Do I need a cookie banner on my website?

Short answer · updated 2026-09-30

You need one if your site sets cookies that aren’t strictly necessary. Analytics, advertising and some embedded videos and maps set that kind.

In Ireland and the EU, visitors must agree before those cookies load, and Reject must be as prominent as Accept.
A site with only strictly necessary cookies doesn’t need to ask.

Ireland and the EU

Irish law, S.I. No. 336 of 2011, requires consent before a site stores or reads information on a visitor’s device.
The exception is storage strictly necessary for a service the visitor asked for. The Data Protection Commission’s guidance adds the practical rules:

Non-essential cookies can’t be set before the visitor agrees.
Boxes and sliders can’t be switched on by default.
Reject needs equal prominence to Accept. An “OK, got it” banner with no reject option isn’t acceptable.
Carrying on browsing doesn’t count as consent.
Analytics cookies need consent. The DPC says first-party analytics are unlikely to be an enforcement priority.

In its 2019 review, the DPC found 10 of the 38 organisations it examined using pre-ticked boxes.

The rules changed on 5 February 2026, under the Data (Use and Access) Act 2025. Some cookies no longer need consent.
They include strictly necessary cookies and analytics used only to see how your site is used.

For those analytics, you must explain them clearly and give visitors a simple, free way to object. Advertising cookies still need consent.
The ICO’s guidance was last updated on 29 April 2026.

There’s no federal cookie-consent law. California lets consumers opt out of the sale or sharing of their data, including through a browser signal.
Its law applies to businesses with revenue of $26.625 million or more, or other large-scale data thresholds.
A small local business is usually outside it.

Open your site in a private browser window. In Chrome, open Developer Tools, then Application, then Cookies, and look at what appears.
List every embed on the site: analytics, a booking widget, maps, videos, social feeds and chat.
Ask whoever built the site which of these set cookies, and when.

This is general information, not legal advice. For your own situation, ask a solicitor.
Our guide to what an Irish company website must show by law covers the other notices.

In Ireland, yes: the DPC says analytics cookies need consent.

In the UK, analytics used only to see how your site is used may be exempt since February 2026. You still have to explain it and let visitors object.

No. A privacy notice explains what personal data you collect and why. A cookie notice explains the cookies your site uses.

Many sites put the cookie details inside the privacy notice.

Breaking the cookie rules is an offence under the 2011 regulations, with a fine on conviction.

The DPC has examined websites before and published what it found.

Sitecomb, our website checker, gives a free score across six areas.

It looks for a cookie notice and a privacy notice, and checks the security flags on your cookies.

If something needs changing on the site, tell us what needs fixing.