Cookie notice: what belongs on the banner and what belongs behind it

A cookie notice is the message telling visitors what your site stores on their device, what it is used for, and how they can accept or refuse it. It is usually the first thing anyone sees on a website, it is almost universally disliked, and a surprising share of them do not do the job they exist for — because the tracking has already started by the time the banner appears.

The underlying rule in most regimes that require consent is narrow and easy to state: cookies that are not strictly necessary for the site to work should not be set until the visitor has agreed. Everything else about banner design follows from that.

What a cookie notice has to do

• Say what categories of cookie the site uses, in language a visitor understands.
• Explain what each category is for — the site working, remembering preferences, measuring traffic, advertising.
• Let the visitor accept or refuse the non-essential ones before they are set.
• Make refusing as easy as accepting. A prominent Accept beside a buried Manage is the pattern regulators single out.
• Let the choice be changed later, from somewhere findable.
• Record what was chosen and when, so you can show it if asked.
• Link to the fuller explanation — which is the cookie policy, a separate document from the banner.

Strictly necessary is narrower than most sites assume. Keeping someone logged in, holding a shopping basket, remembering a language choice — those qualify. Analytics generally does not, however useful it is to you, and calling it essential because you rely on it is the most common way a notice becomes wrong.

The mistakes that make a notice worthless

Loading scripts before consent is the big one, and it is usually accidental: the banner is added last, on top of a site where the analytics and advertising tags are already in the page head. The visitor clicks Reject, and the cookies were set two seconds earlier. If you only check one thing, check that.

After that comes the design pressure. Accept in colour and Reject as grey text, a second click needed to refuse, pre-ticked categories, or a banner that keeps returning until the visitor gives in — all of these have been ruled unacceptable in various jurisdictions, and all of them are still everywhere. And a banner that blocks the page entirely tends to lose you the visitor rather than win consent.

Setting one up

1. Inventory what the site actually sets, using the browser's own developer tools rather than what you believe is installed.
2. Group them into essential, preferences, statistics and marketing, and drop anything nobody uses.
3. Block the non-essential ones from loading until consent — this is a technical change, not a banner setting.
4. Write the categories in plain language, with a real example of what each does.
5. Give accept and reject the same visual weight and the same number of clicks.
6. Add a persistent way to change the choice, and link the cookie policy from the banner.
7. Store the record of consent with its date and what version of the notice it applied to.
8. Re-check after any new tool is added, since embeds and pixels arrive with their own cookies.

Cookie notice, cookie policy, privacy notice

Three documents, routinely conflated. The cookie notice is the short interaction asking for a decision. The cookie policy is the fuller page listing the specific cookies, their purpose and their lifespan. The privacy notice covers all personal data processing, of which cookies are one part. Keeping them separate makes each readable; merging them produces the wall of text nobody reads.

Requirements differ by jurisdiction — what needs consent, how it must be obtained, and what counts as necessary are not the same everywhere, and enforcement has been active in this area. Treat the specifics as a legal question for your market, not something to settle from a blog post or by copying the banner from a site you admire.

Fewer cookies is the real fix

The most effective approach is not a better banner. It is having less to consent to. Sites built without third-party advertising tags and with restrained analytics need a much smaller notice, and the visitor experience is better in every respect.

That is broadly the position sites built with Ettex Sites start from: pages are served without advertising or third-party tracking added by us, so what a visitor is asked to accept is what you deliberately added rather than a stack that arrived by default.

Be clear on the limits: there is no consent-management platform built in — no banner component with per-category toggles, no consent log, and no script-blocking that holds tags back until a visitor agrees. If you embed analytics, a chat widget or an advertising pixel, the notice and the blocking are yours to arrange, usually with a dedicated tool.

Block the non-essential scripts until someone answers, give reject the same weight as accept, keep the notice and the policy separate — and reduce what you set in the first place.