What is a cookie banner?
A cookie banner is the notice that asks a visitor's permission before storing or reading information on their device. In the EU and UK it is required for any non-essential storage, including analytics cookies. It is not required for analytics that stores nothing on the device, because there is no storage to consent to.
Worked example
The measurement cost of a compliant banner on 10,000 sessions.
| Sessions | 10,000 |
|---|---|
| Never interacted with the banner, so no consent | 3,100 |
| Actively rejected | 2,400 |
| Accepted | 4,500 |
| Sessions measurable by cookie-based analytics | 4,500 |
55% of traffic is invisible, and it is not a random 55% The people who reject are systematically more privacy-conscious, more technical and more likely to use blockers. Cookie-based analytics behind a banner is not a smaller sample of your audience, it is a different one.
What the law actually requires
The rule people mean by cookie law is the EU ePrivacy Directive, implemented nationally, and PECR in the UK. It regulates storing information on, or accessing information already stored on, a user's terminal equipment.
Two things follow from that wording, and both are widely misunderstood.
- It is about storage, not about analytics. If you store nothing, the rule does not engage, no matter what you are measuring.
- It covers more than cookies. localStorage, IndexedDB, device fingerprinting and anything else that writes to or reads from the device are in scope.
Strictly necessary storage is exempt: a session token to keep someone logged in, a cart identifier, a load balancer affinity cookie. Analytics is not considered strictly necessary in most member states, which is why analytics cookies need consent.
What makes a banner valid
Consent before storage
Nothing non-essential may be written before the visitor agrees. A banner that sets analytics cookies on page load and asks afterwards is decorative, not compliant.
Reject as easy as accept
Regulators across the EU have been explicit: no reject button on the first layer, or a reject flow buried two clicks deeper, invalidates the consent obtained.
Specific and granular
A single accept-all for analytics, advertising and personalisation is not informed consent. Purposes have to be separable.
Withdrawable
Changing your mind has to be as easy as giving consent in the first place, which means a persistent way back to the choice.
What a banner costs you
The compliance cost is the obvious one. The measurement cost is larger and less discussed.
Every visitor who declines or ignores the banner is missing from your analytics entirely, and the missing group is not random. It skews toward technical, privacy-aware, adblock-using visitors, which on a developer-facing product can be most of your actual audience.
There is a conversion cost too. An interstitial covering the page on arrival is a delay and a decision imposed before anyone has seen your content, and it lands hardest on exactly the mobile traffic that bounces fastest.
The alternative is not to skip the banner illegally. It is to remove the thing the banner exists for.
Live demo
See it on real data. The live demo is a fully populated dashboard on demo traffic, with no signup and no card.
Open the live demoCompared
With a banner, or without the storage
Cookie-based analytics plus a banner
- Cross-session identity and long attribution windows
- Consent required, and refusals are common
- Data covers only the consenting slice of your audience
- A CMP to configure, maintain and audit
Cookieless analytics, no banner
- No persistent storage on the device, so no consent to obtain
- Every visitor is counted, not just the ones who agreed
- Full source, campaign, funnel and revenue reporting within a session
- No cross-day identity, which is the honest limitation
Where mrkr fits
mrkr runs cookieless by default. In that mode it writes nothing persistent to the visitor's device, so it does not itself require a banner and it measures all of your traffic rather than the consenting fraction.
You may still need a banner for other things on the site: an advertising pixel, an embedded video player, a chat widget, an A/B testing tool. Removing analytics from the list shortens it, it does not always empty it.
If you switch a site into mrkr's optional cookie mode, that site is storing an identifier again and does need consent. That is a deliberate trade for cross-session identity, and it is worth making on purpose rather than by inheritance.
FAQ
Do I need a cookie banner for analytics?
Only if the analytics stores or reads something on the visitor's device. The ePrivacy rule is about storage on terminal equipment, not about measurement. Analytics that sets no cookie, writes no localStorage and does not fingerprint has nothing to ask consent for.
Does Google Analytics require a cookie banner?
Yes in the EU and UK. GA4 sets first-party cookies for measurement, which is non-essential storage and therefore requires prior consent. Consent mode changes what happens after a refusal, it does not remove the requirement to ask.
Is a banner needed for localStorage?
Yes, if the stored value is not strictly necessary. The rule covers storing information on the device by any means, so localStorage, sessionStorage and IndexedDB are treated the same as cookies.
Start with one line of HTML.Your first visitors show up within a minute.