GDPR Cookie Consent: What a Small Business Website Needs

Getting GDPR cookie consent for small business websites right comes down to one rule: tracking waits for a real "yes". Analytics and advertising cookies should not load until the visitor agrees, refusing should be as easy as accepting, and the visitor must be able to change their mind later. If your site has visitors in the UK or the European Union, this applies to you even when your business is based elsewhere.

This guide covers what counts as valid consent, which cookies need it, what a fair cookie banner looks like, how to connect it to Google Analytics and ad pixels, and the mistakes we see most often on small business sites. It is practical guidance, not legal advice: your privacy notice and legal decisions stay with you and your adviser.

What does the GDPR say about cookie consent?

The GDPR sets the standard for what "consent" means. Article 4 defines it as a "freely given, specific, informed and unambiguous indication" of the visitor's wishes, given "by a statement or by a clear affirmative action". The ePrivacy rules (PECR in the UK) then require that consent before a website stores or reads most non-essential cookies on a visitor's device.

Three points from the GDPR shape every cookie banner:

1. Silence is not consent. Recital 32 says plainly: "Silence, pre-ticked boxes or inactivity should not therefore constitute consent."
2. Withdrawing must be easy. Article 7 says "It shall be as easy to withdraw as to give consent."
3. You must be able to prove it. The same article says "the controller shall be able to demonstrate that the data subject has consented".

France's data protection authority, the CNIL, adds that scrolling down or swiping through a website "can no longer be viewed as a valid expression of consent", and that operators "must not read or write any data in the terminal of the users before obtaining consent."

Does a small business website need cookie consent?

Yes, if it uses cookies or similar tracking that is not strictly necessary and it has visitors in the UK or EU. Size does not create an exemption. The question is not how big your business is, but what your website loads.

Most small business sites need consent because of tools they added without thinking of them as tracking:

• Analytics, such as Google Analytics.
• Ad pixels and tags, such as the Meta Pixel, Google Ads conversion tags or LinkedIn Insight Tag.
• Embedded content that sets its own cookies, such as video players, maps or social feeds.
• Chat widgets and heatmap tools that track visitor behaviour.

The stakes are real. Under Article 83, the most serious breaches can lead to fines of up to 20 000 000 EUR, or 4 % of total worldwide annual turnover, "whichever is higher". Small businesses are far more likely to face a complaint or a warning than a headline fine, but a complaint is still time and stress you do not need.

Which cookies need consent, and which do not?

Cookies that are strictly necessary for something the visitor asked for can usually run without consent. Everything else waits for a "yes".

The safest approach is to list every cookie and tag your site actually loads, then sort each one into a category. A cookie scanner can help, but check the result by hand: scanners miss tags that only fire on certain pages, such as a thank-you page.

What should a GDPR cookie banner include?

A compliant banner gives the visitor a real choice, in plain words, before anything is tracked. Use this checklist:

1. Accept and Reject on the first layer, with equal size and weight. Hiding "Reject" behind a settings link nudges people to accept, which undermines "freely given" consent.
2. A short explanation of each purpose, such as "measure how the site is used" or "show you relevant ads", with a link to your cookie or privacy notice.
3. Separate choices per category, so a visitor can allow analytics but refuse advertising.
4. No pre-ticked boxes and no categories switched on by default.
5. Nothing non-essential loads before the choice. The banner on screen is not enough; the tags themselves must wait.
6. The site still works if they refuse. The CNIL notes that users must be able to access the service "even in case of refusal to consent".
7. A way to change the choice later, such as a "Cookie settings" link in the footer, so withdrawing is as easy as agreeing.
8. A record of each choice: what was accepted, when, and which version of the banner was shown.

Bad banner, good banner

How does Google Consent Mode fit in?

Google Consent Mode is how your banner tells Google's tags what the visitor chose. Google describes it as a way to control how Google tags behave "based on users' consent choices". It does not ask for consent itself; your banner still does that.

Consent Mode uses four main signals:

Google offers two implementations: basic, which blocks Google tags until the visitor consents, and advanced, which loads the tags with consent denied by default and sends limited, cookieless signals that Google uses for conversion modelling. Basic is simpler to explain to visitors and to your adviser; advanced gives better modelled data in Google Ads and Analytics. Whichever you choose, the default for UK and EU visitors should be "denied" until they agree.

If you advertise with Google, this is not optional. Google's EU user consent policy says advertisers must obtain end users' "legally valid consent" for cookies where legally required, "retain records of consent given by end users", and "provide end users with clear instructions for revocation of consent."

Other platforms need the same treatment. The Meta Pixel, LinkedIn tags and similar scripts should only fire after the matching category is accepted, usually by loading them through your tag manager with a consent trigger.

How do you set up cookie consent on a small business website?

You can set it up in an afternoon if you work through it in order:

1. Audit what loads. List every script, pixel, embed and cookie on the site, including tags added by plugins.
2. Pick a consent tool that supports per-category choices, consent records and Google Consent Mode. Many are free or low-cost for small sites.
3. Write the banner text in plain language, with Accept and Reject on the first screen.
4. Block non-essential tags by default, then connect each one to its consent category, ideally through Google Tag Manager.
5. Turn on Consent Mode with "denied" as the default for UK and EU visitors.
6. Update your cookie and privacy notice so it lists what you use and why.
7. Test it. Open the site in a private window, refuse everything, and check in your browser's developer tools that no analytics or ad cookies appear. Then accept and check they do.
8. Re-check after every change to the site, such as a new plugin, embed or ad platform.

A cookie banner also affects how the site feels. A heavy banner that covers the page or slows loading costs you visitors, which matters as much as the legal side. Our article on signs your website is losing customers covers that wider picture.

What are the most common cookie consent mistakes?

1. Tracking before the click. The banner shows, but Google Analytics or the Meta Pixel already fired.
2. No equal Reject button. Accept is one click; refusing takes three.
3. Treating scrolling or closing the banner as consent.
4. Forgetting embeds. A YouTube video or map on the contact page sets cookies on its own.
5. No way to change the choice once the banner is closed.
6. No records, so you cannot show who consented to what.
7. Set and forget. New tools get added and nobody checks the banner still covers them.

Frequently asked questions

Does GDPR apply to my website if my business is outside Europe?

It can. The GDPR can apply to businesses outside the EU that offer goods or services to people in the EU or monitor their behaviour, and website tracking is a form of monitoring. If you target UK or European customers, plan for consent as if you were based there.

Do I need a cookie banner if I only use Google Analytics?

In most cases, yes. Google Analytics sets cookies that are not strictly necessary, so UK and EU visitors should be asked first. Google's own EU user consent policy requires legally valid consent where the law demands it.

Is a cookie banner enough to be GDPR compliant?

No. The banner handles consent for cookies and tracking. You also need a clear privacy notice, secure forms, a lawful basis for the personal data you collect, and a way to answer requests from people about their data.

What is Google Consent Mode v2?

It is the current version of Consent Mode, which added the ad_user_data and ad_personalization signals alongside ad_storage and analytics_storage. It passes your visitors' choices from your banner to Google Ads and Analytics, so Google's tags behave according to those choices.

Can I set cookies before the visitor clicks Accept?

Only strictly necessary ones, such as the cookie that remembers the visitor's consent choice or keeps a shopping basket working. Analytics and advertising cookies should wait until the visitor agrees.

The bottom line

Good GDPR cookie consent is simple to describe: nothing non-essential runs until the visitor says yes, saying no is just as easy, the choice can be changed at any time, and you keep a record. Getting there is mostly a careful setup of your banner, your tag manager and Google Consent Mode, then checking it again whenever the site changes.

Organoo builds websites for businesses in the UK and Europe with consent-aware analytics and ad tracking set up from the start. If you want a site that respects your visitors' choices and still measures what matters, see our website design service, look at our pricing or tell us about your project. Custom quotes and small budgets are welcome.