Cookie Consent for Startups: Minimum Viable Privacy Setup

You don't need a compliance department. You need one script tag.

If you're a startup founder, you have exactly zero interest in reading 200 pages of GDPR text. You want to know: what's the minimum I need to not get fined, and how fast can I set it up?

Here's the honest answer: you need a cookie consent banner that blocks tracking until consent, sends Consent Mode signals to Google, and logs consent records. That's it for now. Everything else (TCF, DSAR portals, evidence packs) can wait until you have real traffic and revenue.

The 5-minute setup

Step 1: Sign up and create a banner (2 minutes)

Go to cookiebeam.com, create a free account. Click "Create Banner." Pick a template that matches your site's color scheme. You can customize everything later.

Step 2: Add the script tag (2 minutes)

Copy the one-line script tag from your CookieBeam dashboard. Paste it before the closing </head> tag in your HTML. If you're using Next.js, add it to your root layout. If you're using WordPress, paste it in the header section.

<script src="https://cdn.cookiebeam.com/banner/YOUR_ID/default/loader.js" async></script>

Step 3: Verify it works (1 minute)

Visit your site. Clear cookies first. The banner should appear. Click Accept, then check that your analytics and marketing tools are firing. Click Reject (clear cookies again), and check that those tools are NOT firing. Done.

What this gets you

GDPR compliance for the EU: Prior consent before tracking, granular category choices, reject as easy as accept.
CCPA compliance for California: Automatic opt-out behavior with "Do Not Sell" for US visitors.
Google Consent Mode v2: Your Google Analytics and Google Ads get proper consent signals. Your data stays accurate and you can still model conversions from non-consenting visitors.
Microsoft + Meta consent: If you're using Clarity, Bing Ads, or Meta Pixel, CookieBeam sends consent signals to those too.
Cookie scanning: CookieBeam scans your site and categorizes cookies automatically. No manual work.

What you can skip for now

Don't let compliance become a month-long project. These things matter but they can wait until you have product-market fit:

TCF v2.2: Only needed if you run programmatic ads (AdSense, header bidding). If you're just running Google Ads, Consent Mode is enough.
Cookie policy page: Important, but you can generate one from a template. CookieBeam's policy generator creates a basic one from your scan results.
Data subject access requests: Handle them manually when they come in (they rarely do at startup scale). Automate later.
Multi-language banners: Start with English. Add translations when you expand to non-English markets.
Evidence packs and audit trails: CookieBeam logs consent automatically. You'll have the records when you need them, but you don't need to build reporting dashboards around them yet.

The one thing you can't skip

Don't load Google Analytics, Facebook Pixel, HubSpot, or any tracking tool before getting consent. That's the single most common violation and the one regulators catch first. CookieBeam blocks these automatically, but if you're loading scripts outside the CMP's control (hardcoded in your HTML, for example), make sure they're conditional on consent.

Do I need cookie consent if I only have 100 visitors a month?

Yes, if those visitors include anyone from the EU or certain US states. GDPR doesn't have a traffic threshold. The good news: at 100 visitors, nobody is going to fine you. But setting up consent now takes 5 minutes and saves you from a scramble later when you're growing fast.

Does the free plan work for a startup?

CookieBeam's free plan covers up to 5,000 pageviews per month and includes all the compliance features (Consent Mode, cookie scanning, consent logs). Most pre-PMF startups won't hit that limit. When you do, it's a good problem to have.

I'm pre-launch with just a landing page. Do I need consent?

If your landing page has Google Analytics, a Meta Pixel, or any other tracking script, yes. A simple landing page with no tracking at all doesn't need a consent banner. But the moment you add analytics to measure your launch, you need consent.