Banner Configuration
Live Banner Preview
What Is a Cookie Consent Banner?
A cookie consent banner is a notice displayed on a website that informs visitors about the use of cookies and similar tracking technologies. It provides users with the ability to accept, reject, or customize which types of cookies are stored on their device. These banners have become a ubiquitous part of the modern web, driven by privacy regulations that require explicit user consent before processing personal data.
The primary purpose of a consent banner is transparency. It tells visitors what data you collect, why you collect it, and how they can control that collection. Under regulations like the GDPR, displaying a consent banner isn’t optional — it’s a legal requirement for any website that uses cookies or tracking technologies to process the personal data of users in covered jurisdictions.
However, the specific requirements vary significantly between regulations. The EU’s GDPR demands opt-in consent before any non-essential cookies are set, while California’s CCPA focuses on the right to opt out of the sale of personal information. Understanding these differences is critical for creating a compliant banner. If you’re unsure about your obligations, our guide to analytics and cookie consent breaks down the requirements in detail, and the GTM Consent Audit tool can verify your implementation is correct.
It’s worth noting that not all analytics tools require a consent banner. Privacy-first solutions like Plausible and Fathom operate without cookies entirely, which can eliminate the need for a banner in many jurisdictions. We’ll explore this distinction further below.
Consent Banner Requirements by Regulation
Each privacy regulation has its own set of rules governing cookie consent banners. The differences can be substantial — from what type of consent is required to which buttons must appear on the banner. The table below provides a detailed comparison to help you understand your obligations under each framework.
| Requirement | GDPR (EU) | CCPA (CA) | LGPD (Brazil) | POPIA (S. Africa) | PIPEDA (Canada) |
|---|---|---|---|---|---|
| Consent Model | Opt-in (prior) | Opt-out | Opt-in (prior) | Opt-in (justified) | Implied / Opt-out |
| Accept Button | Required | Not required | Required | Recommended | Recommended |
| Reject Button | Required (equal prominence) | Not applicable | Required | Recommended | Recommended |
| “Do Not Sell” Link | Not applicable | Required | Not applicable | Not applicable | Not applicable |
| Granular Preferences | Required | Recommended | Required | Recommended | Recommended |
| Pre-checked Boxes | Prohibited | Allowed | Prohibited | Prohibited | Allowed (non-sensitive) |
| Cookie Wall Allowed | Generally no | No financial incentive diff. | No | Case-by-case | Case-by-case |
| Withdraw Consent | Must be as easy as giving | N/A (opt-out model) | Must be easy | Must be possible | Must be possible |
| Record of Consent | Required | Required (opt-out records) | Required | Required | Recommended |
As you can see, GDPR and LGPD are the strictest, requiring explicit opt-in consent before any non-essential cookies are placed. Both regulations also mandate that the reject option be as prominent and easy to use as the accept option — so-called “dark patterns” that make it harder to decline are explicitly prohibited.
The CCPA takes a different approach. Instead of requiring prior consent, it gives California residents the right to opt out of the sale of their personal information. This means you need a “Do Not Sell or Share My Personal Information” link, but you don’t necessarily need a consent banner in the GDPR sense. For a deeper dive into GDPR-specific analytics compliance, see our GDPR web analytics guide. The latest regulatory developments, including the EU Digital Omnibus Directive, are covered in our EU Digital Omnibus analysis.
Do Privacy-First Analytics Need a Consent Banner?
This is one of the most frequently asked questions in the privacy analytics space, and the answer may surprise you: many privacy-first analytics tools do not require a cookie consent banner.
Tools like Plausible Analytics, Fathom Analytics, and Simple Analytics are designed from the ground up to operate without cookies, without local storage, and without collecting any personally identifiable information (PII). Because they don’t use any tracking technologies that fall under cookie consent regulations, they typically don’t trigger the consent requirement under GDPR, LGPD, or other privacy laws.
How Cookieless Analytics Work
Instead of dropping persistent cookies to track users across sessions, privacy-first tools use ephemeral, server-side techniques to count unique visitors. Plausible, for example, generates a daily-rotating hash from the visitor’s IP address and User-Agent string. This hash is never stored, cannot be used to identify individuals, and resets every 24 hours. The result is accurate pageview and visitor counts without any client-side storage.
This approach has been validated by multiple European Data Protection Authorities. The French CNIL, for instance, has explicitly confirmed that analytics tools meeting certain criteria (no cross-site tracking, no PII, audience measurement only) are exempt from prior consent.
When You Still Need a Banner
- Self-hosted Matomo with cookies enabled — While Matomo can be configured to run cookieless, its default setup uses cookies and therefore requires consent under GDPR.
- GA4 (Google Analytics) — Always requires consent in the EU. Google processes data on US servers, sets multiple cookies, and uses data for its own purposes. A consent banner is mandatory.
- Mixed setups — If you use Plausible for analytics but also run marketing pixels (Meta Pixel, Google Ads tag), you still need a consent banner for those marketing cookies, even if your analytics tool is exempt.
For a detailed comparison of privacy-first analytics tools, see our Plausible vs Fathom vs Matomo comparison. If you’re looking to move away from Google Analytics entirely, our Google Analytics alternatives guide covers the best options. For a comprehensive overview of setting up compliant analytics, read our privacy-compliant analytics guide.
Consent Banner Best Practices
A well-designed consent banner balances legal compliance with user experience. Here are the key do’s and don’ts to keep in mind when creating your banner copy and design.
Do: Use plain language
Write in clear, everyday language that any visitor can understand. Avoid legal jargon like “legitimate interest” or “data processing activities” in the banner itself. Save technical details for your full privacy policy.
Don’t: Use dark patterns
Never make the “Reject” button smaller, less visible, or harder to find than the “Accept” button. Under GDPR, both options must be equally prominent. Hidden reject options can result in regulatory fines.
Do: Be specific about purpose
Tell users exactly what the cookies do. “We use analytics cookies to understand which pages are popular” is far better than “We use cookies to improve your experience.” Specificity builds trust.
Don’t: Pre-check consent boxes
Under GDPR and LGPD, all cookie categories except strictly necessary ones must be unchecked by default. Pre-checked boxes do not constitute valid consent and can lead to enforcement action.
Do: Offer granular control
Let users choose which categories of cookies to accept (analytics, marketing, functionality). A simple “Accept All / Reject All” is the minimum, but category-level control demonstrates respect for user choice.
Don’t: Use cookie walls
Blocking access to your site until a user accepts cookies is generally prohibited under GDPR. Users should be able to browse your site even if they reject all non-essential cookies.
Do: Make withdrawal easy
Users must be able to change their cookie preferences at any time, just as easily as they gave consent initially. Include a persistent “Cookie Settings” link in your footer.
Don’t: Ignore mobile users
Your consent banner must be fully functional on mobile devices. Giant banners that cover the entire screen or tiny text that can’t be read on a phone will frustrate users and may violate accessibility requirements.
For websites focused purely on analytics, consider whether you need a banner at all. Switching to a cookieless attribution model with a privacy-first analytics tool can eliminate the banner entirely, improving both user experience and page load performance. Use our Consent Impact Dashboard to calculate exactly how much data you’re losing to consent banners, or check regional requirements with the Consent Logic Planner. See our guide to privacy-enhancing technologies for more options.
Frequently Asked Questions
Want to eliminate consent banners entirely?
Switch to privacy-first analytics and stop asking visitors for permission to understand your own website.
Read Our Privacy Analytics Guide →Related resources