Cookie banner: mandatory or not?

A banner is not an end in itself. What matters is whether a site accesses the device or embeds services that are not strictly necessary.

Whether a banner is needed hinges on a single check: does the page access the device without technical necessity? A pure information page with locally served fonts, no analytics, no embedded videos and no marketing pixels needs no consent banner — not even a "we only use technically necessary cookies" notice if no cookies are set at all. Conversely, a single consent-requiring service (Google Fonts from Google, a YouTube embed, Google Analytics) is enough to trigger the banner obligation.

Active, informed consent and blocking access that requires consent are essential. The vast majority of authorities in the EDPB report object to missing rejection options on a layer with an acceptance button. Misleading design may undermine consent; the specific case and national requirements need assessment.

The most common technical mistake is the "cosmetic" banner: it is displayed, but the tracking scripts already run in the background. Only a solution that actually blocks the scripts until a category is released is effective — either via a script blocker or via the consent APIs of the respective tools. After setup, check in a private window: after clicking "Reject", does really nothing load from google-analytics.com, connect.facebook.net or similar hosts?

Is this a risk?

Under § 25 (1) TDDDG, any access to the device that is not strictly necessary requires prior consent. Only strictly necessary operations (§ 25 (2)) are exempt. A banner that loads trackers despite “Reject” or hides “Reject” does not meet the requirements.

What you can do

• Check which services are really technically necessary — only these without consent.
• If nothing consent-requiring is embedded: no banner needed.
• Otherwise use a consent tool that makes rejecting as easy as accepting and loads services only after agreement.
• After setup, test whether nothing consent-requiring actually loads after “Reject”.

Häufige Fragen

Do I need a cookie banner if I set no cookies at all?

Only if the device is accessed anyway — for example by reading identifiers, LocalStorage for non-necessary purposes or loading external resources that transmit the IP. If really nothing non-necessary is loaded, no banner is needed.

Is a banner with only an "Accept" button enough?

Active, informed consent and blocking access that requires consent are essential. The vast majority of authorities in the EDPB report object to missing rejection options on a layer with an acceptance button. Misleading design may undermine consent; the specific case and national requirements need assessment.

Are technically necessary cookies really exempt?

Yes, under § 25 (2) TDDDG — but only if the access is strictly necessary for a service expressly requested by the user. Shopping cart, login session and language setting fall under it; analytics, marketing and A/B tests do not.

How do I test whether my banner is effective?

Open the page in a private window, developer tools, "Network" tab, then click "Reject" and reload the page. If requests to analytics or marketing hosts appear afterwards, the banner does not block effectively.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.