Consent banners are usually built once, badly, and never revisited. The common version manages to be both non-compliant and worse for your data than a correct one. Not legal advice, and worth a lawyer's read if you operate at scale.
What the rules broadly require
- Consent before non-essential storage. Analytics and advertising cookies wait; loading them first and asking afterwards is the most common failure.
- Refusing must be as easy as accepting. A prominent Accept and a buried Decline is the pattern regulators have specifically acted on.
- Specific and informed. "By using this site you agree" is not consent.
- Withdrawable. There must be a way to change your mind later.
- No pre-ticked boxes for optional categories.
The design that satisfies both sides
Two buttons of equal visual weight, one line of plain text, a link to the detail, and nothing blocking the page. This is both more defensible and better performing than the dark-pattern version, because a banner that traps people generates resentment and a bounce.
Keeping useful data
Consent mode is the mechanism worth understanding: the analytics tag loads immediately but with storage denied, so no cookie is written and no identifiable hit is sent. On consent it switches to granted without a reload. Decline, and it stays denied.
The benefit is that you keep a coherent measurement setup rather than a script that either exists or does not, and providers can model the gap from consented traffic.
The alternative worth considering
Cookieless analytics. Several tools measure page views and referrers without storing anything on the device, which in many interpretations removes the consent requirement entirely.
You lose cross-session identity and detailed funnels. For a marketing site or a small store that is often an acceptable trade, and no banner at all is a genuinely better experience.
Common mistakes
- 01Loading analytics before consent, then asking. The cookie already exists.
- 02Treating dismissal as acceptance. Closing a banner is not consent.
- 03No way to change the choice afterwards.
- 04A policy that does not match reality. If the page says no analytics and analytics run, that is the clearest possible failure and the easiest to check.
That last one is worth an annual review. Policies are written once and tools get added continuously, and the drift is silent.
Working on something like this?
We build websites, stores and custom applications, and we will tell you honestly if the thing you are describing does not need one.