Do I need a cookie banner?
Answer four questions and find out whether your site actually needs a consent banner, and which of your tools is causing it. Free, no account, nothing leaves your browser.
- Free, no account
- Runs in your browser
- Nothing is sent to us
Answer every question to get a result. Your answers stay in this browser tab and are never sent anywhere.
This is general guidance, not legal advice. Consent obligations depend on your jurisdiction, your specific tools and what you do with the data. For a binding answer about your own site, ask a qualified lawyer.
How the answer is worked out
Two independent tests decide it, and failing either one means you need consent.
Test one, storage. Does anything store or read data on the visitor’s device? In the EU that is ePrivacy Directive 2002/58/EC Article 5(3); in the UK it is Regulation 6 of PECR, covered by the ICO’s cookies guidance. Note the wording: storage and access, not cookies. localStorage, sessionStorage, IndexedDB and device fingerprinting are all caught by the same sentence.
Test two, personal data. Does anything retain personal data about visitors? Retained IP addresses usually count. In Breyer (C-582/14) the Court of Justice held that a dynamic IP address can be personal data for a site operator where means reasonably likely to be used exist to identify the person behind it. A stable pseudonymous identifier is personal data too, even hashed.
There is a narrow exemption from the first test for storage that is strictly necessary for a service the visitor explicitly requested. A login session qualifies. A shopping basket qualifies. Analytics does not, because your site works for the visitor whether or not you count them, and “essential to our business” is a different test from “strictly necessary to the requested service”.
Why “not sure” counts as yes
The tool routes every uncertain answer to the cautious branch. That is deliberate. In practice, “I am not sure whether anything writes to the device” almost always resolves to “yes, something does” once someone actually opens the storage tab in devtools, because embedded video players, chat widgets, A/B testing tools and ad pixels all commonly do it without being announced.
If you want certainty rather than a guess, open your site in a private window, look at Application then Storage in Chrome devtools before interacting with anything, and see what is already there.
What usually causes it
In rough order of how often each one turns out to be the culprit:
- Google Analytics or another cookie-based analytics tool. The most common cause and by far the easiest to remove, because cookieless replacements exist that do the same job.
- Ad and conversion pixels. Meta, LinkedIn, TikTok. These exist specifically to identify people across sites, so they will always need consent.
- Embedded video. A standard YouTube embed sets cookies on load. The privacy-enhanced domain reduces but does not always eliminate this.
- Chat and support widgets. Most set a persistent identifier so a conversation survives a reload.
- A/B testing and personalisation tools. They need to remember which variant a visitor saw, which means storage.
Each one is a separate decision. Removing analytics does not help if a Meta pixel is still firing.
Removing the cause rather than the banner
The banner is a symptom. Teams spend real effort tuning consent-rate optimisation, when the shorter path for most sites is to remove the two or three things that need consent in the first place.
Analytics is the usual place to start because a direct replacement exists. sonex sets no cookies, writes nothing to the visitor’s device, and retains no personal data, so neither test applies to it. If it is the only thing on your site that needed consent, the banner goes with it.
If you keep an ad pixel, you keep the banner. That is a legitimate trade, and worth making deliberately rather than by default: it is worth knowing how much traffic the banner is hiding from you before deciding the pixel is worth it.
Frequently asked.
- Is a cookie banner legally required?
- No law says "show a banner". What the law requires is consent before storing or reading information on a visitor's device, and a lawful basis for processing personal data. The banner is just how most sites collect that consent. Remove the storage and the personal data and there is nothing left to consent to.
- Which laws decide this?
- In the EU, the ePrivacy Directive 2002/58/EC Article 5(3) governs storing or accessing information on a user's device, and the GDPR governs any personal data that results. In the UK the storage rule is Regulation 6 of PECR, enforced alongside the UK GDPR. California's CCPA and CPRA create separate but overlapping obligations.
- Are analytics cookies strictly necessary, so exempt?
- Generally no. The exemption covers storage strictly necessary to deliver a service the visitor explicitly asked for, such as a login session or a shopping basket. Regulators including the ICO have been consistent that analytics does not qualify, because the site works fine for the visitor whether or not you count them.
- Does using localStorage instead of cookies avoid the banner?
- No. Article 5(3) and PECR Regulation 6 are written about storing or accessing information on the device, not about cookies specifically. localStorage, sessionStorage, IndexedDB and device fingerprinting are all covered by the same rule.
- Is this legal advice?
- No. This tool is general guidance based on how the main rules are usually applied. Your obligations depend on your jurisdiction, your specific tools and what you do with the data. For a binding answer about your own site, ask a qualified lawyer.