Cookie consent banner: legal without scaring visitors away

That pop-up about cookies is neither decoration nor a formality — it is a legal obligation with fairly clear rules. A poorly built banner is both unlawful and annoying, while a well-built one protects you without ruining the experience. Here is how to do it right, without dark patterns.

Why the banner exists at all

GDPR and ePrivacy rules require that for non-essential cookies you obtain the visitor's consent before they activate. This covers cookies for analytics, advertising and embedded content (YouTube, maps, social networks). The aim is not to torment the user but to give a person a real choice over what is tracked. The wider context of your obligations is in GDPR for websites.

Which cookies need consent and which do not

• Essential (no consent): those without which the site cannot function — cart, login, security and basic technical cookies.
• Analytics: Google Analytics and similar — require consent.
• Marketing/ads: tracking for ads and remarketing — definitely require consent.
• Embedded content: a YouTube video, Google map or social buttons set their own cookies — these need consent too.

What a correct banner looks like

The rule is simple: rejecting must be as easy as accepting. That means a "Reject all" button as visible as "Accept all", no pre-ticked boxes and no hiding options three clicks deep. Offer categories (analytics, marketing) so the user can choose. Avoid a "cookie wall" that makes site access conditional on consent — in most cases that is not valid consent.

The most common mistake: scripts load before consent

Many banners ask nicely, yet Google Analytics or the Facebook pixel still load the moment the page opens — which makes the consent meaningless. The correct solution blocks those scripts until the visitor clicks "Accept". If you use analytics, align it with the banner; basic settings and a cookieless alternative are described in analytics for beginners.

Tools that do it for you

You do not have to code a banner from scratch. Solutions like Cookiebot, CookieYes and (for WordPress) Complianz automatically scan cookies, show a banner with categories and block scripts until consent, with a consent log you need as proof. For a simple site without ads or analytics, a lightweight custom banner sometimes suffices — but the moment you add analytics, a tool pays off.

This applies in Serbia too

Serbia's personal data protection law is largely aligned with GDPR, and the moment you have visitors from the EU (including the diaspora) GDPR concerns you anyway. The practical takeaway: put up a banner that respects choice, blocks unnecessary cookies until consent and keeps a record. That way you are both compliant and fair to the visitor — which, in the end, is also good business.