Does my website need a cookie banner? What you need to know as a business owner
An 'OK' button on the banner isn't enough. What real consent is, when a cookie banner is mandatory, and how it connects to Google Consent Mode.
Many business owners think an 'Accept' button is enough and the cookie banner obligation is taken care of. In reality, such a banner is often legally invalid — and it's exactly these that get fined. Here's what to watch for in 2026.
When is a cookie banner mandatory?
If your website uses any cookie that isn't strictly necessary for basic operation — you need a banner. In reality this applies to almost every website, because at least Google Analytics or the Facebook Pixel is wired in.
If, on the other hand, there are only strictly necessary cookies (e.g. login, cart, language switcher), then no banner is needed. But it's important to audit this — often something is built in that the owner doesn't even know about.
What does real consent mean?
The GDPR sets four conditions: consent must be (1) freely given, (2) specific, (3) informed and (4) unambiguous. This makes clear why a 'Continue' or 'Close' button isn't enough.
Freely given: the user must be able to decline with equal weight (not just a tiny 'X'). Specific: statistics and marketing cookies must be allowable separately. Informed: they must know what you're asking consent for. Unambiguous: it must be an active action (ticked, clicked).
Why isn't the 'OK' button enough?
An 'OK' button breaks at least two of the conditions above. First, it gives no option to decline (not freely given); second, it requests all cookies as a bundle (not specific).
'Dark patterns' — e.g. the 'Accept' button being more prominent than 'Decline' — are also risky. Authorities are starting to sanction these too.
What has to be stored about consent?
Asking isn't enough — you also have to be able to prove that the user consented, when, and to exactly what. This is the consent audit trail (consent log).
A professional Cookie Management Platform (CMP) — e.g. Cookiebot, Iubenda, Termly, OneTrust — stores this automatically and handles it in a provable way. We can also build a custom solution — often cheaper in the long run.
How does it connect to Google Consent Mode?
Google Consent Mode is a technical solution by which Google Analytics, Google Ads and other Google services adapt based on the user's consent. If someone doesn't consent, Google receives anonymised data — and doesn't infer the individual visitor.
From a business perspective: this has been effectively mandatory for EU advertisers since March 2024. Those who don't add it get drastically less measurement data from Google, and their ad optimisation gets worse too.
Want cookie banner setup or an audit?
Our operations package includes rolling out GDPR-compliant cookie handling, maintaining an audit log, and Google Consent Mode integration — all in one.