Cookie Consent and Analytics Tags: What Small Sites Need to Know

The short answer

In the EU, the default is consent first. Storing or reading information on a visitor’s device, whether through cookies or similar technologies, needs consent unless it’s strictly necessary for a service the visitor asked for (or needed to transmit a communication). Analytics and marketing tags generally aren’t strictly necessary, so in most EU countries they should wait for consent. Some national authorities allow narrowly configured audience measurement without consent.

In the UK, the default is also consent first, but there is now an explicit exception for analytics used solely to produce statistics that improve your site. It’s narrow: per-visitor logs, linking visits to purchases or email addresses, and anything used for advertising still need consent.

Either way, the tag has to be held back technically until the visitor chooses. A banner that appears while the tags are already running doesn’t meet the standard.

The rule behind cookie banners

The EU rule comes from Article 5(3) of the ePrivacy Directive, which countries have written into their own laws. The European Data Protection Board’s Guidelines 2/2023 on the technical scope of Article 5(3) sum it up: storing information, or gaining access to information already stored, in a user’s device is only allowed on the basis of consent or necessity for specific purposes set out in that Article.

Three points from those guidelines matter for anyone running website tags:

1. It isn’t only about cookies. The EDPB says Article 5(3) applies to cookies and to “similar technologies.” It names browser storage such as local storage, and dedicates a section to tracking pixels and tracking links.
2. It isn’t only about personal data. The rule covers “information,” which the EDPB says includes both non-personal and personal data. A random visitor ID that doesn’t reveal anyone’s name is still covered.
3. JavaScript that sends data back counts. According to the guidelines, when client-side code sends information back over the network to a server, that is “gaining access” under Article 5(3), even if the information was generated locally. That is exactly how most tags work.

The EDPB also notes that falling under Article 5(3) doesn’t automatically mean consent is needed; each case has to be checked against the exemptions. But for analytics and marketing tags, the exemptions are where most of the debate is, so let’s look at them.

Is analytics “strictly necessary”? The EU view

The EDPB’s Cookie Banner Taskforce report (January 2023) addressed websites that label cookies as “essential” when they serve purposes that wouldn’t be considered strictly necessary. The taskforce noted that website owners are responsible for maintaining their list of cookies and for being able to demonstrate why each one they call essential really is. Calling an analytics or advertising cookie “essential” to avoid asking doesn’t make it so.

Some national authorities have published a narrow route for audience measurement. France’s CNIL is a well-known example. Its guidance for developers says audience measurement trackers can be exempt from consent if you:

1. Inform users of their use.
2. Give users the ability to object.
3. Limit the purpose to audience measurement and A/B testing.
4. Don’t cross-check the data with other processing, such as customer files or statistics on visits to other sites.
5. Limit the tracker to a single site or app publisher.
6. Truncate the last byte of the IP address.
7. Limit the lifetime of the trackers to 13 months.

The CNIL also warns that most large audience measurement offerings do not fall within the exemption, and it says the topic depends on ePrivacy law, which may vary by country. In other words, if you sell to customers in several EU countries, plan on asking for consent for analytics unless you have checked each country’s position and configured your tool to match it.

The UK is different now: the “statistical purposes” exception

In April 2026 the ICO published its final guidance on storage and access technologies, which reflects changes made by the Data (Use and Access) Act 2025. Its chapter on exceptions lists five cases where consent isn’t needed: communication, strictly necessary, statistical purposes, appearance and emergency assistance. The statistical purposes exception is the ICO’s “analytics” exception, and it comes with conditions:

1. Sole purpose. The storage or access must be only for collecting statistical information to improve your service. If the same data is also used for advertising, the exception doesn’t apply.
2. Aggregate results. Individual-level data may be collected along the way, but the output should be aggregated, and the data kept only as long as needed.
3. An easy way to object. You must tell people about the analytics and offer a simple, free way to object, and you must actually stop when they do. Browser settings on their own don’t count.
4. Third-party tools act for you. An analytics provider can be used if it is your processor, only helps improve your service and doesn’t combine the data with other information it holds.
5. No profiling or personalization. Tracking or profiling individuals or groups, for example to target content, falls outside the exception.

The ICO’s examples make the line concrete:

The ICO’s older cookie guidance, written before these changes, said analytics cookies generally needed consent, and it may still turn up in searches. Make sure you’re reading the current storage and access technologies guidance.

Where common tags usually fall

Putting the EU and UK positions side by side gives a rough map for the tags a small store typically runs. Treat it as a starting point for your own review, not a ruling:

What a valid cookie banner looks like

Once consent is needed, it has to be valid consent: freely given, specific, informed and unambiguous. The EDPB taskforce and the ICO’s guidance on managing consent in practice agree on the practical points:

1. Nothing that needs consent runs before consent. The taskforce recalled that, by default, no cookies that require consent can be set without it, and consent must be a positive action. The ICO lists pre-enabling technologies before consent as bad practice.
2. Reject is as easy as accept. A vast majority of EU authorities in the taskforce considered a banner with a consent button but no reject option on any layer to be an infringement. The ICO’s checklist asks whether your mechanism makes it as easy to refuse as to accept.
3. No pre-ticked boxes. The taskforce confirmed that pre-ticked boxes in the settings layer don’t lead to valid consent.
4. Continuing to browse isn’t consent. The ICO says silence or inactivity doesn’t qualify, and if visitors move on without choosing, you must not use the technologies that need consent. “By continuing to use this site you agree” wording is one of its bad-practice examples.
5. No hidden or faded reject options. The taskforce found that a “refuse” link buried in a paragraph of text, or placed outside the banner without visual support, doesn’t produce valid consent, and that a reject button with text so low in contrast it’s unreadable is manifestly misleading.
6. Withdrawal is easy and always available. Both the taskforce and the ICO say people must be able to withdraw consent at any time, as easily as they gave it. A permanently visible link or small icon that reopens the settings is one way.
7. Legitimate interest isn’t a shortcut. The taskforce confirmed that legitimate interest can’t be the legal basis for placing or reading cookies under Article 5(3).

The ICO adds two practical points for repeat visitors. There’s no fixed expiry for consent, but you shouldn’t re-prompt people as a matter of course, especially after they decline; it suggests six months as a reasonable time before asking again. And you need to be able to show that consent was given, so keep records of what each visitor chose and when.

How to load tags only after consent

Most small sites do this with a consent management platform (CMP): a service that shows the banner, stores each visitor’s choices and tells your other scripts whether they may run. The ICO notes that many site owners use one, and that you can also build your own. Whichever route you take, the steps are the same:

1. List every tag and what it stores. Open your site in a private browser window, then open the developer tools (Application or Storage tab) and note every cookie and local storage entry, which script set it and what it’s for. Also check the network tab for requests to third-party domains.
2. Sort them into categories. Strictly necessary, analytics or statistics, marketing, and preferences are the usual groups. Be strict about the first one; the taskforce flagged “essential” labels that don’t hold up.
3. Choose how the tags will be blocked. Common options are a CMP that blocks scripts automatically until the matching category is accepted, script tags you mark so the CMP releases them only after consent, or a tag manager that fires each tag on a consent trigger. Use the method your CMP documents; don’t rely on hiding the banner with CSS.
4. Put the CMP before everything else. It must load first in the <head> so it can hold back the tags that come after it.
5. Write the banner text in plain language. Say what each category does, name the tools, and link to your cookie or privacy notice. Give “Accept all” and “Reject all” equal weight on the first layer.
6. Add a way to change the choice later. A “Cookie settings” link in the footer of every page is the simplest version.
7. Test it like a regulator would. In a fresh private window, load a page and don’t click anything: no consent-based cookies should exist and no analytics or ad requests should go out. Click reject and browse a few pages: still nothing. Click accept: now the tags should run. Then withdraw and confirm they stop.

One business consequence to expect: once tags wait for consent, your analytics will only count visitors who accept. Traffic numbers usually look lower than before, and trends are easier to read than absolute counts. Plan for that rather than redesigning the banner to push people toward “Accept,” which is precisely what the regulators’ examples above warn against.

What the marketingLABO tag stores

If you use marketingLABO, it helps to know exactly what its tag does so you can describe it accurately and sort it into the right category. The tag is a single script added to the <head> of each page. Our privacy policy describes what it collects: pages viewed, date and time of viewing, IP address, cookies, browser type and information entered in forms. It shows this in your dashboard and handles it on your behalf. Under our terms, you are responsible for disclosing this collection in your own privacy policy and for obtaining any consent that’s needed.

The tag sets first-party cookies on your site’s domain and uses the browser’s session storage:

In practice, marketingLABO is not a statistics-only tool. Its value is in per-visitor histories, linking visits to email contacts, and pop-ups and journeys that react to who the visitor is (first or returning, pages viewed, days since the last visit). Those are the kinds of uses both the EDPB framework and the ICO’s examples place on the consent side. For EU and UK visitors, the straightforward approach is to put the marketingLABO tag in your CMP’s marketing (or analytics and marketing) category so it loads only after consent.

Be aware of what that means for your marketing: visitors who decline won’t appear in your reports or visitor histories, and banners won’t be shown to them, because the banners are delivered by the same tag. Features that depend on recognizing a returning browser, like messages for first-time vs. returning visitors, will work only for people who accepted.

marketingLABO does not include a consent management platform

To be clear about what the product does and doesn’t do: marketingLABO has no CMP. It doesn’t show a configurable consent banner with categories, block other scripts, store consent records or read signals from a third-party CMP. You’ll need a separate tool, or your site platform’s built-in consent feature, to control when the tag loads.

The site settings do include a simple cookie notice bar, but it isn’t a substitute. Its wording is fixed and is currently in Japanese only; it describes continued use as agreement, which the ICO lists as bad practice; and the tag records the page view before the visitor chooses. If a visitor clicks the bar’s “decline” button, the tag deletes its visitor ID cookie and stops recording on later page loads. That’s a useful opt-out, but it isn’t prior consent. For EU and UK audiences, leave the bar off and use a proper CMP.

A quick checklist

1. Decide whether you have EU or UK visitors you need to plan for (check your traffic by country).
2. Inventory every cookie, storage entry and third-party request on your site.
3. Categorize each tag honestly; keep “strictly necessary” for things the visitor’s request truly depends on.
4. Install a CMP that loads first and blocks non-essential tags until consent.
5. Offer Accept and Reject with equal prominence; no pre-ticked boxes, no “by continuing you agree.”
6. Add a footer link to reopen cookie settings, and make sure withdrawal stops the tags.
7. Update your privacy or cookie notice to name each tool, what it stores and for how long.
8. Test in a private window: before choosing, after rejecting and after accepting.
9. Keep consent records, and don’t re-prompt people who declined too often.

FAQ

My business is in the US. Do EU or UK cookie rules apply to me?
They can, if your site is aimed at people in those places. These rules are about the visitor’s device, and enforcement depends on national law, so the answer turns on where your audience is. If you actively sell to EU or UK customers, plan for them.

Are first-party cookies exempt?
No. The EDPB guidelines say the rule covers information regardless of who stored it, and the ICO’s exceptions turn on what the storage or access is for, not whose domain the cookie is on. A first-party cookie used for profiling or advertising needs consent just like a third-party one.

Can I show a banner but keep analytics running until people click reject?
Not where consent is required. The taskforce and the ICO both say tags that need consent must not run until consent is given, and that inactivity isn’t consent.

Does using local storage instead of cookies avoid the rule?
No. The EDPB names local storage among the technologies covered, and the ICO’s guidance covers “storage and access technologies” generally.

Does email marketing need separate consent?
Yes, it’s a separate question with its own rules. See our guide to GDPR and email marketing consent.

Which marketingLABO plan do I need?
The tag and analytics are on every plan, including Free. See the pricing section. You’ll need a CMP from another provider on any plan if you serve EU or UK visitors.

Sources

European Data Protection Board, “Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive,” version 2.0: https://www.edpb.europa.eu/system/files/documents/2024-10/edpb_guidelines_202302_technical_scope_art_53_eprivacydirective_v2_en_0.pdf

European Data Protection Board, “Report of the work undertaken by the Cookie Banner Taskforce” (January 2023): https://www.edpb.europa.eu/system/files/2023-01/edpb_20230118_report_cookie_banner_taskforce_en.pdf

Information Commissioner’s Office (UK), “What are the exceptions?”: https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-exceptions/

Information Commissioner’s Office (UK), “How do we manage consent in practice?”: https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/how-do-we-manage-consent-in-practice/

Information Commissioner’s Office (UK), “Final storage and access technologies guidance published” (April 2026): https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/04/final-storage-and-access-technologies-guidance-published/

CNIL (France), “Sheet n°16: Use analytics on your websites and applications”: https://www.cnil.fr/en/sheet-ndeg16-use-analytics-your-websites-and-applications