Cookie Consent for Small Business Websites in the EU

If your website uses Google Analytics, the Meta Pixel, Google Ads tags or embedded videos, it almost certainly needs a cookie banner in the EU. Many small business sites have one. Fewer have one that does what it says.

This post explains the basics in plain words: what the rules require in general, what a fair banner looks like, how Google’s Consent Mode fits in, and what it means for your ads. It is general information, not legal advice. Rules are applied differently by each country’s data protection authority, and they change. For anything specific to your business, ask a lawyer or your local authority’s guidance.

The rule in one paragraph

Two sets of EU rules matter. The ePrivacy rules (implemented in each country’s own law) say you generally need a visitor’s consent before you store or read information on their device, such as cookies, unless it is strictly necessary for a service they asked for. GDPR sets the standard for that consent: freely given, specific, informed and unambiguous, and as easy to withdraw as to give.

In practice: strictly necessary cookies (keeping a shopping basket, remembering the language, security, remembering the consent choice itself) don’t need consent. Analytics, advertising and most third-party tracking do.

What usually needs consent on a small business site

Tool	Typical status
Shopping basket, login, security cookies	Strictly necessary, no consent needed
Remembering the cookie choice itself	Strictly necessary
Google Analytics 4	Generally needs consent
Meta Pixel	Needs consent
Google Ads and remarketing tags	Need consent
TikTok Pixel, LinkedIn Insight Tag	Need consent
Embedded YouTube videos, Google Maps	Often set cookies; many sites block or use privacy-enhanced versions until consent
Chat widgets	Depends on the tool; check what it sets

Some authorities accept privacy-friendly analytics without consent under strict conditions, but the conditions vary by country. If in doubt, ask for consent.

What a fair banner looks like

Data protection authorities across Europe have repeatedly criticised the same banner designs. A banner that is more likely to be fine:

• Blocks non-essential cookies until the visitor chooses. Tags must not fire on page load "just in case".
• Offers Accept and Reject at the same level. If "Accept all" is a big button on the first screen, "Reject all" should be just as easy: same screen, similar size and prominence. Hiding reject behind "Settings" is a common complaint.
• Has no pre-ticked boxes. The EU Court of Justice has ruled that pre-ticked boxes are not valid consent.
• Explains purposes in plain language: analytics, advertising, embedded content, and which companies are involved.
• Lets people change their mind later, typically through a "Cookie settings" link in the footer.
• Doesn’t treat scrolling or continuing to browse as consent.
• Remembers the choice, so visitors aren’t asked on every page.

Show the banner in your visitors’ language. A German-language site with an English-only banner makes consent less "informed".

Google Consent Mode v2, explained simply

Consent Mode is Google’s way for your cookie banner to tell Google tags (Analytics, Ads, Tag Manager tags) what the visitor chose. It uses four main signals:

• ad_storage: may advertising cookies be stored?
• analytics_storage: may analytics cookies be stored?
• ad_user_data: may user data be sent to Google for advertising?
• ad_personalization: may data be used for personalised advertising, such as remarketing?

The last two were added in version 2. Google requires advertisers to send these consent signals for users in the European Economic Area if they want to keep using features like remarketing audiences and conversion measurement based on those users.

The usual setup:

1. Set all four signals to denied by default, before any Google tag runs.
2. When the visitor accepts, your banner updates the signals to granted.
3. Google tags read the signals and change behaviour accordingly.

There are two modes. In basic mode, Google tags don’t load at all until consent is given. In advanced mode, tags load but, without consent, send cookieless pings that Google uses for modelling. Advanced mode gives Google more data to fill gaps; basic mode is the more conservative choice. Which one is right for you is a question for your privacy advice, not just your marketing.

What about the Meta Pixel?

Meta doesn’t use Google’s Consent Mode. The usual approach is to have your banner or Tag Manager load the Meta Pixel only after the visitor accepts marketing cookies. Many consent tools have a ready setting for this. Our guide on Meta Pixel setup for small businesses covers the rest of the setup.

What it means for your ads

Proper consent means you will measure fewer conversions than really happen. People who reject cookies still book tables and buy products; your tools just can’t see all of them. Some practical consequences:

• Expect lower reported numbers after you fix a banner that previously tracked everyone. The business didn’t change; the measurement did.
• Compare channels with the same blind spot. All tools miss the same rejecting visitors, so trends are still useful.
• Use first-party signals you are allowed to use: booking records, order systems, code words, asking customers where they heard of you.
• Server-side tracking doesn’t remove the need for consent. It is a technical route, not a legal one.

Choosing a banner tool

You can use a paid consent management platform, a free plan from one, or a banner your web developer builds. Whatever you choose, check:

• It actually blocks tags before consent. Test it: open your site in a private window, don’t click anything, and look at which cookies are set (your browser’s developer tools show them).
• It supports Google Consent Mode v2 if you use Google tags.
• It logs consent in a way you can show if asked.
• It works on mobile without covering the whole page in a way that makes rejecting harder than accepting.

A short checklist

• List every tool on your site that sets cookies or sends data
• Block non-essential ones until consent
• Accept and Reject equally easy, no pre-ticked boxes
• Consent Mode v2 signals set, default denied
• Meta Pixel and other ad tags fire only after consent
• A footer link to change the choice
• Privacy policy explains it all in plain words

The free Paid Ads Workbook includes this checklist as part of its tracking setup, next to the Pixel and GA4 steps in our GA4 setup guide.