How to set up a cookie banner correctly: what to consider legally and technically

When do you need a cookie banner – and when not?

What matters is not whether a website uses “cookies” but what for. Technically necessary storage, for example for the shopping cart, login or the security of the site, needs no consent. Consent is, however, required for everything that is not strictly necessary: audience measurement, marketing and advertising pixels, remarketing and embedded third-party content, if information is stored on or read from the device in the process.

This applies not only to cookies but also to similar techniques such as the browser’s local storage or fingerprinting. A website that uses only necessary technology can do without a banner; it still needs a complete privacy policy. So first get an overview of which services your site actually embeds – it is often more than one thinks.

The legal bases at a glance

In Germany, Section 25 of the TDDDG regulates when information may be stored on or read from the end device: in principle only with consent, unless the storage is strictly necessary so that a service requested by the user can be provided. If personal data is processed in the process, the GDPR also applies, setting requirements for voluntariness, information, specificity and provability of consent.

Valid consent is voluntary, informed, tied to specific purposes and given by an unambiguous active act. The European Court of Justice and the Federal Court of Justice have ruled on pre-ticked boxes that these do not constitute valid consent. The legal situation and the interpretation by the supervisory authorities continue to develop; for your individual case, please turn to a data protection or legal adviser.

What a compliant banner looks like

On the first layer, the visitor must understand what it is about: which technologies are used for what, and who is responsible? The option to refuse should be as easy to reach as consent. In the view of the German supervisory authorities, this means in practice a button for refusing that is designed equivalently to the button for accepting, not hidden in a text link or a grey field.

On the second layer, visitors can switch categories or individual services on and off. Defaults must be set to “off”, except for necessary functions. The privacy policy and legal notice (Impressum) must also be reachable without answering the banner. The decision must be changeable at any time later, for example through a permanently visible link in the footer. The banner should also be operable by keyboard and screen reader.

• First layer: clear explanation, purposes, controller
• Equivalently designed buttons for accepting and refusing
• Second layer: selection by category or individual service
• No pre-selected boxes for non-essential services
• Links to privacy policy and legal notice without forcing a decision
• Permanent link to change or withdraw consent

Technical imple­menta­tion: load scripts only after consent

The most common mistake lies not in the text but in the technology: the banner appears, but analytics or advertising scripts already load on page view. That makes the consent worthless. Non-essential scripts may start only after the visitor has agreed. You achieve this through a consent solution that blocks scripts, or through a tag manager that ties triggers to consent.

Embedded content such as videos or maps should also be loaded only after consent, for example via a placeholder with a click. Fonts and scripts that you deliver locally avoid transfers to third parties from the outset. If you use Google services, check whether their consent mode is correctly connected to the banner. Check the implementation in a new browser window with the developer tools: before the decision, no requests may go to advertising or analytics services.

Docu­menta­tion, withdrawal and ongoing maintenance

You must be able to prove that and how visitors consented. Good consent solutions log the decision with the time and the version of the banner. The list of services in use, in the banner and in the privacy policy, must match reality. When a new tool is embedded, such as a chat widget or a pixel, updating both places belongs to the same work step.

Plan regular checks, because websites change: plugins are updated, services change their behavior, marketing adds scripts. A scan of the website for cookies set and third parties called helps to discover deviations. Withdrawal must be as easy as consent; after a withdrawal, the site should switch the corresponding services off again.

Common mistakes – and how Nano Concepts helps

Typical mistakes are a banner without an equivalent refuse option, scripts that load before consent, outdated service lists, a banner that covers the legal notice and privacy policy, and a design pattern that pushes people to agree. Sometimes the privacy policy also does not match what the site actually embeds. Such deviations can lead to complaints, warning letters or claims for damages.

Nano Concepts sets up the consent solution technically cleanly: we inventory the embedded services, block non-essential scripts until consent, design the banner to match your brand and check the result in the browser. This is part of our website projects (Starter from €2,500, Professional from €8,000) and can also be requested for existing sites; the quote follows the free initial consultation. Please clarify the legal assessment and the wording with your data protection or legal adviser.