Stygeon

Blog

Cookie banner: when you really need one, and when you don’t

5 min read

Many websites show a cookie banner out of habit, because “that’s what you do”. Sometimes it isn’t needed at all. Other times the banner is there but blocks nothing: the trackers start as soon as the page opens. That’s the worst case, because it annoys visitors and doesn’t protect you.

Here is when a banner is really needed and how it must work, with the Italian rules as the reference (the EU rules behind them are the same everywhere). It’s a practical guide, not legal advice.

The rule in one line

To store or read information on a visitor’s device you need their consent, first, unless it is strictly necessary for the service they asked for. This comes from the EU ePrivacy rules; in Italy it is Art. 122 of the Privacy Code, explained by the Italian data protection authority (the Garante) in its guidelines on cookies and other tracking tools of 10 June 2021, in force since 10 January 2022.

Two details that are often missed:

  • it isn’t only about cookies: it also covers similar tools, such as storage in the browser (localStorage), pixels and device fingerprinting;
  • you always need a notice explaining what you use, even when consent isn’t needed.

These are the ones without which the site can’t do what the visitor asked: the session after logging in, a shop’s basket, the chosen language or theme, the security and anti-bot protection of the hosting provider or CDN.

For these no banner is needed. Explaining them in the notice is enough, and that can be part of the privacy policy.

Analytics: it depends on how you collect them

Visit statistics can be treated like technical cookies, so without consent, only under precise conditions:

  • they are used to produce aggregate statistics, for the single site that collects them;
  • the IP address is masked (at least its last part);
  • the provider does not combine the data with other data and does not use it for its own purposes.

Tools that use no cookies and don’t identify visitors fit here, for example the aggregate statistics some hosting providers and CDNs offer, or Matomo installed on your own server and configured correctly.

Google Analytics usually doesn’t meet these conditions, because Google can also use the data for its own services. The careful approach is to turn it on only after consent.

No exceptions here. These need consent before they start:

  • Meta Pixel (Facebook and Instagram), Google Ads, LinkedIn Insight, TikTok Pixel;
  • tools that record visitor sessions, such as Hotjar or Microsoft Clarity;
  • in general, anything used to recognise the visitor across sites or to show them targeted ads.

External content: the most forgotten

A YouTube video, a Google Maps map or Google Fonts loaded from Google’s servers: when the page opens, the external service receives the visitor’s IP address, and some also set their own cookies.

The fixes are simple:

  • host the fonts on your own site instead of loading them from Google;
  • load videos and maps after the visitor clicks, or after consent. YouTube’s “privacy-enhanced mode” reduces cookies but doesn’t remove the connection to Google.

So: does your site need a banner?

  • Technical cookies only and anonymous aggregate statistics, no external content: no banner needed. The notice is enough.
  • Even one advertising tool, session recording, Google Analytics or external content loaded when the page opens: you need a banner, with consent collected first.

This site is a concrete example: it sets no cookies, measures visits with cookieless aggregate statistics, hosts its own fonts and loads no external videos or maps. The light or dark theme a visitor picks is remembered in the browser, but it’s a preference they asked for, so it’s technical. Result: no banner.

If you need a banner, it must actually work

The most common problem isn’t a missing banner, it’s a banner that blocks nothing. A correct banner:

  • starts no tracker before the visitor chooses: non-anonymous analytics, pixels and external content start only after consent;
  • closing it with the X counts as a refusal: only technical cookies stay on;
  • scrolling is not consent, and no boxes are pre-ticked;
  • lets visitors accept all, refuse all or choose by purpose, with clear controls;
  • doesn’t come back within six months after a refusal, unless something important changes;
  • lets visitors change their mind at any time, through a link that’s always there, usually in the footer;
  • doesn’t lock people out if they refuse (a so-called cookie wall, generally not allowed).

The most common consent tools in Italy (iubenda, Cookiebot, CookieYes, Complianz and others) do most of this, but only when set up properly: the tracker’s script has to be tied to consent, not just added to the page.

How to check your site

Two quick ways:

  • in the browser: open the site in a private window and, without clicking anything, look at the stored cookies (in the developer tools, under Application or Storage). If cookies like _ga, _fbp or _gcl_au appear, trackers start before consent;
  • with Ronda, our free check: it reads the home page and reports trackers and advertising, cookies set on the first visit, external services loaded when the page opens, and whether the privacy and cookie policy links are there.

In short

You need a banner only if you use tools that aren’t strictly necessary: advertising, profiling, Google Analytics or external content. If you need one, it must really block those tools until the visitor chooses. And often the best fix is the simplest: remove what you don’t use, and the banner is no longer needed.

All articles