Websites · Glossary
What is a consent banner?
A consent banner is the notice a website shows on a first visit asking whether the visitor accepts non essential cookies and similar tracking, such as analytics, advertising pixels and embedded videos or maps from other companies. A proper banner offers an equally easy accept and reject choice, and the site waits for the answer before loading anything the visitor has not agreed to.
A consent banner is a switch, not a notice. It only means something if the site actually waits for the visitor's answer before loading trackers and third party embeds.
Nuwan Madhusanka · Co-founder
5 min read · Published
| Question | UK | EU | Australia |
|---|---|---|---|
| Main rules | PECR and UK GDPR | ePrivacy Directive and GDPR | Privacy Act 1988 and its principles |
| Non essential cookies | Consent before they are set | Consent before they are set | No cookie specific consent rule |
| Rejecting | Must be as easy as accepting | Must be as easy as accepting | Good practice, not a cookie rule |
| Pre ticked boxes | Not valid consent | Not valid consent | Avoid; consent must be informed |
| Essential cookies | No consent needed | No consent needed | Disclose in the privacy policy |
| Regulator | ICO | National data protection authorities | OAIC |
What a consent banner is
Most websites load more than their own files. Analytics tools set cookies to recognise returning visitors, advertising tags follow people across sites, and embedded YouTube videos, Vimeo players and Google Maps load code from those companies, which can set their own cookies and learn who visited. Privacy laws in the UK and the European Union say that apart from cookies strictly necessary to provide what the visitor asked for, such as a login session or a shopping cart, a site must get consent before storing or reading information on a visitor's device. The consent banner is where that consent is asked for and recorded. It usually appears at the bottom or corner of the first page, explains in a sentence what is used, links to the privacy or cookie policy, and offers choices. The answer is remembered so the visitor is not asked on every page, and a link in the footer lets them change their mind.
How it gates cookies and embeds
A banner that only displays a message while trackers load anyway does not achieve anything legally or practically. A working banner sits in front of the site's optional code. Until the visitor chooses, the site loads only what is essential. Analytics and advertising scripts stay off. Embedded videos and maps are replaced by a placeholder, such as a still frame and a button that says the content is from YouTube and will load if they click. When the visitor accepts, the site stores their choice with a date and a version number and loads the optional code. When they choose essential only, the optional code stays off and the placeholders stay in place, with the option to load a single video by clicking it. If the site later adds a new tracker, the version number changes and the banner asks again. Essential storage, such as staying signed in, does not need consent.
When a site needs one
A site needs a consent banner when it uses non essential cookies or loads third party content that can track visitors, and it has visitors in places whose law requires consent, notably the UK and the EU. A UK shop with analytics needs one; so does an Australian business with European customers. Australian law has no cookie specific consent rule like the UK's, but the Privacy Act expects businesses it covers to tell people when personal information is collected and why, and tracking that identifies people counts. Many Australian sites use a banner anyway because it is the clearest way to give that notice and respect choice. A site that sets no cookies beyond essential ones and embeds nothing from other companies may not need a banner at all, which is a real option: a simple cookie free visitor counter and a click to load map can remove the need entirely.
Common mistakes
Loading analytics and embeds before the visitor answers, which defeats the purpose. Offering a big Accept button and hiding Reject behind a settings page, which UK and EU regulators have said does not give a free choice. Pre ticked boxes for optional categories. A full screen pop up that blocks the site until the visitor accepts. Treating scrolling or continuing to browse as consent. No way to change the choice later. Calling every cookie essential, including analytics. Forgetting that embedded videos and maps are third party content too. Copying a banner and cookie policy from another site that uses different tools, so the text describes trackers the site does not have and misses the ones it does. And never revisiting the banner when a new marketing tag is added by someone in a hurry before a campaign launch.
Where it shows up in OneCraft
When a website is generated with the legal capability, the AI follows its legal guide: a bar fixed to the bottom of the page, never a blocking pop up, with one sentence, Accept all and Essential only as equal buttons and a link to the privacy page, plus a Privacy choices link in the footer that reopens it. YouTube, Vimeo and Google Maps embeds show a click to load placeholder until consent. The choice is stored with a version so a change asks again. Staying signed in counts as essential, and the site's own visit counter sets no cookies and no ids. Phone apps get no banner, since they have no cookies or embeds. The AI writes no privacy policy or terms: the owner supplies that text, which is used word for word, and until then the page says the policy is being prepared.
Questions people ask
Does an Australian website need a cookie consent banner?
Australian law has no rule that requires a cookie banner as such. A business covered by the Privacy Act must still tell people when it collects personal information, including through tracking. If the site has visitors from the UK or EU, their rules apply to those visitors. Many Australian sites use a banner for clarity and simplicity.
Are analytics cookies counted as essential cookies?
Under UK and EU rules, generally no. Essential means needed to deliver what the visitor asked for, such as a login or a cart. Analytics help the business, not the visitor, so they normally need consent. Counting visits without cookies or identifiers avoids the question altogether.
Can a consent banner block the site until people accept?
A wall that only lets people in if they accept tracking is not a free choice under UK and EU rules, so regulators treat it as invalid consent in most cases. A bar that sits at the bottom while the visitor reads, with accept and reject buttons of equal weight, is the safer pattern.
How long should a cookie consent choice be remembered?
There is no single fixed period, but six to twelve months is common practice, after which the banner asks again. Ask again sooner if the site starts using new kinds of cookies or trackers. Store the date and version of the choice so you can show what the visitor agreed to.
Does an embedded YouTube video need consent?
A standard YouTube embed loads code from Google that can set cookies and send data about the visit, so under UK and EU rules it generally needs consent first. A placeholder that loads the video only when clicked solves it, and some providers offer privacy enhanced embed modes that reduce tracking.
Make one with websites
The button opens the generator with this use case already described. Change the wording to match your own.
Create a website with OneCraftRelated questions
- What is a data export request?What is a data export request? A person asking for a copy of the data a business holds on them. Timings under GDPR, UK GDPR and the Australian Privacy Act.
- What is a CDN?What is a CDN? A network of servers around the world that keeps copies of your site files close to visitors, so pages load faster and survive traffic spikes.
- What is noindex?What is noindex? A tag that asks search engines not to show a page in results while it stays online. When to use it, how it differs from robots.txt, and risks.
- What is a hiring pipeline?What is a hiring pipeline? The stages an applicant moves through, from new to screening, interview, offer and hired or rejected, and what happens at each.
Written and checked by the OneCraft team. Last checked .