Do I Need a Cookie Banner on My Website?

Yes, and the mechanism has changed. Regulators now run automated scanning programs that check sites at scale rather than waiting for a complaint, so being small no longer means being overlooked. Several European authorities have published results from these sweeps, with warning letters sent to sites purely on the basis of what the scanner found.

Whether a banner exists, whether cookies fire before consent is given, and whether the banner offers a genuine choice. That third point is where many sites fail: a banner that makes accepting easier than declining is treated as not offering a real choice, regardless of how professional it looks.

The regulation allows up to €20 million or 4% of global annual turnover, whichever is higher. In practice a small business would not face the ceiling, though penalties well below it are still material. The more common outcome from an automated sweep is a warning letter with a deadline, followed by formal investigation if nothing changes.

Yes, for visitors in the EU or UK. Analytics cookies are not covered by the strictly necessary exemption, which applies to things like session handling that the site cannot function without. Analytics measures behavior for your benefit, so consent is required before it runs.

It applies based on where your visitors are, not where you are registered. Unless you actively block European traffic, some portion of your audience is covered. This catches out businesses that assume geography protects them while running ads that reach exactly the visitors the rules apply to.

Yes, and this is usually the more expensive consequence. If consent signals never reach Google properly, conversions go unattributed and campaigns optimize on partial data. You end up adjusting creative and audiences to fix a problem that started with the banner rather than the campaign.

Open your site in a private window, open the network tab, and watch what fires before you touch the banner. Then decline and check again. Scripts still running after a decline mean the banner is collecting answers it does not act on, which is the specific failure automated scanners are built to detect.

Often not. Built-in banners from site builders and page plugins frequently display a notice without blocking anything, and many are not certified for passing consent signals to Google. The interface looks the same either way, so the only reliable check is watching what actually loads before consent is given.