Do you need a cookie banner on your website?

The short answer: it depends on who visits your website and what runs on it. No law in the United States makes a small website show a cookie pop-up. Europe is different: its rules say a website should ask before using cookies that track people, like analytics and advertising cookies, for visitors there. So a brand-new website serving a local US audience can usually skip the banner, and a website with visitors or customers in Europe should turn one on. Either way, this is a smaller job than it looks, because most website tools include the banner as a setting.

Quick answer

• A cookie is a small file a website stores in a visitor's browser to remember things, like a login or a shopping cart.
• A cookie banner is the pop-up that asks permission before the website uses cookies that are not needed to make it work, mainly tracking cookies for analytics and advertising.
• No US federal law requires a cookie banner. California's privacy law asks large businesses for notice and an opt-out link instead, and it only covers businesses over $25 million in yearly revenue, or ones handling personal information of 100,000 or more California residents or households, or ones making half their money selling it (California Attorney General, 2026).
• The European Union's rules say websites must ask visitors there before using tracking cookies. Cookies that just make the website work, like a login or a cart, never need permission. The UK has its own similar rules.
• Google also requires websites that use its advertising and measurement tools to get consent from visitors in the European Economic Area, the UK, and Switzerland.
• The practical answer for a first website: get your privacy policy done first, then turn on your website tool's cookie banner option if people in Europe can realistically end up on your website.

This guide walks through what the banner actually asks, whether your website even uses cookies, and how to decide without a law degree.

What is a cookie banner actually asking?

A cookie is a tiny text file a website places in your browser so it can remember something about you. Some cookies do jobs you would miss immediately: staying logged in, keeping items in a shopping cart, remembering a language choice. Others do quieter work: counting visitors for an analytics report, or following someone across websites to show them ads later.

That difference is the whole story. Lawmakers in Europe decided that the second kind, the tracking kind, should only run after a visitor says yes. The banner is simply the asking. It is not a warning that a website is dangerous, and it is not a legal disclaimer. It is a permission slip for the optional cookies.

That is also why a good banner has a real choice on it. A visitor who says no should still get the whole website. Only the optional layer switches off.

Does your new website even use cookies?

Probably yes, but fewer than you think, and mostly the harmless kind. Walk through what a normal first website actually runs:

• A contact form does not need tracking cookies. Someone types a message, you get an email.
• A login area or a shopping cart uses cookies, but these are the essential kind that never need a banner. The website cannot do its job without them.
• Analytics, like Google Analytics, is the big one. It uses cookies to count visitors and see which pages they read, and that counts as tracking under Europe's rules. If you are just setting up visitor counting, our guide on how to know if your website is working covers it.
• Embedded extras, like a video player or a social media feed placed on your page, often set cookies from those companies too.

So the honest picture for most first-timers: your website has essential cookies nobody needs to ask about, plus analytics, which is the one that triggers the banner question.

Does any US law require a cookie banner?

No. There is no US federal law that makes a website show a cookie consent pop-up.

The California law people have heard of, the CCPA, works differently. It asks businesses to tell people what they collect and to offer a "Do Not Sell or Share My Personal Information" link they can click, which is notice and an opt-out, not a permission pop-up. And it only covers for-profit businesses that clear at least one of three bars: over $25 million in yearly revenue, or buying, selling, or sharing the personal information of 100,000 or more California residents or households, or earning half their revenue from selling personal information (California Attorney General, 2026). A new website with a contact form and a visitor counter is nowhere near any of those. Newer privacy laws in other states mostly follow that same pattern: aimed at businesses handling data at scale, built on notice and opt-out choices.

What US law and your tools do expect from almost every website is a privacy policy, which is a different thing from a banner. If you have not sorted that page yet, our guide on whether you need a privacy policy covers it in the same plain way, and it is the one to do first.

What if people from Europe visit your website?

Europe is where the banner comes from. The European Union's rules for websites say you must ask visitors there for permission before storing cookies that are not needed to provide the service they asked for. The EU's official guidance for businesses spells out both halves: tracking cookies used for advertising, analytics, or market research need consent first, while cookies that carry out the visitor's own request, like logging in or keeping a cart, are exempt. The UK kept its own version of these rules after leaving the EU.

The rules also care about fairness in the banner itself. Saying no has to be as easy as saying yes, and a visitor who says no must still get the website.

There is one more push in the same direction that has nothing to do with governments. Google requires websites that use its advertising and measurement products to get consent from visitors in the European Economic Area, the UK, and Switzerland before cookies are used for those tools. So if you run Google Analytics or Google ads and people in Europe open your website, Google's own rules expect the banner too.

So does your website need a banner or not?

Put your website in one of three buckets:

1. Local US business, no analytics or ads. A plumber whose website is a few pages and a contact form. No banner needed. Your cookies are the essential kind, and no law asks you to announce those. Get the privacy policy done and move on.
2. US audience, but you run analytics. This is most first websites. No US law forces a banner. But your website is on the open internet, someone in Europe can land on it, and your analytics tool sets tracking cookies for them too. You will not be the target of a European regulator over a visitor counter, but since your website tool likely includes a banner option, turning it on is a few minutes of work that settles the question. If that feels like overkill for a purely local business today, skipping it for now is a fair choice too. This one is a judgment call, and either answer is honest.
3. You serve or sell to people in Europe. Turn the banner on. The rules apply to websites outside Europe when they serve people inside it, Google's consent rules apply on top, and asking first is what your European customers expect anyway.

If your situation is genuinely unusual, a short conversation with a lawyer beats guessing. For a normal first website, the buckets above cover it.

How do you add a cookie banner without building anything?

Do not build one yourself, and do not paste banner code from a random tutorial. The tools you already use almost certainly have this covered:

1. Check your website tool first. Most website builders include a cookie or consent banner as a setting you switch on. Look in settings for words like cookies, consent, privacy, or banner.
2. Check your analytics tool. Modern analytics tools have consent features that hold tracking back until the visitor agrees, which is exactly what the rules want.
3. Keep the banner honest. A real yes and a real no, no tricks that hide the reject button. The website keeps working for people who say no.
4. Link your privacy policy from the banner. The banner asks permission, and the policy explains the details. They work as a pair.

That is the whole job. It belongs in the same afternoon as your privacy policy, and once it is on, it quietly does its work without you thinking about it again.

What happens if you skip the banner?

Honestly, for a small US-focused website, usually nothing. European enforcement has aimed at large platforms and heavy advertising trackers, not at a bakery whose visitor counter set a cookie for a tourist from Berlin. The bigger everyday risk is on the tool side: Google requires consent for its advertising and measurement tools in Europe, and its policy says it can limit or cut off those tools on websites that ignore it.

The sensible reading is not fear, it is proportion. The banner is a small, finished task, the same shelf as your privacy policy. Decide which bucket your website is in, flip the setting if it needs flipping, and get back to the part only you can do: the business the website exists for.