Scan your site

Cookies and consent: what your site sets and when you need a banner

Last updated

By the FocalScore team at Astrolabix LLC. First published . Sources last checked .

The short answer

Find out what your site actually stores on a visitor's first visit. Cookies the site needs to work (a basket, a login, remembering the visitor's cookie choice) can stay. Analytics and advertising cookies, in many places including the UK and the EU, must wait until the visitor agrees. If you set them, you need a banner that asks first, remembers the answer and can be reopened, and a cookie policy that matches what the site really sets.

What cookies are, and which kinds need consent

A cookie is a small piece of data a site stores in the visitor's browser. Sites also use similar browser storage that works the same way for these purposes. They fall into two groups:

Cookies set under your own address are first-party; cookies set by another company's address, from a script or embed on your page, are third-party. Browsers are restricting third-party cookies, and Google's guidance explains how to prepare for that.

When you need a banner depends on where your visitors are. In the UK and the EU, cookies that aren't strictly necessary need the visitor's consent before they are set, so a site with analytics or advertising tags needs a way to ask. A site that sets only strictly necessary cookies doesn't need to ask. Elsewhere the rules differ: California, for example, treats the Global Privacy Control signal some browsers send as an opt-out of selling or sharing personal data. This guide is not legal advice; your country's data-protection regulator publishes the rules that apply to you.

Why it matters to a small business

A banner that asks but loads the tracking tags anyway gives the impression of consent without the substance, and a cookie policy that doesn't match the site is easy for anyone to check against it. It also matters for your own numbers: if your analytics tags load before anyone has answered, the figures you rely on include people who later said no.

How the free scan decides

The scan visits the homepage as a new visitor who hasn't answered any banner, and records what is stored and what is loaded.

Putting it right

  1. Start from the inventory. Take the list from your report and, for each cookie, note who sets it, what it is for and how long it lasts. Remove the tags and embeds you no longer use; each one gone is one less thing to ask about.
  2. Hold back what needs consent. Use a consent tool that blocks analytics and advertising tags until the visitor agrees, and only then loads them. If you use Google's tags, consent mode passes the visitor's answer to them.
  3. Make the banner fair. Offer accepting and refusing with equal ease, remember the answer, and put a permanent "Cookie settings" link in the footer that reopens the choice.
  4. Respect the opt-out signal. Most consent tools have a setting for Global Privacy Control; switch it on so a browser that sends it is treated as a "no".
  5. Write the policy from the inventory. A table with each cookie's name, who sets it, its purpose and how long it lasts, linked from the banner and the footer. When the scan finds a cookie lasting longer than the policy says, correct whichever of the two is wrong.
  6. Look again after changes. A new plugin, app or embed often brings its own cookies; add it to the inventory and the policy when you add it to the site.

Where to set it up, by platform

How to check yours

Open your homepage in a private window and, before touching the banner, open the browser's developer tools and look at the stored cookies (in Chrome, Application › Cookies). Anything for analytics or advertising there has been set without consent. Then refuse, reload and look again. The free scan does the same as a new visitor and lists each cookie with who set it; the sample report shows the layout.

Checklist

What the free scan checks for this

These are the FocalScore checks that cover this guide's subject. Each one in your report says what it found, shows the evidence and gives the fix.

Sources

Last checked . Documentation, settings and rules change; if one of these pages now says something different, it is right and this guide is out of date. Tell us at info@focalscore.com.

  1. Google Tag Platform: Set up consent mode
  2. Privacy Sandbox: Prepare for third-party cookie restrictions
  3. OWASP Cheat Sheet: Session management