediately: embedded videos, map services, or social media posts that send data to the respective provider the moment the page opens.
• External scripts with tracking functions: chat widgets, review widgets, or personalization services that recognize visitors across websites.

As soon as one of these applies, there is usually no way around a consent dialog — and a properly implemented one at that: as a basic principle, declining should be as easy as accepting, and none of it may load before consent is given.

What is allowed without a banner

No consent is needed for technically necessary functions, for example:

• session cookies for login areas or shopping carts
• storing a language preference or the cookie choice itself
• security functions such as protection against form spam
• a contact form that sends an inquiry by email

And — the often overlooked point: visitor statistics are not automatically subject to consent. There are cookieless, self-hosted analytics solutions that only record anonymous, aggregated numbers (page views, country of origin, device type), build no personal profiles, and transmit no data to third parties. If you measure this way, you still know how many visitors come and which pages work — without a banner.

How to build a website that needs no banner at all

The most elegant solution is not the perfect banner but a website that doesn't need one. For a normal business website, that is well within reach — it takes four building blocks:

1. Host fonts locally. Externally loaded web fonts transmit the IP address of every visitor to third-party servers and have already been the subject of waves of formal cease-and-desist letters (known in Germany as Abmahnung). Locally hosted fonts look identical and solve the problem at the root — our article on externally loaded fonts and the GDPR shows how.
2. Cookieless statistics instead of tracking. A self-hosted, anonymous visitor statistic delivers all the numbers a small business really needs.
3. Two-click embeds. Videos and maps only load once the visitor actively clicks a preview. Before that, not a single byte flows to the provider — the click itself is the informed decision.
4. No marketing pixels. If you don't embed ad network pixels, you don't need to collect consent for them either. For most local businesses this is no loss, because their customers come through search, not retargeting.

All the websites we build follow exactly this pattern: static pages, local fonts, cookieless statistics — and therefore not a single banner. You can see examples in our Showroom or live at the client project maschinen-niedermeier.com.

Why going without pays off twice

A banner is not just a legal topic — it is a conversion topic. The first thing a visitor sees of your website should be your offer, not a consent dialog covering the screen. Especially on mobile, visitors bounce before they have even seen what the site is about. If your website gets visitors but hardly any inquiries, the banner is one of the suspects — more on that in the article why your website gets no inquiries.

On top of that: if you use no consent-requiring services, you also have no sources of error. Misconfigured consent dialogs — for instance ones where tracking starts before the click, or where declining is hidden — can lead to complaints and cease-and-desist letters. The banner-free website simply doesn't have that risk.

Frequently Asked Questions

Is a cookie banner legally required in the EU?

No, not across the board. Consent is generally required if the website uses non-essential cookies or comparable techniques. The banner is merely the usual means of obtaining that consent. A website without consent-requiring services needs no banner — it still needs a privacy policy.

Do I need a banner for my contact form?

Generally no. The data from a contact form is processed in order to answer the inquiry — no cookie consent is needed for that. The processing does, however, have to be described in your privacy policy.

May I measure visitor numbers entirely without consent?

Yes, if the measurement works without cookies, builds no personal profiles, and passes no data on to third parties. Cookieless, self-hosted analytics solutions meet these conditions and still deliver meaningful numbers on visitors, pages, and origin.

What about embedded videos and maps?

Directly embedded content from external providers usually loads data the moment the page opens — that requires consent. The clean solution is a two-click approach: the page initially shows only a local preview image, and the external content loads only after a deliberate click by the visitor.

My website builder switched the banner on automatically — can I turn it off?

Only if you are sure the website loads no consent-requiring services. Many builders and prefab designs load external fonts, scripts, or statistics services in the background — in that case the banner is unfortunately justified. You can check this in the network tab of your browser's developer tools: if third-party domains show up when the page loads, caution is advised.