You arrive on a website for one piece of information and before you can see it, you have to answer a question you never asked. A rectangle covers the content. On the left Accept all, on the right a grey Settings hiding a list of a hundred and fifty partners you have never heard of.
Most people click the bigger button. Not because they agree. Because they want to read the text underneath.
That banner is not a law of nature that landed on every website on earth. It follows from one technical decision that somebody probably made on your behalf: measuring traffic with a third party script in the visitor's browser instead of counting it on your own server. This article is about what the banner actually solves, what it costs you and when it can go without losing anything.
Where the banner came from
The rule is older than people expect. The European ePrivacy directive of 2002, amended in 2009, says one thing: anyone who wants to store data on a user's device or read data from it needs consent. The only exception is what is strictly necessary to transmit a message or to provide a service the user explicitly asked for.
Notice what the rule is not about. It is not about personal data. It is about the device. What decides is whether you reach into the visitor's phone, not how sensitive the data you extract turns out to be.
In the Czech Republic the regime was milder for years: offering a way to opt out was enough. An amendment to the electronic communications act flipped it on 1 January 2022. Since then consent has to come first, and banners appeared overnight even on sites where a line in the footer had been sufficient.
That figure explains why banners are everywhere. A fraction of sites collect sensitive data; almost all of them carry a third party measurement script. And that script stores an identifier in the browser so it can tell you are the same person as yesterday. That settles it: you need consent, and consent gets collected with a banner.
What the banner actually solves
Ask a site owner what the banner is there for. The answer tends to be „because of GDPR“, a shorthand that hides what is going on.
A banner does not protect privacy. Protecting privacy would mean the data is not collected. The banner only changes who is answerable for collecting it: the site asks, the visitor clicks, and from that moment the collection is fine because the visitor agreed to it. It is a legal instrument, not a technical one.
A cookie banner is not privacy protection. It moves responsibility from the site operator to a visitor who has two seconds to decide and no information
For that transfer to hold, consent has to be freely given, informed and specific. Refusing must be as easy as agreeing, and withdrawing must be as easy as granting.
This is where the whole thing breaks. A site that meets that condition honestly loses most of its measured data. And a site unwilling to lose the data starts bending the banner.
The same research did a second thing: it gave people differently designed banners and measured how they decided. The results are uncomfortably clear.
- Removing the reject button from the first screen raises consent by 22 to 23 percentage points
- Adding detailed settings to the first screen lowers consent by 8 to 20 percentage points
- Whether the banner is a strip at the bottom or a barrier across the whole screen has no measurable effect on the decision
In other words: your consent rate is not determined by what people think of your website. It is determined by where somebody put a button.
The banner that saves your data: refusal hidden under Settings, a grey button against a coloured one. Over ninety per cent agree and the numbers look wonderful. It is exactly the construction that attracts fines.
The banner that follows the rules: Accept and Reject side by side, the same size. Over sixty per cent refuse, your measurement shrinks to a third, and you are paying for a tool that sees a minority of your visits.
This is the heart of it. An honest banner and complete data are two goals that pull against each other. Having both is not possible. Most companies pick one and behave as though they had both.
Is it amateurism, or convenience
Neither, quite. It is the default setting of the tools websites are assembled from.
Build a site on WordPress and measurement gets handled by a plugin. The plugin puts a Google script into the page. The script stores an identifier in the browser. And because you have just reached into the visitor's device, you need consent, so you install a second plugin that renders a banner. Nobody in that chain made a mistake. Every step made sense at the time.
The problem is that the path only runs one way. Neither a hosted platform nor an ordinary template offers the option „count the visits on the server and send them nowhere“, because doing that means touching what runs on the server. A plugin installed from a gallery runs in the browser, and there the only way to recognise a returning person is to store something on their device.
So the answer is: convenience that settled into a norm over a few years. Amateurism starts where the banner goes up and nobody checks what actually runs underneath it. That happens often: scripts fire before anybody clicks, refusing switches nothing off, and the banner is decoration that protects neither the visitor nor the operator.
What a banner costs
The cost comes in three kinds and none of them is the invoice for the tool.
Money
The European Commission did the sums when it justified its November 2025 proposal to simplify the whole system. It arrived at roughly 1 200 euros per website over three years of operation and more than 800 million euros a year across the union. That is not just tool licences: it covers configuration, sorting cookies into categories, checks and a lawyer.
Speed
The banner has to be on the page before anything that needs consent. So it loads among the first things and occupies the browser's main thread at precisely the moment the browser should be rendering content.
How long a banner takes to respond to a click
Values in milliseconds
the banner runs in a separate frame
448 ms of blocked main thread in one measurement
| Label | Value |
|---|---|
| Sourcepoint | 6 ms |
| Usercentrics | 56 ms |
| Cookiebot | 57 ms |
| TrustArc | 67 ms |
| Termly | 69 ms |
| Quantcast | 74 ms |
| CookieYes | 81 ms |
| Didomi | 95 ms |
| OneTrust | 104 ms |
| Osano | 225 ms |
| Google Funding Choices | 468 ms |
Two of the eleven tools measured cross the threshold for a good response on their own, before anything else happens on the page. And that is only the reaction to a click. What the banner does to rendering tends to be worse: in one measured case the banner text became the largest element on screen and the time to render the main content jumped from 1.43 to 3.61 seconds. The site dropped from the good band to the poor one without anything else about it changing.
Data
The third cost is the one the whole exercise was for. You put the banner on the site so you would be allowed to measure. Except that once it is up, you measure less than you would have without it.
What a hundred visits consist of when you measure with a third party script
Composition in per cent
- What you see in the dashboard36%
- Refused consent54%
- Script never ran at all10%
Total 100%
| Label | Value |
|---|---|
| What you see in the dashboard | 36% |
| Refused consent | 54% |
| Script never ran at all | 10% |
The model is deliberately rough. With a technical audience the blocking is far higher: a comparison of two measurements on one site receiving traffic from Hacker News and Reddit showed Google Analytics missing 58 per cent of visitors. On Firefox 88 per cent, on Chrome 50. With ordinary business visitors the blocking will be lower, but never zero.
Google has an answer to this: consent mode fills the gaps by modelling, that is by estimating from the behaviour of people who did agree. There are two catches. First: the dashboard does not tell you what was measured and what was estimated. Second, and more important for a smaller company: modelling only switches on once you have at least a thousand events a day from people without consent for seven days, and a thousand a day from people with consent. A company website with five hundred visits a month will never come near that threshold. It keeps the hole and gets no plaster.
You pay for the banner, slow the site down, irritate your visitors, and the result is that you know nothing at all about some of them
How to measure without a banner
Go back to what the rule actually says. You need consent when you store data on the visitor's device or read data from it. When you do neither, there is nothing to consent to.
Meanwhile the server knows about the visit anyway. It has to, or it could not send the page. It knows the address, the time, the kind of browser and where the person came from. Those details can be counted on the spot and stored as figures in a summary without writing anything into the browser.
One question remains: how to tell that two page views belong to one person without tagging them. The solution I use on my own sites looks like this.
- 1A fingerprint, that is an irreversible hash, is computed from the IP address, the kind of browser and today's date.
- 2A random salt goes into the computation. It is created when the application starts, lives only in memory and is never stored.
- 3The fingerprint is stored instead of the IP address. The IP cannot be recovered from it, because nobody has the salt, myself included.
- 4The salt changes every day, so the same person's fingerprint diverges after midnight. A visit can be reassembled; a profile across weeks cannot.
- 5Detailed records are deleted after sixty days. What remains are daily summaries from which no individual can be traced.
Nothing is written into the browser. No cookie, no entry in the page's storage, no reading from it. The consent rule does not apply, because the device is never touched. And no detail remains in the database from which a person could be identified, so data protection has nothing to weigh in on either.
The price for that is real and it is fair to say it out loud. This kind of measurement cannot tell that the same person came back three weeks later. It will not connect a click on an advert on Monday with an order on Friday. It cannot build advertising audiences. It knows how many people came, from where, what they read, how far they read, where they left and how many of them sent an enquiry. For the vast majority of company websites that is exactly the set of questions anybody ever actually answers.
| Third party script with a banner | Measurement on your own server | |
|---|---|---|
| Visitor consent | Required; without it the script may not run | Not needed, nothing is stored on the device |
| How many visits you see | Only those with consent and no blocker | All of them, Firefox with a blocker included |
| Where the data sits | On the tool operator's servers | In your database next to the rest of the site |
| Effect on speed | Banner script and measurement script before the content | None, it is counted as the page is sent |
| Returning visitor | Recognised by a stored identifier | Not recognised, the fingerprint changes daily |
| Advertising audiences and remarketing | Supported; it is the main reason the tool exists | Not supported and not attempted |
| Who sees the numbers | You and the tool operator | Only you |
When you genuinely need a banner
I am not going to claim everybody can do without one. There are cases where it is necessary and where trying to avoid it is just quietly breaking the rules:
- You build advertising audiences, run remarketing or measure conversions from Google Ads and Meta. None of that works without an identifier in the browser
- You have an embedded YouTube video, a map, a chat widget, an A/B testing tool or session recording. Each of those reaches into the device on its own account
- You run a shop with behavioural recommendations, a basket shared across devices or a loyalty scheme
- You work with conversion attribution across several days and channels and that number drives decisions
In those cases you have to have a banner, and it is worth doing it properly rather than making it look like the competitor's. The difference from the usual state of affairs is that here the banner is a deliberate decision rather than a by-product of assembling a site out of plugins.
And even there, two things can be separated. Measure basic traffic on the server, that is for everybody without exception, and collect consent only for the advertising tools. Then when half your visitors refuse, you lose advertising audiences rather than the picture of how many people visit and where they come from.
The trap called „cookieless“
A great deal is being sold under the heading of „cookieless“ solutions and some of it only appears to escape the rule. The European Data Protection Board settled the point in guidelines adopted in October 2024: what decides is whether the device is being accessed, not what the technique is called.
The rule therefore also covers tracking pixels in images, links carrying appended identifiers, browser fingerprinting and, in some cases, the handling of an IP address. A tool that collects thirty browser properties instead of a cookie and assembles a unique device signature from them needs consent in exactly the same way. It just does not mention it.
The difference lies in what is done to the visitor's device, not in what the label says.
What is coming and why it is worth watching
In November 2025 the European Commission put forward a package called the Digital Omnibus, intended to reduce cookie banners substantially. Three things in it matter to site operators:
- The cookie rules move from the ePrivacy directive into the GDPR itself, into new articles 88a and 88b. Among other things that brings a ceiling on fines of up to 4 per cent of worldwide turnover
- An explicit exemption for audience measurement is created: aggregated statistics about the use of a service that the operator keeps purely for itself would not require consent
- The choice moves to the browser and websites will have to respect it. Anyone who refuses may not be asked again for six months
For now this is a proposal, not law. In mid 2026 negotiations between the Parliament and the Council are under way, the cookie provisions are among the contested points, and adoption is not expected before the end of the year. Until then the present rules apply.
The direction is readable, though, and worth weighing when deciding about a new website. The exemption under negotiation is written precisely for measurement an operator keeps for itself and passes nowhere. A site built that way today survives both outcomes: it complies with what applies now, and if the amendment passes it will not need changing at all.
How to check where you stand in ten minutes
- 1Open your site in a private window and leave the banner alone, clicking nothing. In the developer tools, under Application, look at the stored cookies. Nothing beyond technical ones may be there at that moment.
- 2Click Reject all and go through the list again. If anything was added after refusing, the banner is not doing what it claims.
- 3In the Network tab, sort requests by domain and list every third party one. Write down what each is for. The ones you cannot explain are candidates for deletion.
- 4Compare the visit count in your analytics with the number of page requests in the server log or at your host. The difference is what you are not seeing.
- 5Write down which numbers from the dashboard you actually used to make a decision in the past year. Usually there are five, not fifty. Then ask whether you need a banner for them.
The last point tends to be the most uncomfortable and the most useful. Most company websites run a tool built for large online shops, use three numbers out of it, and pay for that with a banner, with speed and with a share of their traffic they never see.
How I do it
The sites I build measure themselves. It is not a library or an outside service, it is a part of the website that sits in your admin next to the enquiries. Specifically:
- Zero third party scripts. No Google Analytics, no font from somebody else's domain, no social network button dragging tracking along with it
- No cookie banner, because there is nothing to consent to
- A dashboard in the admin: how many people came, from where, which pages they read and how far, where they left, what they searched for and did not find, how many visits ended in an enquiry
- Speed measured on real visitors, not just simulated in PageSpeed. The same metrics Google grades
- Crawlers counted separately, language model crawlers included, so you can see whether ChatGPT or Claude is reading your site
- Detailed records delete themselves after sixty days, leaving the summaries
A typical company website: WordPress, a Google Analytics plugin, a banner plugin, a Facebook pixel, a font from somebody else's domain. The visitor clicks away a question they never wanted, and you still see only some of your people.
A custom site with its own measurement: the visitor sees the content straight away, nothing is written to their device, and in the admin you see every visit rather than only the consented ones.
Does every website need a cookie banner?
No. A banner is only needed when the site stores data on the visitor's device beyond what is technically necessary, or reads data from it. A site that measures traffic on its own server and carries no third party scripts collects no consent, because there is nothing to consent to.
Do analytics cookies need consent in the Czech Republic?
Yes. The Czech data protection authority classifies traffic measurement cookies as non technical, meaning they may only be stored with consent. The exemption in section 89(3) of the electronic communications act covers only transmitting a message and what is strictly necessary for a service the user explicitly requested. France has its own narrow exemption for audience measurement under strict conditions; the Czech Republic does not.
Can a badly built cookie banner lead to a fine?
Yes, and not token amounts. In September 2025 the French authority fined Google 325 million euros and Shein 150 million euros for cookies stored without consent. The highest final Czech fine for cookies stands at 898 thousand crowns. The most common breach is always the same: scripts firing before the visitor clicks.
Is Google Analytics banned?
No. After the 2022 decisions the situation settled thanks to the EU to US data transfer framework, which survived a challenge before the General Court of the European Union in September 2025. An appeal to the Court of Justice is pending. So it can be used, but you need the visitor's consent and you should expect the legal basis to move again.
Will removing Google Analytics cost me SEO data?
No. Data on search positions, impressions and clicks from results lives in Google Search Console, which needs no script on the site. It stays with you after the measurement script is gone.
Can cookieless measurement recognise a returning visitor?
No, and that is a deliberate price. To do it, the measurement would have to store a persistent identifier, which is exactly where the duty to collect consent begins. For a company website it is usually a good trade: you know how many people come, from where and what they do, without tracking individuals.
What if we advertise on Google Ads?
Then you will need a banner, because conversion measurement and remarketing do not work without an identifier in the browser. The sensible move is to separate two things: measure ordinary traffic on the server without consent, and collect consent only for the advertising tools. Your basic numbers then stay complete even for people who refuse.
Is the European Union abolishing cookie banners?
The Digital Omnibus proposal from November 2025 aims to reduce them substantially: it introduces an exemption for audience measurement and moves the choice into the browser. In mid 2026 it is still a negotiation rather than law, and adoption is not expected before the end of the year. Sites that already measure for themselves and carry no banner will not need changing if it passes.