Cookie consent has a bad reputation, and most of it is earned. The banners that cover half the screen, hide the reject button, and reappear on every page have taught people to click whatever makes them go away. A small site can do much better with a modest amount of care. The goal is a banner that meets the law, respects the visitor, and does not get in the way of reading the page.
Start by finding out what your site actually sets
Before touching a banner, list the cookies the site sets and the scripts that set them. Open the browser developer tools, go to the storage or application panel, and load the site in a private window so nothing is left over from earlier visits. Note every cookie, which domain set it, and how long it lasts. Then match each one to a purpose.
Most cookies sort into four buckets:
- Strictly necessary: login sessions, cart contents, security tokens, load balancing
- Preferences: language, currency, dark mode, region
- Analytics: visitor counts, page popularity, traffic sources
- Marketing: ad pixels, retargeting, cross site tracking
Strictly necessary cookies do not need consent under most privacy laws, because the site cannot function without them. Everything in the other three buckets generally does need consent before it loads. That distinction shapes the whole design.
The rule that makes banners honest
The core requirement in Europe, and the spirit of similar rules elsewhere, is simple. Non essential cookies must not load until the visitor agrees. That means the analytics and marketing scripts stay switched off when the page first loads, and only run after someone opts in. A banner that sets tracking cookies the moment the page appears, then asks for permission afterward, has the order backwards and fails the test no matter how the buttons are worded.
This is why “accept” and “reject” have to carry equal weight. If accepting is one click and rejecting takes three, or if the reject option is grayed out or buried in a settings screen, the consent is not freely given. Two clear buttons, side by side, same size, same prominence. A visitor should be able to say no as easily as they say yes.
Keep the banner small and the wording plain
A consent banner does not need to explain the entire privacy policy. It needs to say, in a sentence or two, that the site uses cookies for specific purposes, offer a clear accept and reject, and link to the full policy for anyone who wants detail. A slim bar along the bottom of the screen does the job without blocking content.
Plain wording helps more than legal phrasing. “We use cookies to measure traffic and, if you allow it, to show relevant ads” tells a visitor what is happening. A wall of vendor names and legal citations does not. Save the detail for the policy page, where people who care can read it and the rest can skip it.
Categories, not all or nothing
For sites that run analytics and marketing, a good banner lets visitors choose by category rather than forcing a single yes or no. Three toggles cover most cases: necessary (always on, not adjustable), analytics, and marketing. Default the optional categories to off. A visitor who wants to allow analytics but not ad tracking can do that in one screen, and the site honors exactly what they picked.
This is where a consent management plugin earns its place. Most content platforms have several, and the reputable ones handle the mechanics: showing the banner, storing the choice, and blocking scripts in categories the visitor declined until they change their mind. The important feature to check is script blocking. A plugin that only hides a banner but lets the tracking scripts run anyway looks compliant and is not.
Remember the choice, and let people change it
Once someone makes a choice, the site should remember it so the banner does not return on every page and every visit. A stored preference lasting somewhere between 6 and 12 months is common. Storing consent itself uses a cookie, and that one counts as strictly necessary, because it exists to honor the visitor’s decision.
People also change their minds. A small persistent link in the footer, something like “Cookie settings”, lets a visitor reopen the panel and adjust or withdraw consent at any time. This is a legal expectation in several regions and a courtesy everywhere. Withdrawing should be as easy as granting was.
A short checklist
- List every cookie and script the site sets, and sort them by purpose
- Load only strictly necessary cookies before consent
- Offer accept and reject with equal prominence
- Let visitors choose by category, with optional categories off by default
- Use a consent tool that actually blocks the scripts a visitor declines
- Store the choice so the banner does not nag
- Put a “Cookie settings” link in the footer for changes and withdrawal
- Keep the wording plain and the banner small
What good looks like
A visitor lands on the site and sees a slim bar at the bottom. It says the site uses cookies for analytics and, with permission, marketing, with an accept button, a reject button, and a settings link. They click reject. No tracking scripts run, the bar disappears, and it does not come back on the next page. Weeks later they decide analytics is fine, click “Cookie settings” in the footer, flip one toggle, and the site adjusts.
None of this is hard, and none of it requires a large budget. The banners people hate are usually the product of a template dropped in without thought, tuned to push acceptance. A banner built to inform and to honor the answer is quieter, faster, and easier to trust. It also happens to be the version the law was asking for all along.