Cookies and the law: what your site actually needs - Zephyra Studio

A cookie banner is not just a formality visitors click through without reading. The law draws a clear line between cookies a site needs to function and cookies that track visitor behaviour, and only the second group actually requires consent, before they load.

Essential versus non-essential cookies

Essential cookies keep the site working: they remember that you are logged in, hold your cart contents, remember your chosen language. These do not need consent, because the site would not work properly without them.

Non-essential cookies are everything else: Google Analytics, a Facebook Pixel, marketing tracking tools, chat widgets that log conversation history. These require consent BEFORE they load, not after.

What "before it loads" actually means

The most common mistake is a banner that appears while analytics has already started running in the background, before the visitor has even read the banner or noticed it. That is not real consent, it is a formality displayed after the violation already happened.

"Continuing to browse the site" does not count as consent either. The law requires a clear, affirmative action (clicking "Accept"), not an assumption that silence means agreement.

What the banner needs to allow

A proper cookie banner does not just offer an "Accept all" button.

• An option to decline non-essential cookies, not just accept them
• A clear breakdown by category (essential, analytics, marketing), not one combined yes/no
• A way to change the decision later, not only once on the first visit
• A link to the full privacy/cookie policy for details

Source

Key takeaways

• Essential cookies do not need consent, non-essential ones (analytics, marketing) do, and it has to happen BEFORE they load, not after.
• "Continuing to browse" is not valid consent, the law requires a clear confirming click.
• A banner has to make declining just as easy as accepting, not just a large "Accept all" button.

Conclusion

If you are not sure whether your cookie banner actually blocks analytics while it waits for consent, or just displays a message while everything already loaded in the background, that is a difference we check directly in the code, not just visually.