Does your website need a cookie banner?

The banner has nothing to do with cookies as such. It is about what your site does on the visitor's device, and who it talks to. Most small business sites talk to nobody but the visitor, and for them a banner is pure friction. Some load a dozen trackers before the page has finished painting, and for them a banner that does not block anything is worse than none.

The rule in Germany is § 25 of the TDDDG, which implements the EU's ePrivacy rules. You need consent before you store information on a visitor's device or read information from it. Consent has to be active. The Federal Court of Justice settled that in May 2020 in the Planet49 case (I ZR 7/16): a pre-ticked box does not count, and neither does "by using this site you agree".

When you do not need one

The law exempts anything strictly necessary to deliver the service the visitor asked for. A cookie that keeps a shopping cart together, remembers that someone is logged in or stores the language they picked is fine without a banner. So is a site that shows pages and a contact form and nothing else.

That is where a lot of well-built small sites sit. Fonts served with the site, no embedded maps or videos pulling from Google or YouTube, no advertising pixels. The site talks to nobody but the visitor, so there is nothing to ask consent for. Baden-Württemberg's former data protection commissioner put it plainly: privacy-friendly websites get by entirely without banners. The BeCURE site is an example: fonts, pictures and even the film are served from its own address, no third-party script loads, and the site runs without a banner.

When you do

The moment you add Google Analytics, a Meta pixel, an embedded YouTube video or a Google Map, you need consent before any of it loads. Germany's data protection authorities said in 2020 that Google Analytics, as a rule, needs consent, and in March 2025 the Hanover Administrative Court held that Google Tag Manager on its own requires it. The same goes for a chat widget, a third-party booking widget and an embedded Instagram feed. Each one stores something on the device or sends the visitor's IP address to another company, which is the same mechanism behind the Google Fonts ruling.

And the banner has to actually block those things until the visitor says yes. A banner that says "we use cookies, OK?" while the analytics are already running is worse than no banner, because it documents that you knew.

The grey zone: counting visitors without cookies

What if you only want to know how many people come? Tools like Matomo in cookieless mode, or server-side counters that read the request logs, are often sold as consent-free. The honest answer is that German authorities disagree with each other. The federal commissioner says Matomo generally needs consent. Bavaria's authority has said that counting visits with Matomo can work without it, under narrow conditions. Baden-Württemberg's suggests server-side analytics may be fine, and the city of Hamburg's own portal runs a cookieless tracker without a banner. If you want numbers without a banner, choose a tool that stores nothing on the device and keeps its data in the EU, and accept that the position is not settled.

What to do with a typical small site

Remove what you do not use. Many small sites carry an analytics tag nobody has looked at in a year, a map embed that could be a static image with a link to Google Maps, and a YouTube video that could be a thumbnail opening YouTube in a new tab. Take those out and the banner goes with them. The site gets faster, the privacy policy gets shorter, and the first thing a visitor sees is your business instead of a legal pop-up. Sites built with AI tools deserve a special look here, because the tools can embed things you did not ask for.

If you really need analytics or ads, use a proper consent tool that loads nothing until the visitor agrees, write the privacy policy to match, and keep a record. If your setup is more complicated than that, ask a lawyer. We build websites. This is not legal advice.

This is the first post in a small series on the law and money side of websites. The next one is about accessibility and the European Accessibility Act.