Do You Legally Need a Cookie Banner?
When a cookie banner is legally required, when it is not, and why "everyone has one" is the wrong reason to add or skip it.
6 min read
Whether you legally need a cookie banner depends on where your visitors are and what your site does with cookies. In the EU and UK, you generally need opt-in consent before setting any non-essential cookie. In the US, there is usually no banner mandate, but state laws increasingly require you to honor opt-outs, which a banner or preference center is the practical way to deliver.
The EU and UK: Consent Before Cookies
Under the ePrivacy rules that sit alongside GDPR, you must get a visitor's informed, opt-in consent before storing or reading non-essential cookies on their device. "Non-essential" is almost everything used for analytics, advertising, and personalization; only cookies strictly necessary to deliver the service the user asked for are exempt. That is why nearly every EU-facing site shows a banner: the law requires the choice to come first.
The US: Opt-Out, Not a Banner Mandate
US state privacy laws take a different shape. They generally do not require a consent banner before cookies load. Instead, they require you to let people opt out of the "sale" or "sharing" of their personal information, which in practice covers a lot of advertising and analytics cookies, and to honor an opt-out preference signal. You can meet that with a "Your Privacy Choices" link and a preference center rather than a blocking wall, though many teams use one consent tool to cover both models.
When You Probably Do Not Need One
If your site sets only strictly necessary cookies, no analytics, no ad pixels, no embedded third-party content that tracks, you may not need a banner at all. The honest test is not "does everyone have one" but "does anything on this page track the visitor before they agree." A tracker audit answers that faster than guessing.
The Wrong Reasons to Decide
Copying a competitor's banner, or skipping one because enforcement feels unlikely, both get teams in trouble. Regulators have fined companies for banners that set cookies before consent, for missing reject options, and for no banner where the law required one. The requirement follows your trackers and your visitors' location, not the industry norm.
How Concord Fits
Concord scans your site to show you exactly which trackers fire and which are non-essential, then serves a banner that adapts by region: opt-in blocking where the EU and UK require it, a "Your Privacy Choices" opt-out where US state laws apply. You configure the rules once instead of maintaining separate tools for each market, and the same platform records the consent and honors opt-out signals.