Look at this website. Scroll to the bottom. Click around a few pages. No cookie banner appeared, and none is hiding.
That is not an oversight, and it is not us being reckless. It is what happens when you build a site that does not track people, then read the rules rather than copying what everyone else does.
Meanwhile, a huge number of small business websites carry a banner they never needed, sitting on top of tracking they never asked for, while missing the handful of things the law actually cares about. If that might be you, this is the twenty minute version.
Standard disclaimer, meant sincerely: we build software, we are not solicitors. For anything unusual, or if you handle health or financial data, get proper advice.
The rule in one sentence
You need consent before setting cookies that are not strictly necessary for your site to work.
That is the bit most people miss. The law is not "websites must have banners". It is "you must ask before tracking". No tracking, no asking. The banner is a symptom of the tracking, not a legal ornament every site is supposed to wear.
So why does almost every site have one?
Because of one decision, usually made without thinking: adding Google Analytics.
Analytics sets cookies to follow visitors, which is not strictly necessary for the site to function, which means consent, which means a banner. Add a Facebook pixel or embedded YouTube videos and the picture gets busier. The banner is the tail on that dog.
The uncomfortable part is what those banners are usually worth. A young business site gets a few dozen visitors a week. Analytics data at that volume tells you almost nothing you could act on, and the first thing every visitor now meets is a consent popup asking them to make a decision before they have read a word about you.
What we did instead
We wanted to know how many people visit and which pages they read. We did not need to know who they are or follow them anywhere. So we use a cookieless analytics service: it counts visits and pages without storing anything on your device and without building a profile of you.
No cookies means no consent, which means no banner. We get the numbers we actually use, and you get to read the site without being interrupted. It cost nothing and took ten minutes.
If a business genuinely needs Google Analytics - running paid ads and needing conversion tracking is the honest case - then it needs the banner and needs it done properly. That is a real trade, made deliberately, not a default absorbed from a template.
What actually matters, and gets forgotten
Here is the irony. Sites with a banner they did not need are often missing the things that are genuinely required.
A privacy policy that describes reality. Not a downloaded template mentioning services you do not use. What you collect, why, how long you keep it, who else sees it, and how someone asks for their data or its deletion. If your contact form emails you and stores enquiries in a database, say that. Ours does, and ours says so.
A lawful basis for your contact form. Someone filling in a form to ask you a question has clearly consented to you replying. That is fine. What is not fine is quietly adding them to a mailing list - marketing needs its own explicit opt-in, unticked by default.
Not collecting what you do not need. The safest data is the data you never asked for. Every extra field on a form is a small liability. If you do not need their phone number to reply by email, do not ask for it.
Keeping it secure and not keeping it forever. HTTPS as standard, sensible access control on any admin area, and a deletion habit for enquiries you no longer need. Data you deleted cannot leak.
Being reachable. A real way to contact you, and business details on the site. Ours are in the footer: company name, number, registered address.
The five minute check for your own site
Open your website and ask:
Does a banner appear? If yes, do you know what tracking it is asking permission for, and do you use that data? If you cannot answer both, you may be able to remove the tracking and the banner together.
If a banner appears, does clicking reject actually stop the tracking, or does it fire regardless? A banner that ignores the answer is worse than no banner - it is a documented failure rather than an oversight.
Does your privacy policy describe the site you actually have? Read it as a stranger would.
Does your contact form collect more than you need to reply?
Can a visitor find who you are and how to reach you without hunting?
The point
Compliance for an ordinary small business website is not a legal maze. It is mostly a set of sensible decisions about what you collect and why, and being honest about it in plain language.
Do that and the banner question answers itself. We built this site to need less, so it asks less of you, and there was nothing to hide behind a popup.
Written by Graeyna
The team that designs, builds and runs the software we write about. Engineers, not marketers.