Do I need a cookie banner on my small business website?

You need a cookie banner only if your website stores or reads information on a visitor's device that is not strictly necessary for the site to work. In the EU that usually means tracking, advertising and many analytics tools, plus content embedded from other companies. If your site uses none of those, you may not need a banner at all.

What does the EU rule say, in plain words?

The rule comes from the EU's ePrivacy Directive, often called the "cookie law", and each country has written it into its own national law. In plain words: before a website stores or reads information on someone's phone or computer, it must ask for permission, unless that information is strictly necessary to provide what the visitor asked for.

A cookie is a small file a website saves in the visitor's browser, but the rule also covers similar techniques, such as other browser storage or tracking methods that read details from the device.

When personal data is involved, the GDPR, the EU's general data protection law, applies as well. It also sets what valid consent looks like: freely given, specific, informed, and as easy to withdraw as to give.

This article is general information, not legal advice.

What counts as strictly necessary?

Things the visitor needs for the site to do what they asked, for example:

• Remembering what is in a shopping basket
• Keeping someone logged in to an account they chose to open
• Remembering the visitor's cookie choice
• Security features that protect a form from abuse

These usually do not need consent. Measuring visitors, showing ads and following people across websites are not strictly necessary, even when they are useful to you.

What usually triggers the need for a banner?

Usually tools added for convenience, often without the owner knowing exactly what they do:

• Google Analytics and similar tools that set cookies to recognise returning visitors
• Facebook Pixel and other ad pixels that track visitors for advertising
• Embedded YouTube videos that can set cookies or load tracking as soon as the page opens
• Embedded Google Maps that load content and scripts from Google's servers
• Fonts loaded from another company's servers, which send each visitor's IP address (the number that identifies their internet connection) to that company. This is more a data protection question than a cookie one, but it often leads to consent or privacy work.
• Some chat, booking or social media widgets, depending on how they are built

Each can be used legally with proper consent. The real question is whether you need them.

How can I avoid needing a banner?

Replace each tool with an option that does not store or read anything unnecessary on the visitor's device:

1. Use cookieless analytics. Some simple analytics tools count visits without cookies and without identifying anyone: which day, which page, which site sent the visitor, phone or desktop.
2. Link instead of embedding. Replace an embedded map with a "Get directions" link that opens the visitor's own map app. Replace an embedded video with a photo that links to the video.
3. Host fonts on your own site or use an EU font provider that does not track visitors. Your site looks exactly the same.
4. Remove ad pixels you no longer use. Many sites still carry a pixel from a campaign that ended long ago.
5. Check what is actually there. Ask whoever built your site to list every outside service it loads.

Is a banner a bad thing?

Not legally. If you need tracking or advertising, a proper consent banner is the right way to do it. But banners cover your page on phones, some visitors leave instead of choosing, and a badly made banner that loads trackers before anyone clicks does not protect you anyway. If you do not need the tools, removing them is simpler than managing consent.

What should I do if I am not sure?

Make a list of every outside service your site uses, then ask a data protection professional or read the guidance from your country's data protection authority. Rules and their interpretation differ between countries and change over time.

The easiest cookie banner to manage is the one you do not need.

For reference, sites built with Tabernio set no cookies, use cookieless analytics, load fonts from an EU provider and use map links instead of embedded maps, so its own features do not require a banner, and data is stored in the EU. You can read more at tabernio.com.

Questions

Does a privacy policy replace a cookie banner?

No. A privacy policy explains what you do with personal data, while a banner asks for permission before non-essential storage happens. If you collect any personal data, for example through a contact form, you generally need a privacy notice either way.

Can I just show a notice saying "by using this site you accept cookies"?

Generally not. Under EU rules, consent has to be an active choice made before non-essential cookies are set, so simply continuing to browse is not usually enough.

Are cookieless analytics really enough for a small business?

For most, yes. Knowing which pages people visit, on which days, from which sites and on what kind of device answers the practical questions, such as whether anyone reads the menu and whether a new listing sends visitors.