Cookie banners are the part of launching that nobody enjoys. They cost money if you buy a tool, they annoy visitors, and it’s easy to add one without knowing whether you need it. Others skip it because their analytics says “no cookies”, which isn’t the whole answer either.
Whether you need one depends on two things: what your site stores or reads on a visitor’s device, and where your visitors live. This guide covers the EU, the UK and the US, using what the regulators themselves publish. It was checked on 7 November 2026.
The short answer
- Your site only keeps people signed in, remembers a cart or a language, and has no analytics: no banner.
- You use simple, anonymous analytics that keeps no profile of anyone: in the UK, Spain and France, usually no banner, as long as your privacy policy mentions it and visitors can opt out. Other EU countries are less clear.
- You use an ad pixel (Meta, TikTok, Google Ads), Google Analytics or embedded videos that track: in the EU and UK, visitors must agree before these load, and a cookie banner is how you ask them.
- All your visitors are in the US: most small apps need no banner. Some state laws, like California’s, ask larger businesses to let people opt out of having their data sold or shared.
It isn’t only about cookies
The EU rule is in the ePrivacy Directive, Article 5(3). It says you need consent to store information on someone’s device or read information from it. Cookies are the best-known way, but the EU’s data protection board says the rule also covers tracking pixels and scripts that make the browser send information, whether or not that information identifies anyone. The UK’s rules work the same way and name local storage and fingerprinting too.
So “we use no cookies” doesn’t settle it on its own. What settles it is whether what your site does fits one of the exceptions below.
What never needs consent
The rule has an exception for anything strictly necessary to give visitors what they asked for. The UK regulator, the ICO, lists examples that fit:
- keeping someone signed in while they use your app
- remembering what’s in a shopping cart
- security and fraud prevention, such as on a payment form
- remembering a visitor’s cookie choice itself
“Necessary” means necessary for the visitor, not for your business. The ICO is explicit that advertising is never strictly necessary, even if ads pay for your service.
What always needs consent
- Ads and ad tracking. Pixels from Meta, TikTok, Google Ads or LinkedIn need consent first. The ICO says no advertising purpose fits any exception.
- Tracking people across sites or devices.
- Large analytics tools that use the data for their own purposes. France’s regulator, the CNIL, says most large audience measurement offerings don’t qualify for its exception, whatever their settings.
- Social media buttons and embeds that track visitors. For embedded videos, the ICO suggests a privacy mode, so nothing is set until someone presses play.
Analytics: it depends where your visitors are
This is where small apps can often skip the banner. Several regulators now allow simple visitor statistics without consent, with conditions:
| Where | Analytics without consent? | What you must do |
|---|---|---|
| UK | Yes, for aggregate statistics used to improve your site (ICO, April 2026) | Say so in your privacy policy and give visitors a simple, free way to opt out. A third-party tool may only use the data to help you |
| Spain | Yes, for a listed set of measurements: page views, referrers, devices, time on page, scroll depth, clicks and region (AEPD, January 2024) | Say so in your privacy policy. The tool must not reuse the data or follow people across sites, and data is kept 25 months at most |
| France | Yes, for measuring your own audience with anonymous statistics (CNIL) | Tell visitors and let them object. No tracking across sites, no reuse by the provider |
| Germany | No general yes. The regulators say even counting visitors has to be judged case by case | If many of your visitors are in Germany, ask someone who knows German law, or ask for consent |
| US | Usually yes. California’s law, the best known, works by letting people opt out, not by asking first, and only applies to larger businesses | If California’s law (CCPA) applies to you, let people opt out of having their data sold or shared |
Google Analytics sets cookies and is the kind of large tool these exceptions usually leave out, so if you use it and have visitors in the EU or UK, you’ll need a banner. If you want to drop the banner, a simple cookieless tool is the usual route. Our Google Analytics alternatives guide compares them.
Check what your app actually sets
You can see what your site stores in a minute, in Chrome:
- Open your site in a private window, so nothing from earlier visits is there.
- Right-click the page and choose Inspect, then open the Application tab.
- Under Storage, open Cookies and Local storage and click your site’s address. Each row is something your site stored.
- Open the Network tab, reload the page and type
googletagmanager,google-analytics,facebookortiktokin the filter box, one at a time. Requests there mean those trackers were loaded.
Do this before you click anything in a banner. Anything that appears before a visitor has said yes is the part that matters.
To get a full list in plain words, ask your builder:
List what my app stores and sends
List every third-party script, pixel, widget and embed in my app, and every cookie or local storage entry my app or those tools set. For each one, say what it is for, which company runs it, and whether it runs before a visitor has done anything. Don’t change anything yet.
If you need a banner, make it a fair one
A banner that pushes people to accept isn’t valid consent. The ICO’s checklist for consent mechanisms asks for:
- refusing as easy as accepting, so a reject button next to accept, not hidden behind settings
- nothing optional running until the visitor says yes
- separate choices for different purposes, such as analytics and ads
- naming the companies that will get the data
- an easy way to change the choice later
Most builders can make this for you without a paid tool:
Add a fair cookie banner
Add a cookie banner to my app. Show Accept all and Reject all buttons with the same size and style, plus a Choose button with separate switches for analytics and for ads. Load analytics and ad scripts only after a visitor allows them, and never before. Remember the choice, and add a Cookie settings link in the footer that opens the banner again. Keep sign-in and other necessary features working without consent.
If you don’t need one
No banner doesn’t mean nothing to do. Mention your analytics in your privacy policy and give visitors a way to opt out. Our own LaunchPal analytics works this way: no cookies, and a “Don’t count my visits” link you can put next to that sentence.
This guide sums up what regulators publish. It isn’t legal advice. If most of your visitors are in a country not covered here, or you handle sensitive data, ask someone who knows the rules where you operate.