Why cookie consent matters beyond compliance

Cookie consent gives website visitors control over how their information is stored, accessed and used, while also playing a key role in the data that businesses can collect for analytics and marketing. 

Understanding consent can help protect user trust, make tracking more transparent and, importantly, make sure you know what your website is actually doing.

TL;DR

• You don’t automatically need a cookie banner. It depends on what your website stores, accesses and uses.
• Cookies aren’t the whole picture anymore. Tracking pixels, scripts, tags and web storage can also fall under the rules.
• Consent can affect your analytics. If visitors don’t consent to analytics, you may have less data available in tools such as GA4.
• Consent should be considered during the website project, not at launch. Understanding what tools and integrations are being used early makes implementation much easier.
• It’s also about trust. Visitors should understand what happens when they use your website and have meaningful control over their choices.

What is cookie consent?

Cookies are small files that websites can store on a visitor’s device. They can be used for practical things, such as keeping someone logged in or remembering what’s in a shopping basket.

They can also be used to understand how people use a website, track behaviour, and provide valuable insights to a business to inform their marketing approach. By clicking ‘accept cookies’, you provide consent for your data to be tracked and stored.

But it isn’t just cookies that need to be considered when it comes to tracking. The Information Commissioner’s Office (ICO) now uses the broader term “storage and access technologies”,  which includes cookies, tracking pixels, web storage, scripts and tags, and more. These technologies can support everything from website functionality and analytics to advertising attribution and campaign performance tracking. The ICO finalised its updated guidance in April 2026, following changes introduced by the Data (Use and Access) Act 2025.

Do I need a cookie banner on my website?

Not necessarily. It depends on what your website is actually doing.

Some cookies and similar technologies, such as those needed to keep someone logged in or to run a checkout, don’t require consent. There’s also a limited exception for basic analytics that only measure how a site is performing. But it has conditions, and it doesn’t cover advertising or tracking people across different websites.

So, rather than adding a cookie banner because every other website seems to have one, the first question should really be: what is your website actually doing, and what information is it obtaining or using?

What if I’m not tracking visitors?

Even if your website doesn’t use non-essential tracking, there’s still value in understanding what is happening behind the scenes. Cookie consent is ultimately about transparency and giving people control over what happens when they visit your website. 

Often people say “we don’t track visitors”. But what this really means is “we aren’t deliberately tracking visitors”. You might not be running Google Ads or Meta ad campaigns, but your website could still have a Google Analytics script, embedded video or maps, chat software, booking tools, marketing integrations or other third-party scripts.

That doesn’t automatically mean all of these require consent. But it does mean they’re worth double-checking!

The ICO’s latest guidance puts meaningful user control at the centre of its approach and says that 99% of the UK’s top 1,000 websites now meet its compliance standards for cookie banners.

This conversation can matter even for businesses that aren’t running marketing campaigns. It’s often assumed that cookie consent only matters if you’re running ad campaigns or collecting lots of data. In reality, you don’t need to be doing either to benefit from understanding what your website is doing.

Why does cookie consent matter if I use Google Analytics?

If someone declines analytics consent, Google Analytics won’t be able to observe their activity in the same way as it can for someone who has consented. That can leave gaps in your reporting, which matters if you’re using website data to understand where visitors come from, which campaigns are working, what pages people visit or how many people complete an enquiry, for example.

This is where Google Consent Mode comes in. In simple terms, it allows Google tags to adjust their behaviour according to a visitor’s consent choices. Where the requirements are met, Google can also use behavioural modelling. Put simply, it’s educated guessing: Google looks at the behaviour of visitors who did consent and uses it to estimate what the visitors who didn’t might have done. It fills gaps in your reporting with estimates, not individual tracking.

It’s important to explain that this doesn’t mean consent is being bypassed. If someone says no, their choice still needs to be respected. Instead, modelling can help businesses understand their data without simply treating every person who declines consent as if they don’t exist.

This is also why consent needs to be considered alongside analytics, rather than added as an afterthought. Your cookie banner, tracking setup and reporting all need to work together.

Why is cookie consent a website project issue, not just a marketing one?

This is the part that stands out to me most as a Digital Project Manager.

Cookie consent is often treated as a launch-day checklist item. It’s an easy detail to overlook: the build is nearly done, and someone asks what happens with analytics and cookies. At that point, decisions that would have been simple earlier become part of a tight launch schedule.

That’s why we raise it during discovery, alongside content, functionality, integrations, hosting and analytics. It’s much easier to understand which tools are in play and how they should behave before development starts than to uncover a third-party script doing something unexpected right before go-live.

What should a good cookie banner do?

The best cookie banners shouldn’t make the website difficult to use, but they also shouldn’t hide important information behind confusing language. The ICO’s guidance emphasises meaningful choice and transparency, so I’d keep the basics fairly simple:

• Be clear: Explain what you’re asking for in language people understand – there’s no need to overcomplicate it.
• Give people a genuine choice: Don’t make accepting cookies significantly easier than refusing them.
• Be specific: Where different types of tracking are used, give people meaningful options.
• Let people change their mind: Users should be able to withdraw their consent.

Cookie consent is about more than compliance

Yes, there are legal requirements around cookies and other storage and access technologies. But if that’s the only reason you’re thinking about consent, you’re missing part of the conversation.

It’s also about trust.

Your website is often the first interaction someone has with your business. Being transparent about what happens when they visit is part of that relationship, whether you’re a large ecommerce brand running multiple advertising campaigns or a small business with a handful of pages and a contact form.

You might not think you’re tracking anyone. You might not even need a traditional cookie banner. But you should understand what your website is doing.

From a project management perspective, that’s probably the biggest takeaway I’d want a client to have: don’t wait until launch to ask what cookies are being used. Understand what your website is doing, decide what consent is needed and make sure the experience is clear for the people using it.

That’s a much more useful approach than simply adding a cookie banner because a checklist says you need one.