Cookies and tracking on your website, delegated to a plugin

Aug 29
3 min read

Updated: 4 days ago

Introduction

A banner appears on the website asking visitors to accept cookies. It was added by a plugin, it has never been configured, and the analytics and advertising scripts load before anybody clicks anything.

The banner is doing nothing except signalling that the business has thought about this. Cookie compliance is one of the more visible obligations, it is publicly checkable by anybody including a regulator, and it is almost always handled by installing something and never looking at it again. The banner is treated as the compliance rather than as the mechanism for it. Meanwhile the page is publicly inspectable by anybody who wants to check.

1. Cookies and tracking on your website are governed by specific rules

Frequently separate legislation.

Many jurisdictions regulate storing or accessing information on a visitor's device under rules distinct from general data protection law, with their own consent requirements. Establish which apply to you.

2. Find out what your site actually sets

Almost nobody knows.

Browser developer tools, or a free scanning service, will list every cookie and tracker on your site. Owners are routinely surprised by how many there are and by scripts added years ago for a campaign that ended. Nobody removes a tracker when a campaign stops.

3. Distinguish necessary from everything else

The distinction the rules turn on.

Cookies strictly necessary for the site to function — a shopping basket, a login, security — generally do not require consent. Analytics, advertising and personalisation typically do, in most jurisdictions. The distinction is about necessity to the visitor, not usefulness to you.

4. Do not load non-essential scripts before consent

Where most implementations fail.

A banner that appears while analytics and advertising pixels have already loaded provides no protection. The scripts must be blocked until the visitor agrees, which is a configuration step rather than an installation one. Most consent tools support this and most installations never enable it.

5. Make refusing as easy as accepting

An increasingly enforced requirement.

A prominent accept button with reject hidden behind a settings menu is exactly the pattern regulators have been acting against. Both options should be equally available at the first level.

6. Do not make consent a condition of access

Except in narrow circumstances.

Blocking the site entirely unless somebody accepts tracking is generally not valid consent. There are limited exceptions in some jurisdictions and they are narrower than the practice suggests.

7. Let people change their mind

A standing requirement.

A way to review and withdraw consent, available from every page, and a record of what each visitor agreed to. Consent given once and never revisitable does not meet most standards.

8. Explain it in a cookie notice

Separate from or within the privacy notice.

What each category does, who sets it, how long it lasts and what happens if it is refused. A list generated automatically by a scanning tool is a reasonable starting point.

9. Review it when the site changes

New tools add trackers.

A new chat widget, an embedded video, a booking system or a marketing pixel each adds something. A check whenever the site is significantly altered keeps the configuration accurate.

Be honest about what the tracking costs you in return. A well-implemented consent banner reduces the data you collect, because some visitors decline, and businesses should understand that trade rather than discovering their analytics have changed and assuming something is broken.

Conclusion

Configure what you installed rather than assuming a banner resolves the obligation.

Establish which rules apply in your jurisdiction, scan the site to find out what it actually sets, distinguish strictly necessary cookies from everything else, block non-essential scripts until consent is given, make refusing as easy and prominent as accepting, avoid conditioning access on acceptance, provide a way to review and withdraw consent from any page, publish a cookie notice explaining each category, review it whenever the site changes, and understand the effect on your own data collection.