What is a cookie banner?
A cookie banner asks permission before storing anything on a visitor's device. When it is required, what makes one valid, and what it costs in data quality.
What is a cookie banner?
A cookie banner is the notice that asks a visitor's permission before storing or reading information on their device. In the EU and UK it is required for any non-essential storage, including analytics cookies. It is not required for analytics that stores nothing on the device, because there is no storage to consent to.
A worked example.
The measurement cost of a compliant banner on 10,000 sessions.
| Sessions | 10,000 |
|---|---|
| Never interacted with the banner, so no consent | 3,100 |
| Actively rejected | 2,400 |
| Accepted | 4,500 |
| Sessions measurable by cookie-based analytics | 4,500 |
55% of traffic is invisible, and it is not a random 55%
The people who reject are systematically more privacy-conscious, more technical and more likely to use blockers. Cookie-based analytics behind a banner is not a smaller sample of your audience, it is a different one.
What the law actually requires
The rule people mean by cookie law is the EU ePrivacy Directive, implemented nationally, and PECR in the UK. It regulates storing information on, or accessing information already stored on, a user's terminal equipment.
Two things follow from that wording, and both are widely misunderstood.
- It is about storage, not about analytics. If you store nothing, the rule does not engage, no matter what you are measuring.
- It covers more than cookies. localStorage, IndexedDB, device fingerprinting and anything else that writes to or reads from the device are in scope.
Strictly necessary storage is exempt: a session token to keep someone logged in, a cart identifier, a load balancer affinity cookie. Analytics is not considered strictly necessary in most member states, which is why analytics cookies need consent.
What makes a banner valid
Consent before storage
Nothing non-essential may be written before the visitor agrees. A banner that sets analytics cookies on page load and asks afterwards is decorative, not compliant.
Reject as easy as accept
Regulators across the EU have been explicit: no reject button on the first layer, or a reject flow buried two clicks deeper, invalidates the consent obtained.
Specific and granular
A single accept-all for analytics, advertising and personalisation is not informed consent. Purposes have to be separable.
Withdrawable
Changing your mind has to be as easy as giving consent in the first place, which means a persistent way back to the choice.
What a banner costs you
The compliance cost is the obvious one. The measurement cost is larger and less discussed.
Every visitor who declines or ignores the banner is missing from your analytics entirely, and the missing group is not random. It skews toward technical, privacy-aware, adblock-using visitors, which on a developer-facing product can be most of your actual audience.
There is a conversion cost too. An interstitial covering the page on arrival is a delay and a decision imposed before anyone has seen your content, and it lands hardest on exactly the mobile traffic that bounces fastest.
The alternative is not to skip the banner illegally. It is to remove the thing the banner exists for.
See it on real data
The live demo is a fully populated dashboard with real demo traffic. No signup and no card required.
Open the live demo
With a banner, or without the storage
Cookie-based analytics plus a banner
- Cross-session identity and long attribution windows
- Consent required, and refusals are common
- Data covers only the consenting slice of your audience
- A CMP to configure, maintain and audit
Cookieless analytics, no banner
- No persistent storage on the device, so no consent to obtain
- Every visitor is counted, not just the ones who agreed
- Full source, campaign, funnel and revenue reporting within a session
- No cross-day identity, which is the honest limitation
Where Mrkr fits
Mrkr runs cookieless by default. In that mode it writes nothing persistent to the visitor's device, so it does not itself require a banner and it measures all of your traffic rather than the consenting fraction.
You may still need a banner for other things on the site: an advertising pixel, an embedded video player, a chat widget, an A/B testing tool. Removing analytics from the list shortens it, it does not always empty it.
If you switch a site into Mrkr's optional cookie mode, that site is storing an identifier again and does need consent. That is a deliberate trade for cross-session identity, and it is worth making on purpose rather than by inheritance.
Questions, answered.
Related terms.
- What is cookieless analytics?
Cookieless analytics measures website traffic without storing a cookie, a localStorage value or any other identifier on the visitor's device.
- What is cookieless tracking?
Cookieless tracking is any method of recognising visits without storing an identifier in the browser.
- What is first-party data?
First-party data is information you collect directly from your own audience on your own properties: site behaviour, purchases, support conversations, and anything customers tell you.
- What is tracking pixel?
A tracking pixel is a tiny, usually invisible image embedded in a web page or an email.
- What is web analytics?
Web analytics is the collection, measurement and analysis of what happens on a website: who visits, where they came from, which pages they see, and what they do before they leave.
Where this shows up in Mrkr
- Remove the reason for the banner with cookieless analytics
The mechanism, the legal reasoning, and where cookie mode changes it.
- See a full dashboard built without any device storage
- Browse the full analytics glossary
Every metric, method and privacy term, defined in one place.
Your first visitor is already here.
Drop in the script and watch them land. It takes about a minute.