Cookie banners: what is theatre and what is required

Cookie consent requirements are not about aesthetics—they’re about compliance with laws like GDPR (EU) and CCPA (California), and failing to meet them can result in fines up to 4% of global revenue. The problem? Many websites use bloated, slow, or legally ineffective banners that serve no purpose beyond checking a box. The real requirement is a functional, transparent system that respects user choices and tracks consent properly—not a pop-up that disappears after 30 seconds.

Key Takeaways

• Cookie consent is a legal requirement under GDPR/CCPA, not a marketing gimmick—your banner must actually record and respect user choices.
• A compliant banner must identify cookies, explain their purpose, and let users opt out without forcing them to accept all.
• Many "cookie banners" are theatre: they don’t track consent, don’t update when cookies change, and can’t prove compliance in an audit.
• Manual consent tracking (e.g., cookies or localStorage) is unreliable—use a dedicated consent management platform (CMP) for accuracy.
• Ignoring consent requirements risks fines, lost user trust, and legal action—especially if you collect personal data.
• Your hosting provider or CMS (like WordPress) may offer cookie solutions, but they often lack granular control or legal coverage.
• If you’re unsure whether your banner is compliant, audit it against GDPR/CCPA guidelines or consult a legal expert.

What is the cookie consent requirement?

The cookie consent requirement stems from laws like the General Data Protection Regulation (GDPR) (EU) and the California Consumer Privacy Act (CCPA), which mandate that websites must obtain explicit consent before storing or accessing user data via cookies or similar technologies. This is not optional—it’s a legal obligation. The requirement applies if your website collects personal data (e.g., IP addresses, browsing behaviour) or uses cookies for analytics, advertising, or personalisation.

The core mechanism is simple: you must inform users about the cookies your site uses, explain their purpose, and give them a meaningful choice to accept or reject them. Failure to comply can lead to fines, legal action, and damage to your reputation. Many websites, however, treat cookie banners as a checkbox exercise rather than a compliance necessity.

Why does this matter in production?

In production, a poorly implemented cookie banner doesn’t just look unprofessional—it can break compliance, trigger legal risks, and even cause technical issues. For example, if your banner doesn’t track consent properly, you may unknowingly violate GDPR/CCPA. Worse, if users can’t opt out of analytics cookies, you might be collecting data without their knowledge, which could lead to fines or lawsuits.

Beyond legality, a slow or intrusive banner harms user experience, increasing bounce rates and reducing conversions. A compliant banner, on the other hand, builds trust by being transparent and respectful of user choices. In practice, we’ve seen clients who assumed their banner was compliant discover it wasn’t during an audit—leading to costly fixes and reputational damage.

When do you actually need a cookie consent banner?

You need a cookie consent banner if your website uses any of the following:

• Tracking cookies (e.g., Google Analytics, Facebook Pixel, heatmaps).
• Advertising cookies (e.g., retargeting ads, personalised content).
• Session cookies that store personal data (e.g., login sessions).
• Third-party scripts that may set cookies (e.g., embedded videos, social media widgets).

If you only use essential cookies (e.g., for authentication or security), you may not need a banner—but you still must document their purpose and ensure they don’t collect unnecessary data. Always check your jurisdiction’s specific rules, as requirements vary slightly (e.g., GDPR vs. CCPA).

How does cookie consent actually work?

The mechanism behind cookie consent is straightforward but often misimplemented. When a user visits your site, the banner must:

1. List all cookies (or categories of cookies) your site uses, along with their purpose (e.g., "analytics," "advertising").
2. Provide clear, concise explanations of what each cookie does and why it’s needed.
3. Offer users a choice to accept or reject cookies (or granular control over specific categories).
4. Store the user’s choice (e.g., via a cookie or localStorage) so it persists across sessions.
5. Only load non-essential cookies after the user has given consent.
6. Allow users to revoke consent at any time (e.g., via a "Preferences" link).

Many websites fail at step 4—they don’t actually track consent, or they use unreliable methods like JavaScript variables that reset on page refresh. A proper solution requires a persistent storage mechanism (e.g., an HTTP-only cookie or localStorage) that survives page reloads.

Step-by-step: How to implement a compliant cookie banner

Implementing a compliant banner isn’t complex, but it requires attention to detail. Below is a step-by-step guide to setting it up correctly.

1. Audit your cookies: Identify all cookies your site uses, including third-party scripts. Tools like MDN’s cookie guide or browser extensions (e.g., Cookie Scanner) can help.
2. Choose a consent management solution. Options include:
   • Dedicated CMPs (e.g., OneTrust, Cookiebot, Usercentrics), which handle tracking, updates, and compliance out of the box.
   • Manual implementation (e.g., using a library like Consent Manager), which gives you full control but requires more effort.
   • CMS plugins (e.g., for WordPress, GDPR Cookie Consent), which are easier but may lack granularity.

   For most businesses, a CMP is the safest choice, as it ensures compliance and updates automatically when laws or cookie policies change.

3. Configure the banner:
   • List all cookie categories (e.g., "Analytics," "Advertising," "Necessary").
   • Provide a clear explanation for each category.
   • Set the default to "Deny all" (users must actively accept).
   • Include a "Preferences" link for granular control.
4. Implement consent tracking:
   • Use a persistent storage method (e.g., an HTTP-only cookie or localStorage) to save user choices.
   • Ensure the tracking mechanism survives page refreshes and browser restarts.
   • Avoid relying on sessionStorage, as it resets when the tab closes.
5. Load non-essential scripts conditionally:
   • Only load analytics, ads, or other non-essential scripts after the user consents.
   • Use JavaScript to check consent status before loading scripts (e.g., `if (userConsent === 'granted') { loadAnalytics(); }`).
6. Test and audit:
   • Verify the banner works across browsers and devices.
   • Check that consent persists after page reloads.
   • Ensure third-party scripts respect the user’s choice.
   • Conduct a compliance audit to confirm GDPR/CCPA adherence.

Warning: If you’re using a CMS like WordPress, avoid plugins that only add a banner without proper consent tracking. Many "cookie plugins" are just theatre—they don’t actually enforce compliance. Always check if the plugin tracks consent persistently.

Configuration that actually matters

The devil is in the details. Here are the critical configurations to get right:

How to verify your cookie banner works

Verification is critical—many banners look compliant but fail in practice. Here’s how to test:

1. Check consent persistence:
   • Accept cookies, then refresh the page. Does the banner reappear?
   • Close the browser and reopen it. Does consent persist?
   • Use browser dev tools to inspect cookies/localStorage—can you see the consent status?
2. Test third-party scripts:
   • Deny all cookies, then check if analytics scripts (e.g., Google Analytics) load.
   • Accept analytics cookies, then verify the script loads.
3. Check the "Preferences" link:
   • Can users revoke consent for specific categories?
   • Does the banner update accordingly?
4. Audit compliance:
   • Review your cookie policy to ensure it matches the banner’s explanations.
   • Check if you can prove consent in an audit (e.g., via logs or a CMP dashboard).

Common failure modes:

• Consent not stored persistently (e.g., using sessionStorage instead of cookies/localStorage).
• Third-party scripts ignore consent (e.g., Google Analytics loads regardless of user choice).
• Banner disappears too quickly (e.g., auto-hides after 30 seconds without user interaction).
• No "Preferences" link (users can’t manage consent granularly).
• Legal text is vague or misleading (e.g., "We use cookies" without explaining what they do).

Failure modes and how to debug them

If your banner isn’t working, here’s how to diagnose the issue:

1. Consent not saving:
   • Check if you’re using the right storage method (e.g., `document.cookie` for HTTP-only cookies or `localStorage.setItem`).
   • Verify the cookie/localStorage key is correct (e.g., `consent_status`).
   • Test in incognito mode—some browsers block localStorage by default.
2. Scripts loading without consent:
   • Inspect the network tab in dev tools—are scripts loading before consent is checked?
   • Check if third-party scripts have their own consent mechanisms (e.g., Google Analytics may require additional setup).
3. Banner not appearing:
   • Is the banner script blocked by an ad blocker or browser extension?
   • Is the script loading after the page renders (e.g., due to async/defer)?
4. Consent not respected on subdomains:
   • Cookies/localStorage are domain-scoped—if your site has multiple subdomains (e.g., `app.yoursite.com`), consent may not transfer.
   • Use a dot-prefixed domain (e.g., `.yoursite.com`) to ensure consistency.

Example debug command: To check if consent is stored, open the browser console and run:

console.log(document.cookie); // For HTTP-only cookies
console.log(localStorage.getItem('consent_status')); // For localStorage

If nothing appears, your consent isn’t being saved correctly.

Cost and operational overhead

The cost of a compliant cookie banner depends on your approach:

The simplest option is a CMS plugin (e.g., for WordPress), but these often lack granular control and may not update automatically when laws change. A dedicated CMP (e.g., OneTrust or Cookiebot) is more expensive but ensures compliance and reduces operational burden. Manual implementation is the cheapest but requires ongoing maintenance and testing.

For most businesses, the cost of a CMP is outweighed by the risk of non-compliance. Fines under GDPR/CCPA can reach 4% of global annual revenue—far more than the cost of a proper solution.

Security considerations

Cookie consent isn’t just a legal issue—it’s also a security one. Here’s what to watch for:

• Cookie hijacking: If you store consent in a regular cookie (not HTTP-only), it could be stolen via XSS attacks. Always use HTTP-only cookies for sensitive data.
• Third-party risks: If a third-party script (e.g., an ad network) sets cookies without consent, you’re still liable. Ensure all scripts respect your consent mechanism.
• Data minimisation: Only collect the data you need. Avoid storing unnecessary personal information in cookies.
• Secure connections: Ensure all cookie-related traffic uses HTTPS to prevent interception.

We’ve seen clients whose "secure" banners were vulnerable to XSS because they used regular cookies instead of HTTP-only ones. Always follow security best practices when implementing consent tracking.

Common mistakes we see in production

After helping dozens of clients fix their cookie banners, here are the most common mistakes:

• Assuming a plugin is enough: Many WordPress plugins add a banner but don’t actually track consent. They’re just theatre.
• Not updating cookie lists: Websites often forget to add new cookies (e.g., from a new analytics tool) to the banner, leading to non-compliance.
• Forcing users to accept all: GDPR/CCPA require users to opt in, not opt out. Defaulting to "Accept all" is illegal.
• Ignoring third-party scripts: Many sites assume their banner covers third-party cookies (e.g., Facebook Pixel), but these often bypass consent mechanisms.
• No audit trail: Without logs or a CMP dashboard, you can’t prove compliance in an audit. Many clients realise too late that their banner doesn’t track consent properly.

One client we worked with had a banner that looked compliant but failed because their analytics script loaded before consent was checked. The fix required rewriting the script-loading logic, which took weeks to debug.

A realistic scenario: Fixing a non-compliant banner

Let’s say you run an e-commerce site using WooCommerce on WordPress. Your current banner is a simple plugin that adds a pop-up but doesn’t track consent. Here’s how to fix it:

1. Audit your cookies: Use a tool like Cookie Scanner to list all cookies (e.g., WooCommerce session cookies, Google Analytics, Facebook Pixel).
2. Replace the plugin: Uninstall the existing banner and install a dedicated CMP like GDPR Cookie Consent (but note: this is still manual—better to use a CMP with a WordPress plugin).
3. Configure consent storage:

   // Example: Store consent in an HTTP-only cookie
   document.cookie = "consent_status=granted; path=/; Secure; HttpOnly";
   

4. Update script loading:

   // Only load analytics if consent is granted
   if (document.cookie.includes("consent_status=granted")) {
     (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){(i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)})(window,document,'script','https://www.google-analytics.com/analytics.js','ga');

5. Test and audit:
   • Verify consent persists across sessions.
   • Check that analytics scripts load only after consent.
   • Conduct a compliance review to ensure GDPR/CCPA adherence.

If this seems complex, our team can help you audit and implement a compliant solution without risking fines or legal action.

Alternatives compared

If you’re weighing your options, here’s how different approaches compare:

Approach	Control	Maintenance	Compliance risk	Best for
Manual implementation	Full	High	High (easy to miss updates)	Small sites with simple needs
CMS plugin (WordPress)	Limited	Moderate	Moderate (many are theatre)	Small sites, few cookies
Dedicated CMP	High	Low (provider handles)	Low	Most businesses

The "simpler option" (e.g., a CMS plugin) often wins for small sites with minimal cookies, but it’s a false economy if you later add analytics or ads. For most businesses, a dedicated CMP is worth the cost—it ensures compliance, reduces risk, and saves time in the long run.

In short

A compliant cookie consent banner isn’t optional—it’s a legal requirement under GDPR/CCPA. The key steps are:

1. List all cookies and their purposes clearly.
2. Let users opt in (not out) and track their choice persistently.
3. Only load non-essential scripts after consent.
4. Avoid theatre banners—use a dedicated CMP for reliability.
5. Test thoroughly and audit compliance regularly.

If your current banner feels like an afterthought, it probably is. Our team can help you implement a solution that actually works—or audit your existing setup to confirm it’s compliant.

People also search for

• How cookie consent affects your website’s performance and budget
• When a hosting upgrade triggers cookie consent requirements
• Legal compliance as a core website requirement
• Why off-the-shelf cookie plugins often fail compliance
• Need help with cookie consent or other web compliance?
• See how we’ve helped clients fix non-compliant setups
• Still unsure? Check our FAQs on web compliance
• More guides on technical and legal website requirements

Cookie consent isn’t just a checkbox—it’s a foundation of trust. If your banner isn’t working, the risk isn’t just legal. It’s your users’ trust in your site. Let’s fix it properly—before an audit or a fine forces you to. Contact our team for a compliance review, or see how we approach ongoing site maintenance and compliance.