Do you actually need a cookie banner?
Six questions about what your site puts on a visitor's device. Nothing is sent anywhere — the answer is worked out in your browser, and this page stores nothing about you either.
Written against the European rules on storing things on a visitor's device — the ePrivacy Directive as implemented in the EU and EEA, and the equivalent UK regulations — which is what “cookie banner” nearly always means. It does not cover US state privacy laws, which ask different questions about selling and sharing data. (We build software, not legal advice: assess your own setup.)
- 1
Do you run advertising or marketing tracking?
Meta Pixel, Google Ads, LinkedIn Insight, TikTok Pixel, or any retargeting tag — including the server-side versions (Meta Conversions API, server-side GTM), which do the same job without a browser tag.
- 2
Do you embed third-party content that sets cookies?
YouTube or Vimeo players, Google Maps, live-chat widgets, social feeds, comment systems. (Google Fonts served as a stylesheet sets no cookies — though hotlinking it does send your visitor's IP to Google, which is a data-protection question rather than a banner one. Self-hosting the files removes it either way.)
- 3
Does your analytics set cookies or a persistent visitor ID?
Google Analytics 4 does — the _ga cookie holds an identifier that persists across visits. Some privacy-focused tools do not. If you run GA4 with consent mode, answer for what it does before anyone consents.
- 4
Do you store anything on the visitor's device yourself?
Your own cookies, localStorage or sessionStorage — for preferences, A/B tests, carts, or anything beyond keeping a logged-in user signed in.
- 5
Does your host, CDN or shop platform set cookies for you?
Cookies you did not choose but that ride on your domain — Cloudflare's __cf_bm, Shopify's _shopify_y, Wix, Squarespace, Webflow and WordPress plugin cookies, Stripe.js on any page that loads it. Some are security or load-balancing; some are analytics.
- 6
Do visitors log in to your site?
A session cookie that exists only to keep a signed-in visitor signed in is generally treated as strictly necessary. It is asked here because it is still a cookie — it changes what you may claim publicly, even where it needs no consent.
0 of 6 answered.
Why this question keeps being asked wrong
The rules behind the banner are about reading and writing things on someone else's device, not about having a website. That is why the honest version of this check is a list of what you store rather than a checkbox that says “EU visitors”. A site that stores nothing has nothing to ask permission for, and a site running retargeting needs to ask properly no matter which analytics it uses.
We sell cookieless analytics, so we have an obvious interest in one of the six answers above. The other five we cannot sell you anything for, which is exactly why they are on the page.