Cookies, trackers and an honest banner

Cookies are small files kept in the browser, grouped as necessary, preferences, analytics and advertising. An honest banner gives an equal choice.

What your site does in a person’s browser

We call “cookies” the small files a site keeps in the browser (see the lesson on authentication, where a cookie holds a session number). But other things do the same: local storage (localStorage), pixels (invisible images that report that a page was opened), counter scripts and device “fingerprints” (from the set of fonts, the screen and other things). That’s why lawyers say “cookies and similar technologies,” and why we say “trackers” for short.

Some of these are what the site can’t work without, and some are what follows people. The law and common sense tell them apart. So the first step is always an inventory: what your site sets in a person’s browser, why, for how long and who sets it.

Categories

Four categories are used everywhere.

• Necessary. The thing the person asked for doesn’t work without them: the session at login or an inquiry, protection of the form against request forgery, a record that the person has already answered the banner. They need no consent, but you name them in the notice.
• Preferences (functional). Convenience: language, a color theme, a remembered city. The site works without them. On a strict reading of the EU rules they need consent, and some regulators exempt a setting the person chose themselves; in practice many sites treat them as necessary if the person made the choice. To avoid arguing, list them in the table.
• Analytics. A visitor identifier in a counter: telling a new visitor from a returning one, counting visits. Google Analytics, for example, sets cookies with names like _ga (see the service’s help for the list and the periods).
• Advertising. Identifiers that follow interests between sites and show ads. The most sensitive category.

Third-party embeds set cookies too, and you answer for them as for your own: a video player, a map, a social widget, a chat. That’s why this textbook opens video only after a click. Loading fonts from another server also hands that server the visitor’s address. In January 2022 a court in Munich awarded €100 to a visitor whose IP address was sent to Google by fonts embedded from Google’s servers without consent. Other German courts haven’t all agreed, but it’s simplest to host your fonts yourself, and the page loads faster too (the first lesson of this part).

Open the diagram. In the first part, sort the cookies into categories; in the second, build a banner and see what nudging looks like.

What the law says

In the European Union the rule is in Article 5(3) of the ePrivacy Directive (2002/58/EC, as amended in 2009). Storing information on a person’s device, or gaining access to information already stored there, is allowed only with the person’s consent, after clear and comprehensive information. The exceptions are narrow: storage whose sole purpose is carrying out a transmission, and storage strictly necessary to provide a service the person has explicitly requested. Consent has the meaning it has in the GDPR: freely given, specific, informed and unambiguous, and as easy to withdraw as to give. In 2019 the Court of Justice of the EU decided in Planet49 (case C-673/17) that a pre-checked box isn’t valid consent for cookies. In January 2022 the French regulator, the CNIL, fined Google €150 million and Facebook (Meta Ireland) €60 million, because on their sites accepting cookies took one click and refusing took several. Several regulators allow a narrow exception for strictly anonymous audience measurement, so check your own country’s regulator.

In the United Kingdom the same rule is in regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR): a person must not store information, or gain access to information stored, in a user’s device unless the exceptions in Schedule A1 apply, or the user has given consent. The Data (Use and Access) Act 2025 added new exceptions (for example a narrow one for purely statistical analytics about how your own service is used) and raised the penalties for PECR breaches. The ICO reads the exceptions narrowly, and according to commentators on its guidance, an ordinary third-party analytics tool whose provider reuses the data for its own purposes may not qualify. Read the ICO’s current guidance before deciding that your analytics needs no banner.

In the United States there’s no federal cookie law. Instead the state privacy laws apply to the purpose. Under California’s CCPA, giving personal information to third parties for cross-context behavioral advertising is “sharing,” and a consumer has the right to opt out of the sale or sharing of their information. A covered business must give a way to opt out (a link such as “Do Not Sell or Share My Personal Information”) and must treat an opt-out preference signal as a valid request. The best-known signal is Global Privacy Control (GPC): a browser setting or extension that tells every site you visit that you opt out. In August 2022 the California Attorney General announced a $1.2 million settlement with Sephora, the first CCPA enforcement action, which alleged that it failed to disclose that it sold personal information and failed to honor opt-outs sent through GPC. Several other states have laws with a similar opt-out signal rule. The laws apply only above their thresholds (see the lesson on personal data law), but the practice of honoring GPC is cheap, and the browser sends it for you: a Sec-GPC: 1 request header, and navigator.globalPrivacyControl in a script. Also be aware that in the US some plaintiffs have used older wiretapping and privacy statutes, such as California’s Invasion of Privacy Act, against trackers and session recording; ask a lawyer if you use them.

In Russia, as a comparison: there’s no separate cookie law (as of 30 October 2026). But 152-FZ defines personal data broadly, so a visitor identifier together with an address or behavior may fall under it. In practice, Russian sites mention cookies in the policy and give a choice for the non-essential ones, and lawyers differ about how far a Russian audience requires a banner. A foreign counter or chat is also a data transfer abroad.

This guide is a snapshot, and the rules and their readings change; for a real project discuss it with a lawyer.

How to make an inventory

1. Open the site in a window with no history, and in the developer tools open the “Application” tab: the “Cookies” and “Local storage” sections.
2. Write down everything that is there before a choice in the banner. Then press “Accept” and write down what was added. Then clear it all and press “Reject”: nothing non-essential should be added.
3. For each entry, a table row: name, why, how long, who sets it, category, whether consent is needed.
4. Go through the pages with embeds (video, a map, a chat): they set their own.
5. Update the inventory whenever a new service is added. Free scanners also find cookies, but they don’t know why you have them.

The banner

You saw the rules of an honest banner in the lesson on analytics ethics: two equal buttons, nothing on in advance, the counter not started before the choice, and the chance to change your mind. Here is what practice adds.

• Equality in look and place. “Accept” and “Reject” of the same shape, color and size, side by side. A bright “Accept” next to a tiny refusal link is a dark pattern from the lesson on the limit of manipulation, and it’s exactly what was fined in the EU.
• Three choices: accept all, reject all, set by category. Necessary cookies can’t be switched off.
• Blocking before the choice. A banner without blocking is decoration. The “dormant” script technique (type="text/plain") from the lesson on analytics ethics is practiced right here.
• A record of the choice: the date, the banner version and the choice. It’s the same “consent as a record” as in the lesson on personal data law.
• A way to change your mind: a “Cookie settings” link in the footer of every page.
• It doesn’t get in the way. The banner doesn’t cover the content entirely or hide the focus (WCAG 2.4.11), it opens with the keyboard, it has a name, and its buttons have visible focus.
• It doesn’t come back every time after a refusal: the choice is remembered for a reasonable period (six months or a year).
• No wall: the site opens whatever the choice.
• Browser signals. Honor Global Privacy Control where the law counts it (California and other states); elsewhere it’s good practice. Treat a GPC signal as an opt-out of the sale or sharing of data and as a refusal of advertising cookies.

Practice

You’re in the era of 2022: the site collects statistics, and you should say so honestly. Make a cookie table for your project (at least five rows, with a category and a consent flag), make a banner of three identical buttons, make the counter dormant and add a link in the footer for changing your mind.

The check reads markup: the categories and the consent flag, a banner with three equal buttons, a dormant script. Whether it’s honest in fact, and whether the table is real, is for you to decide: open the developer tools on a real site and compare.

What used to be different

In the 2000s cookies were “cookies” and bothered no one. Then advertising networks appeared that followed people between sites, and in 2009 and 2011 the EU introduced the consent rule. The first banners were a line saying “by continuing to use the site you agree,” and then they became a maze where refusing took five screens. Regulators began to punish the maze itself. In the US the answer came later and took a different form, with opt-outs and signals such as GPC. Russian practice rests for now on the law on personal data and on site owners’ caution, but it’s changing too.