We get these questions from website owners every week. Here are the straight answers.
Do I need a cookie banner on my website?
If your website uses cookies or similar tracking technologies beyond what's strictly necessary for the site to function, and you have visitors from the EU, UK, or several US states with privacy laws (California, Colorado, Connecticut, and others), then yes. If your site truly sets zero non-essential cookies (no analytics, no ads, no social embeds), you technically don't need a consent banner for EU visitors, but you may still need a privacy notice.
What counts as a 'necessary' cookie that doesn't need consent?
A cookie is strictly necessary if the website literally can't work without it. Shopping cart cookies, login session cookies, load balancer cookies, and CSRF protection tokens all qualify. Analytics cookies (including Google Analytics), advertising cookies, social media cookies, and preference cookies (like language or theme) are NOT strictly necessary and require consent.
Does Google Analytics require cookie consent?
Yes. Google Analytics sets cookies (_ga, _gid, and others) that track visitor behavior across pages and sessions. Under GDPR, ePrivacy Directive, and UK PECR, you need explicit opt-in consent before loading Google Analytics. Under CCPA/CPRA, you need to offer an opt-out mechanism. Google's own EU User Consent Policy requires consent signals from EEA traffic.
What happens if I don't have a cookie banner?
For EU-targeted websites, data protection authorities can issue fines up to 20 million euros or 4% of annual global turnover under GDPR. In practice, most enforcement starts with warnings and orders to comply. But fines have been issued: the French CNIL fined Google 150 million euros and Amazon 35 million euros for cookie consent violations. Smaller companies typically face fines in the tens of thousands.
Can I use a simple 'accept all' button without a reject option?
No, not in the EU. GDPR and the ePrivacy Directive require that rejecting cookies is as easy as accepting them. A banner with only 'Accept' and 'Settings' (where rejection is buried several clicks deep) has been ruled non-compliant by multiple DPAs. Best practice: show 'Accept all' and 'Reject all' buttons with equal prominence.
How long should cookie consent last before asking again?
There's no legally mandated duration, but 6 to 12 months is the standard. Asking on every visit is annoying and probably not compliant (it pressures consent). Asking once a year is reasonable. If you change your cookie categories or add new tracking tools, you should ask again regardless of when the visitor last consented.
Do US websites need cookie consent?
There's no US federal cookie consent law yet. But California (CCPA/CPRA), Colorado (CPA), Connecticut (CTDPA), Virginia (VCDPA), and several other states have privacy laws that require opt-out mechanisms for data sales, targeted advertising, and profiling. If you have visitors from these states (and you almost certainly do), you need at minimum a 'Do Not Sell or Share My Personal Information' link.
What's the difference between opt-in and opt-out consent?
Opt-in (GDPR model): no tracking cookies until the visitor actively clicks 'Accept.' This is required in the EU, UK, Brazil (LGPD), and several other jurisdictions. Opt-out (US model): tracking runs by default, and the visitor can choose to stop it. California and other US states use this model. A good consent banner handles both automatically based on the visitor's location.
What is Google Consent Mode v2?
Consent Mode is a protocol between your consent banner and Google's tracking tags. It tells Google whether the visitor consented to analytics and advertising cookies. Without it, Google can't attribute conversions from EEA traffic, which hurts your Google Ads performance. Consent Mode v2 added two new signals: ad_user_data and ad_personalization. Google requires it for all EEA advertising since March 2024.
Do I need consent for server-side tracking?
Yes. Server-side tracking changes where data processing happens (your server instead of the visitor's browser), but it doesn't change the legal requirement for consent. If you're tracking user behavior for analytics or advertising, you need the same consent regardless of whether the tag runs client-side or server-side.
Can cookies still track me if I reject consent?
They shouldn't. A properly implemented consent banner blocks all non-essential cookies until consent is given. If you reject, no analytics or marketing cookies should be set. However, strictly necessary cookies (session, security, cart) will still work because they don't need consent. If a site sets tracking cookies after you reject, that's a compliance violation.
What's a cookie scanner and do I need one?
A cookie scanner crawls your website to detect all cookies, tracking scripts, and network connections. You need one because websites change constantly: developers add new tools, marketing installs new pixels, CMS plugins drop cookies you didn't know about. A scanner finds them before a regulator does. Most CMPs (including CookieBeam) include automated scanning.
How do I handle cookie consent for embedded content (YouTube, Google Maps)?
Embedded iframes from YouTube, Google Maps, social media, and similar services set third-party cookies. You have two options: block the embed entirely until consent (show a placeholder with a 'Load content' button), or use privacy-enhanced modes where available (YouTube's youtube-nocookie.com, for example). CookieBeam's script blocking can handle this automatically.
What is TCF v2.2 and do I need it?
The Transparency and Consent Framework (TCF) is an IAB standard for communicating consent to advertising vendors. If you run programmatic advertising (Google AdSense, header bidding, real-time bidding), TCF v2.2 is effectively required. Google requires TCF compliance for publishers serving ads in the EEA. If you don't run programmatic ads, you don't need TCF.
Can I use pre-checked consent checkboxes?
No. The Court of Justice of the EU ruled in the Planet49 case (2019) that pre-ticked checkboxes don't constitute valid consent. Consent must be a clear, affirmative action. All consent categories (except strictly necessary) must be unchecked by default.
What consent records do I need to keep?
Under GDPR, you need to demonstrate that consent was freely given, specific, informed, and unambiguous. In practice, store: when consent was given, what the visitor consented to (which categories), the version of the banner shown, and a unique consent ID. Keep these records for as long as the consent is valid (typically the same duration as the consent cookie, 6-12 months). CookieBeam stores all this automatically in its consent log.
How do cookie walls work? Are they legal?
A cookie wall blocks access to the website unless the visitor accepts cookies. In most EU countries, cookie walls are illegal because consent isn't 'freely given' if the alternative is losing access. Some countries (notably the Netherlands) have allowed 'pay or consent' models where the visitor can choose between accepting cookies or paying a subscription. The legality varies by jurisdiction and is still evolving.
What's GPC (Global Privacy Control) and should I honor it?
GPC is a browser signal that communicates 'do not sell or share my personal information.' In California (CCPA/CPRA) and Colorado (CPA), honoring GPC is legally required. Other states are following. A good consent banner detects GPC and automatically applies opt-out behavior for visitors with it enabled. CookieBeam honors GPC automatically in US opt-out regions.
How often should I scan my website for cookies?
At minimum, monthly. Ideally, after every deployment. Websites change constantly: a marketing team adds a HubSpot form, a developer installs a new analytics tool, a WordPress plugin drops an unexpected cookie. Automated scanning catches these changes before they become compliance issues. CookieBeam runs automated scans and alerts you when new cookies appear.
Does my cookie banner slow down my website?
It depends on the implementation. A poorly built banner that loads synchronously can add 200-500ms to page load. CookieBeam's script loads asynchronously and weighs under 30KB gzipped. It shouldn't noticeably affect your Core Web Vitals. The bigger performance impact comes from the tracking scripts the banner controls, not the banner itself.
What's the difference between a CMP and a cookie banner?
A cookie banner is the visual popup that asks for consent. A CMP (Consent Management Platform) is the entire system: the banner, the consent storage, the cookie scanning, the analytics, the consent mode integration, the compliance reporting. CookieBeam is a CMP. A simple JavaScript popup that sets a 'consent=true' cookie is just a banner (and probably not compliant).