A Cookie Banner That Actually Does Something

The banner that does nothing

The common arrangement on small business sites is a notice appearing at the bottom of the screen saying the site uses cookies, with a button marked accept.

Behind it, the analytics, the pixels, and the embedded content have already loaded and already reported.

Clicking accept dismisses the notice. Clicking anything else, if there is anything else, also dismisses the notice.

The banner is not doing what it appears to do, and its presence creates an impression of care that the configuration does not support.

How to tell which kind you have

A two-minute check, and most people are surprised by the result.

Open your site in a private window with the browser's network view showing, and load a page without touching the banner.

Look at which external domains have already been contacted.

If your analytics provider, an advertising platform, or an embedded service appears in that list before you have clicked anything, the banner is decorative.

A working setup shows almost nothing external until consent is given, and then shows the rest appearing.

What has to be held back

• Analytics, in most configurations.
• Advertising pixels and remarketing tags.
• Embedded video and maps, which set their own cookies.
• Social feeds and share widgets.
• Chat tools, which frequently identify visitors.
• Heat mapping and session recording.

What does not have to be held back is anything strictly necessary for the site to work: a session for a logged-in user, a basket, a security token, and the record of the consent choice itself.

Doing it properly

The mechanism is straightforward and it is a configuration job rather than a writing job.

Non-essential scripts are not pasted into the template. They are registered with a consent tool, which holds them until a choice is made and then loads the categories that were accepted.

Most consent tools do this natively. Most sites have installed one and left the scripts hard-coded in the template beside it, which produces a banner and no blocking.

Where a tag manager is in use, it can be configured to fire tags only on a consent signal, which is usually the cleanest arrangement for a business already using one.

The test afterwards is the same as the test above: reload and confirm nothing external fires until you choose.

Declining has to be as easy as accepting

The design question that determines whether consent means anything.

A large accept button beside a small link marked preferences, leading to a screen with several steps, is a pattern designed to produce agreement rather than to ask for it.

What is generally expected is that accepting and declining are equally available, at the same level, with similar prominence.

Two buttons, accept all and reject all, side by side, with a third option for detail, is the arrangement that satisfies this and is also the simplest to implement.

Pre-ticked boxes for optional categories do not represent a choice, and neither does a banner with no way to decline at all.

This is a general description rather than legal advice, and requirements vary depending on where you and your visitors are.

A worked example

A professional services firm had installed a well-regarded consent plugin, configured the wording carefully, and considered the matter handled.

Checking the network view showed their analytics, two advertising pixels, and an embedded map all firing on load, before any interaction.

The plugin was displaying a banner and blocking nothing, because every script had been pasted directly into the theme header when the site was built and the plugin had no knowledge of them.

The fix was moving those scripts into the plugin's management and replacing the map with a static image that loaded the real one on click.

Afterwards, a page load contacted no external domain until a choice was made.

Analytics recorded fewer sessions, because a proportion of visitors declined, and that reduction was the evidence it was working rather than a problem to be solved.

Expect your numbers to fall

Worth preparing for, because it surprises people and prompts them to undo the work.

Where tracking previously ran for everybody and now runs only for those who agree, your analytics will report fewer visitors.

The drop varies considerably, and the important point is that the traffic did not change. The measurement did.

Record the date of the change so the discontinuity in your reporting is explained rather than investigated, and compare periods either side of it rather than across it.

Some analytics tools offer a mode that records limited, non-identifying information where consent is absent, which recovers part of the picture without tracking anybody.

Embeds are the awkward part

The category people forget, and the one that most often undermines an otherwise correct setup.

An embedded map, video player, or social feed sets its own cookies and reports to its own provider the moment it loads, independently of anything you configured.

Blocking it until consent means the visitor sees an empty space with an explanation and a button to load it, which is less elegant and is the honest arrangement.

For maps in particular, a static image linking to directions is usually better on every measure: it is faster, it removes the consent problem, and it serves the person who wanted directions just as well.

The counter-case

There is a real argument that a great many sites should not need a banner at all.

A brochure site that runs no advertising, embeds nothing, and uses no analytics has nothing to ask about, and adding a banner to it is noise that trains people to click through notices without reading them.

The better response for such a site is not a well-configured banner. It is to keep the position that requires no consent, which is also faster and simpler to maintain.

Before building consent infrastructure, ask whether you need what it is protecting. Several sites arrive at this exercise, audit their tracking, and find the simplest correct answer is to remove two things and need no banner.

Getting it right

1. Load a page in a private window with the network view open.
2. List what fires before you click anything.
3. Move those scripts into your consent tool's management.
4. Give reject equal prominence to accept.
5. Replace embedded maps with a static image.
6. Retest and confirm nothing external fires first.
7. Record the date your analytics numbers change.

Step two is the whole diagnosis and most people have never performed it.

Setting up measurement properly is covered in installing analytics without breaking privacy rules.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.