Cookie consent

Cookie consent is the explicit permission a website visitor gives before non-essential cookies, such as analytics, advertising or social media trackers, are placed on their device. Under GDPR in the EU and similar laws elsewhere, this permission cannot be assumed or pre-ticked: it has to be freely given, specific and as easy to refuse as to accept, which is why almost every website now shows a consent banner on first visit.

‍

What is cookie consent?

A cookie is a small file a website stores in a visitor's browser to remember information between visits, a login session, a language preference, or a unique identifier used for tracking. Some cookies are strictly necessary for the site to function (a shopping cart, a login session) and don't require consent. Others, mainly analytics and advertising cookies, collect behavioural data and legally require the visitor's informed, opt-in agreement before they can be set. Cookie consent is the mechanism, usually a banner or pop-up, that collects and records that agreement.

‍

How a cookie consent banner works

A consent management platform (CMP) blocks non-essential scripts from loading until the visitor makes a choice, then only fires the ones they agreed to. A simplified example of a blocked analytics script looks like this:

<script type="text/plain" data-category="analytics">
  gtag('config', 'G-XXXXXXX');
</script>

The script only runs (its type is switched from text/plain to text/javascript by the CMP) once the visitor accepts the "analytics" category. If they refuse or ignore the banner, the script never executes and no tracking cookie is set.

‍

Cookie categories and consent choices

• Strictly necessary: required for the site to function (session, security, load balancing); no consent needed.
• Functional: remembers preferences like language or currency; usually requires consent.
• Analytics: measures traffic and behaviour (page views, sessions); requires consent.
• Advertising / marketing: powers retargeting and ad personalisation; requires consent, and is the most regulated category.

‍

Opt-in vs opt-out consent models

Different regions take different default positions, which changes how a banner has to be built:

‍

Best practices and common pitfalls

• Never pre-tick optional consent categories, GDPR explicitly requires an active, informed choice.
• Make "Reject all" as easy to find and click as "Accept all", a banner that hides refusal behind extra clicks (a dark pattern) is a compliance risk.
• Block non-essential scripts until consent is given, loading an analytics or ad script before the visitor answers defeats the purpose of the banner.
• Keep a record of consent (timestamp, choices made) in case of an audit.
• Avoid a full-page cookie wall that blocks all content until consent is given, most regulators treat this as invalid, non-free consent.

‍

Cookie consent and site performance

A poorly implemented CMP script can itself become a performance problem, adding render-blocking JavaScript that delays Largest Contentful Paint and hurts Core Web Vitals. It also directly affects analytics accuracy: a low consent rate means traffic and conversion data in tools like GA4 undercounts real visitors, since only consenting sessions get tracked. Choosing a lightweight, well-configured CMP and loading it asynchronously keeps both compliance and page speed intact.

‍

Cookie consent at BeBranded

At BeBranded, we implement compliant, lightweight cookie consent banners on the websites we build, configured to block non-essential scripts by default and to keep both GDPR compliance and page speed intact. This work is part of our website service.