Start With What Is Actually Regulated
Two distinct things get conflated, and separating them makes the rest straightforward.
- Storing or reading information on someone's device — cookies, local storage, device fingerprinting. In the EU and UK this is governed by ePrivacy rules, and it requires prior consent for anything not strictly necessary. This applies whether or not the data is personal.
- Processing personal data — names, emails, IP addresses, behavioural profiles. This is governed by GDPR in the EU, UK GDPR in Britain, the DPDP Act in India, and a patchwork of state laws in the United States.
A cookie banner addresses the first. A privacy policy and your lawful basis address the second. You need both, and one does not substitute for the other.
What Needs Consent, And What Does Not
| Purpose | Consent needed in EU/UK |
|---|---|
| Session, login, cart, security, load balancing | No — strictly necessary |
| Storing the visitor's consent choice | No — exempt |
| Analytics of any kind, including self-hosted | Yes |
| Advertising and remarketing pixels | Yes |
| Embedded video, maps and social widgets | Yes, because they set their own cookies |
| Live chat, when loaded before an interaction | Yes |
| A/B testing and personalisation tools | Yes |
| Fonts served from a third-party CDN | Contested — self-hosting removes the question |
That last row is worth acting on regardless. Self-hosting fonts removes a compliance argument and usually improves performance at the same time.
What A Compliant Banner Looks Like
The recurring failures are consistent enough to list as requirements.
- Nothing non-essential fires before a choice is made. This is the one most often broken. Tag managers frequently load analytics on page load regardless of what the banner subsequently reports.
- Reject is as easy as accept. Equal prominence, same level, same number of clicks. A refusal buried two screens deep is not a genuine choice.
- No pre-ticked boxes, and no treating continued scrolling as agreement.
- Granular categories — analytics, advertising and functional handled separately rather than bundled into one switch.
- Withdrawal is as easy as giving, which means a persistent link or control to change the decision later.
- A cookie policy that lists what is actually set — name, purpose, duration, and who receives it.
- A record of consent that you can produce if asked.
Reputable consent platforms handle most of this, but none of them audit whether your own scripts respect the answer. That part has to be checked in the browser, and it is where most sites fail despite having paid for a tool.
The Analytics Consequence Nobody Warns You About
Once a compliant banner is live, a share of your European visitors will decline and disappear from your reporting. Your dashboards will show a drop that did not happen in reality.
What to do about it:
- Reset your baseline from the date the banner went live, and stop comparing across it
- Implement consent mode so that modelled conversions remain available to advertising platforms without setting cookies for users who declined
- Track the consent rate itself — it tells you what multiplier your reported numbers sit under
- Lean harder on measures unaffected by consent — server-side enquiry counts, CRM records, actual revenue
- Ask customers directly how they found you, which remains the most robust attribution signal available to most businesses
This connects to a broader problem with website measurement, which we cover in what to measure instead of traffic.
The Other Jurisdictions, Briefly
United States
There is no single federal privacy law. California and a growing list of other states operate primarily on an opt-out model rather than prior consent, typically requiring a clear route to opt out of the sale or sharing of personal information, and honouring browser-level opt-out signals. Practically, if you sell into California you need an opt-out mechanism and an accurate privacy notice; you do not necessarily need a European-style prior-consent banner.
India
The Digital Personal Data Protection Act sets out notice and consent requirements for processing personal data, with an emphasis on clear, plain-language notice and on consent that is specific rather than bundled. Businesses that have treated a boilerplate privacy policy as sufficient will need to revisit both the notice itself and their ability to evidence consent.
Selling across borders
Territorial scope follows the customer. An Indian studio with UK clients, or a US brand shipping to Germany, is within the scope of those regimes for those visitors. Building to the strictest standard you are exposed to is usually cheaper than maintaining several behaviours.
A Practical Sequence
- Inventory what your site actually loads — open developer tools, look at storage and network requests on a clean visit
- Classify each item as strictly necessary or not, honestly
- Remove anything you are not genuinely using, which is usually more than expected
- Self-host fonts and consider privacy-respecting embeds for video and maps
- Install a consent platform and configure categories properly
- Verify in the browser that nothing non-essential fires before consent
- Publish a cookie policy that matches reality and a privacy policy that names your lawful basis, retention periods and rights
- Re-check after any marketing tool is added, because that is when it silently breaks
We build consent handling into sites as part of the engineering rather than bolting a banner over the top, which is the difference between a site that passes inspection and one that merely looks compliant. If you want your current setup checked against what it actually loads, we can audit it and show you the gaps. This article is general guidance and not legal advice — take qualified advice for your specific circumstances.