"Do I need a cookie banner on my website?" is one of the first questions a small business owner asks before going live, and the honest answer is: it depends on what your website loads, not on how big your business is. A bakery with a contact form and nothing else may need no banner at all. The same bakery with Google Analytics, or with a YouTube video that loads as soon as the page opens, needs one.
This guide shows you how to tell which case you are in, what a banner has to do when you need one, and how to keep your website from needing one in the first place.
This article explains the general rules as of October 28, 2026. It is not legal advice. For your specific case, ask a lawyer or your data protection authority.
What the rule actually covers
In the European Union, the rule behind cookie banners is Article 5(3) of the ePrivacy Directive (2002/58/EC). Each country writes it into its own law. In Germany, for example, it is § 25 of the TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz).
The German text makes the principle clear. Storing information on a visitor's device, or reading information that is already there, is only allowed if the visitor has consented after clear and complete information. There are two exceptions:
- The storage or access only serves to transmit a message over a network.
- It is strictly necessary to provide a service the visitor explicitly asked for.
Two things follow from this:
- It is not only about cookies. Local storage, tracking pixels and similar techniques fall under the same rule.
- Necessary means necessary for the visitor. A cookie that keeps a shopping basket filled serves the visitor. A cookie that measures your marketing serves you, so it needs consent.
In the United Kingdom, the rule sits in the Privacy and Electronic Communications Regulations (PECR). The ICO's guidance makes the same point about consent: it needs a clear positive action, and "this must be more than simply continuing to use the website". The UK has also added a narrower exception. Since February 5, 2026, storage used only to collect statistics about how a website is used, in order to improve it, needs no consent if visitors get clear information about it, have a simple, free way to object, and the data is not shared except to help with those improvements (PECR Schedule A1). The ICO is consulting on revised guidance.
When do I need a cookie banner on my website?
Go through your website and list everything that runs on it. These are the usual triggers:
| What runs on your website | Needs consent? |
|---|---|
| Google Analytics 4 or other analytics that set cookies | Yes, in the EU |
| Meta Pixel, LinkedIn or TikTok tags | Yes |
| Google Tag Manager loading marketing tags | Yes, for the tags it loads |
| Embedded YouTube or Vimeo videos | Yes, unless they load only after a click |
| Embedded maps, chat bubbles, booking widgets from other providers | Usually, because they load third-party code |
| Analytics that set no cookies and store nothing on the device | The device-storage rule is not triggered; mention it in your privacy policy |
| A cookie that keeps a visitor logged in or remembers their basket | No, strictly necessary |
If everything on your list falls into the last two rows, you do not need a consent banner. You still need a privacy policy that says what your website does with personal data, such as the IP address or the messages people send through your form.
Embedded content deserves a closer look. A YouTube video or a map from another provider sends the visitor's IP address to that provider the moment it loads. That is why many websites show a placeholder first and load the content only after a click.
What a good banner does
If you need a banner, it has to work for the visitor, not just appear:
- Nothing optional loads before a choice. No analytics, no pixels, no embedded videos until the visitor agrees.
- Consent is an action. Scrolling or staying on the page is not consent.
- Rejecting is as simple as accepting. A visitor who says no should not have to dig through three screens.
- Visitors can change their mind. A link in the footer reopens the settings.
- It names what it holds back. "Statistics" means little. "Google Analytics" and "YouTube" mean something.
A banner that fails these points collects consent that may not count, which leaves you where you started.
Fewer tools, fewer banners
The simplest cookie banner is the one you do not need. Before you add a tool, ask what it gives you:
- Do you read the analytics? If you have not opened them in months, you may not need them. A cookie-free analytics tool answers the questions most owners have: how many visitors, from where, on which pages.
- Do you run ads? If not, remove the pixels, including any left over from old campaigns.
- Can the video load on click? A click-to-load player keeps the video and drops the consent question for everyone who never presses play.
Each tool you remove is one less entry in your privacy policy, too.
How the AI Website Builder handles it
When trettly, the assistant in the AI Website Builder, builds your website, the cookie banner follows what is actually on it:
- No tracking, no banner when the page opens. The banner is set to Automatic by default. It appears as soon as you add a tracking tool, names the tools it holds back, such as Google Analytics, and loads none of them before the visitor agrees. If you prefer, you can set it to always show.
- Every tracking tool waits. Google Analytics, Google Tag Manager, Meta, LinkedIn, TikTok and any tracking code of your own that you add in the settings stay switched off until the visitor agrees.
- Videos and app content wait for a click. A YouTube or Vimeo section, and content from your KIMISUITE apps such as a room search from Booking Hub or appointment booking from Service Manager, show a placeholder first. They load when the visitor clicks them or has accepted the banner. YouTube runs through youtube-nocookie.com.
- The privacy policy comes with it. The legal wizard writes your imprint, privacy policy and accessibility statement from your company data, in versions for Austria, Germany, Switzerland, the EU and an international version. You read them and confirm that you have checked them before you publish.
So a website with your texts, pictures, a contact form, a video and a booking widget opens without a banner: the video and the widget simply wait for a click. Add Google Analytics later, and the banner appears by itself.
See how publishing works, with legal pages and cookie banner
FAQ
Do I need a cookie banner on my website if I use no cookies?
Not for the device-storage rule, as long as nothing else stores or reads information on the visitor's device. That includes pixels, local storage and embedded third-party content. You still need a privacy policy.
Is Google Analytics allowed without a cookie banner?
In the EU, GA4 sets cookies that are not strictly necessary, so it needs consent first. The UK's newer statistics exception comes with conditions, including a simple way for visitors to object and limits on sharing the data, so check whether your setup meets them before you drop the banner.
Are cookie banners required outside the EU?
The rules differ. The UK has its own rules under PECR, enforced by the ICO, with the statistics exception described above. Other countries have their own laws. If your business is in the EU or addresses visitors there, plan for the EU rules.
Does a small business get an exemption?
No. The rule depends on what your website stores on a visitor's device, not on the size of your business.
What happens if a visitor rejects all cookies?
Your website still has to work. Forms, texts and pictures stay usable. Only the optional parts stay off, such as a video, which can still load later if the visitor clicks it.
