Do you need a cookie banner? When it's required and when it isn't

A cookie banner is required as soon as your website stores or reads information on a visitor’s device that isn’t strictly necessary to run the site. That covers almost every analytics tool, every ad pixel and embedded content like YouTube videos or Google Maps. If your site only uses strictly necessary cookies, you don’t need a banner.

This article covers the rules for websites in Germany, which follow EU law. It isn’t legal advice. For your specific case, ask your data protection officer or a law firm.

What the law requires

Two laws work together:

• Section 25 of the TDDDG (called TTDSG until May 2024): Anyone who stores information on a visitor’s device or reads it from there needs consent first. The exception is anything strictly necessary to deliver the service the visitor explicitly asked for. This applies equally to cookies, local storage, pixels and fingerprinting.
• GDPR: If personal data is processed along the way, such as the IP address or an identifier, that needs a legal basis. For tracking and advertising, in practice that’s consent.

The rules apply to every business website, whatever the size of the company.

When you don’t need a cookie banner

You don’t need a banner if your site only stores what it can’t work without. That includes:

• a session cookie for a login or shopping cart,
• the cookie in which your banner stores the visitor’s choice,
• cookies that protect against bots and attacks, like the ones Cloudflare sets,
• fonts and scripts served from your own server.

If your site loads nothing else from third parties, you don’t need a banner.

What triggers the requirement

• Analytics: Google Analytics, Microsoft Clarity, Hotjar and Matomo with cookies.
• Advertising: Meta Pixel, Google Ads, LinkedIn Insight Tag and TikTok Pixel.
• Embedded content: YouTube and Vimeo videos, Google Maps, Instagram feeds and chat widgets.
• Marketing tools: tracking from HubSpot or other CRM systems.

Google Fonts loaded straight from Google’s servers are a special case. They don’t set a cookie, but they send the IP address to Google. In 2022, a Munich court awarded a visitor damages for exactly that. Serve fonts from your own server and the issue is gone.

What a cookie banner has to look like

• Reject on the first layer: The reject button sits next to the accept button and is just as visible.
• No pre-checked boxes: In 2020, Germany’s Federal Court of Justice ruled that a pre-checked box isn’t consent.
• Separate purposes: Visitors can allow statistics and marketing separately.
• Nothing loads before the choice: No tool starts before the visitor agrees.
• Withdrawal at any time: A link in the footer reopens the banner. Withdrawing has to be as easy as agreeing.
• Legal pages stay reachable: The banner doesn’t cover the links to the legal notice and privacy policy.

Free and paid cookie banners

Free: If your domain runs through Cloudflare, Cloudflare Zaraz has its own banner with purposes and multiple languages built in. The Cloudflare Zaraz guide shows how to set it up. Klaro is an open source banner you embed yourself. For WordPress, Complianz and Real Cookie Banner come in free versions.

Paid: Cookiebot, Usercentrics and CCM19 scan your site for cookies on a schedule and maintain text blocks for your privacy policy. They charge by number of pages or traffic.

Measuring without a cookie banner

Every banner costs you data. On my own website, Google Analytics counted only 17 visits from Google Search between late July and late October 2026, while Search Console counted 107 clicks for the same period. Everyone else rejected or ignored the banner.

Some tools count without cookies and without an identifier in the browser, such as Cloudflare Web Analytics, Plausible or Pirsch. The comparison of Google Analytics alternatives covers what they can do. Ask your data protection officer whether your setup can run without consent that way. Another option is server-side tracking, where your website collects the data itself and passes it on filtered.

Check your banner in three steps

1. Before the choice: Open your site in a private window along with your browser’s developer tools. Storage should show only necessary cookies, and Network should show no requests to google-analytics.com, facebook.com or doubleclick.net.
2. After yes: Accept everything and reload the page. Now the tools you allowed show up.
3. After withdrawal: Reopen the banner from the footer link, reject and reload. The tools have to disappear again.

For how I set up tracking through Cloudflare that only measures after consent, see the Cloudflare Zaraz page.