Legal
How to set up cookie consent correctly
Block non-essential cookies until consent is given, make refusing as easy as accepting, and record what each person chose. A banner that sets analytics cookies before you click is not consent — it is a notification.
Before you start
- A full list of cookies your site sets
- Access to the templates and tag configuration
The steps
-
Step 1: Audit what you set
DevTools → Application → Cookies, on a fresh visit. Include third-party cookies from embeds.
-
Step 2: Classify each one
Strictly necessary, functional, analytics, or marketing. Only strictly necessary is exempt from consent.
-
Step 3: Block the rest by default
Nothing non-essential fires before consent. This is the requirement most banners fail.
-
Step 4: Make reject as easy as accept
Both at the top level, equally prominent. Burying reject behind a settings page is non-compliant.
-
Step 5: Offer granular choice
Per category, not a single all-or-nothing switch.
-
Step 6: Record the choice
What was consented to and when, so you can evidence it.
-
Step 7: Allow withdrawal
A persistent link to reopen preferences. Consent that cannot be withdrawn is not valid consent.
-
Step 8: Test it
Clear cookies, load the site, reject everything, and confirm nothing non-essential fires.
The simplest compliant answer
Set no non-essential cookies at all. A privacy-respecting analytics tool that uses no cookies removes the banner entirely — which is faster, better for conversion, and eliminates a whole category of compliance risk.
What a non-compliant banner costs
It layers a legal exposure on top of a conversion problem: the banner annoys everyone, and it does not achieve the compliance it was installed for. Both problems disappear together if you can avoid the cookies.
The background behind this
Buying a website: the questions that decide what you actually own covers the reasoning in about 5 minutes — free, ungated, written from client work.
Who wrote this
Anas Bin Masud builds e-commerce sites and does technical SEO for businesses in the UK, Canada, Ireland and Pakistan. These procedures are the ones I run on client work, written down rather than invented — including the ones where the honest answer is that the fix is not available on your current hosting.