Cookie Consent
Definition
Cookie consent comes from the EU ePrivacy Directive, which says that storing information on a visitor's device, or reading what is already there, needs informed permission unless it is strictly necessary to provide the service the visitor asked for. The rule is about the act of storing, not the word cookie, so localStorage entries, device fingerprints and pixel-based identifiers are covered in the same breath. The GDPR then supplies the standard for what permission means: freely given, specific, informed and unambiguous, signalled by a clear affirmative act. Pre-ticked boxes do not qualify, silence does not qualify, and continuing to scroll does not qualify. Regulators have also been clear that refusing must be as easy as accepting, which is why the accept-only banner with a hidden settings link keeps attracting fines.
Why It Matters
Here is the distinction worth carrying away: the banner is triggered by what you set, not by having a website. Session cookies that keep someone logged in, or a flag remembering a language choice they made, are strictly necessary or close to it. Advertising pixels, cross-site analytics and anything that follows a visitor between sites are not, and those need consent before they load — not after, which is what most sites still get wrong. A site that sets no non-essential storage at all has nothing to ask about, and that is a genuine advantage of counting visits at the edge: the server tallies the request it was already handling, nothing is written to the device, and no banner is owed. This is general information rather than legal advice, but the direction is clear enough that designing the storage away is cheaper than designing the banner well.
How It Works
A compliant flow blocks non-essential scripts from running until a choice is made, usually by holding them behind a consent tool that injects them afterwards. The choice is recorded — commonly in a first-party cookie carrying the categories accepted, a timestamp and a version of the notice — so it can be shown to a regulator and honoured on later visits, typically for six to twelve months before asking again. Categories are granular: necessary, preferences, statistics, marketing, each togglable, with reject all given the same prominence as accept all. Edge analytics sidesteps the mechanism completely, because the count happens in the server's own records from the request line, the referrer and the address, with no identifier written back to the browser and nothing to consent to. If you later add an embedded video or a remarketing tag, the banner comes back with it — third-party embeds set their own storage on your behalf.
Real-World Example
A consultant publishes a report at market-review.99helpers.site and expects to spend an afternoon fitting a consent tool. Nothing on the page stores anything: the visits, referrers and countries are counted by 99helpers at the edge, cookie-free, so no banner is needed and the page loads without a grey overlay in front of it. Then a YouTube embed is added to the second section, and that single iframe sets third-party storage the moment the page loads — which puts the banner requirement back on the table. Switching the embed to the privacy-enhanced domain, or linking out to the video instead, keeps the page as it was.
Common Mistakes
- ✕Loading analytics and pixels first and showing the banner afterwards — by then the storage has already happened and the consent is meaningless
- ✕Making accept one click and reject three — regulators treat unequal effort as an absence of free choice
- ✕Adding a banner reflexively to a site that sets nothing — it asks permission for something you are not doing and trains visitors to click through everything
Related Terms
GDPR
The European Union's General Data Protection Regulation, in force since 25 May 2018, governing how personal data about people in the EU may be collected and used. The UK keeps a near-identical version in its own law.
Personal Data
Any information relating to a person who can be identified, directly or indirectly. The definition is broader than most people expect — an IP address counts, and so does an identifier that only becomes a name when combined with something else.
Data Retention
How long data is kept before it is deleted, and the rules that decide that. Keeping everything forever is a decision too, and usually the wrong one.
localStorage
A browser API that stores string key-value pairs on the visitor's device, scoped to one origin and kept until something clears it. Around 5 MB is available, and the data never leaves that one browser.
Web Analytics
Measuring who visits a site and what they look at. The two methods — a script running in the visitor's browser, or counting each request as it is served — produce different numbers, and neither of them is wrong.
Put a file online in seconds
Drop in a document, an image, a page or a whole static website and share the link — free, with no build step and no server to set up.
Host a file free →