legal tips: cookies banner
8-part series: Is Your Website Legally Sound?
Ensure your website is compliant after important legal changes.
For the next few months we are doing a major focus on website legals, because things change often and let’s face it, the potential costs of being non-compliant can be huge, (especially if you live in a litigious country or are in the wellness industry).
Rules get updated often, new tools get added to your website, and what was compliant six months ago can stop being compliant without notice.
For example, California's CIPA law, which has fuelled a new wave of lawsuits over website tools like chat widgets and session recording software. If your website gets California visitors, (and almost every website does!) this is worth knowing about and we will cover it in a later email.
Instead of one overwhelming “everything you need to know” post, we're breaking website legal compliance down piece by piece, so you can actually work through each one, discover if you need to take action and see clear actions to take either DIY or with our help.
Today, and over the next few months we will help you review your website legals piece by piece and update for compliance.
Cookies: the compliance action every visitor sees
One important note as we go through this series: compliance isn't one size fits all. What your website legally needs depends on where your clients are located, what kind of work you do, and what tools you use.
For this reason we have created little checklists/mini quizzes where it makes sense so that you can quickly see if you need to take action.
Disclaimer:
Website legals has become a big topic, and we have done a huge amount of research to bring you these guides, taking into account the locations, audiences and industries of our clients. Please note however we are not legal professionals. To ensure full compliance with the rules that apply to you, please feel free to take any of our guides and share it with your solicitor/attorney/lawyer to confirm it meets the legal requirements in your industry and for your audience specifically.
-
cookie banners
Cookie banners are probably the single most visible piece of website compliance. A cookies banner allows website visitors to decide if they will allow you to track certain types of behaviour on your website.
-
what counts as tracking
Cookies track things like ads, analytics tools (like Google or Bing), embedded videos, chat widgets, and booking platforms. These may all drop cookies or collect data the moment someone lands on your page, often before they've clicked anything.
-
do you need a cookies banner?
- Do you have clients, customers, or regular visitors from the UK or the EU — even without marketing there? YES/NO
- Do you have clients, customers, or regular visitors from Canada? YES/NO
YES to either? You need a cookies banner that blocks tracking until visitors actively choose.
DON'T KNOW? We can review this for you.
How to set up a Compliant Cookie Banner — Step by Step
-
what cookies consent requires
- A visible option programmed into your website that manages consent.
- Visitors need a real choice. “Accept” and “reject” should be equally easy to select.
- Non-essential cookies (analytics, marketing, embedded content) generally shouldn't load until consent is given.
- The banner should link through to your privacy policy. These two pieces need to say the same thing (we will update that together in a future email in this series).
-
how to DIY a cookie banner
- Choose and install a consent management plugin on your WordPress site (Complianz, CookieYes, and Termly are common choices).
- Run the plugin's automatic scan to detect every cookie and tracking script currently running on your site.
- Confirm how each tracker is actually implemented. At Website Alchemy our standard client setup is GA4 via Site Kit and Bing via CrawlWP, both of which are easiest to manage. Anything pasted directly into the theme code needs closer attention, however, if we built your website this would not be a problem.
- If using Site Kit for GA4 (our default): switch "block Google tags before consent" to Yes for any website serving UK, EU, or Canada-wide audiences.
- If using CrawlWP for Bing (our default), no action needed.
- Categorise each remaining cookie/script, strictly necessary, functional, analytics, or marketing.
- Set up geo-targeted consent rules, opt-in/block-until-accept for UK/EU/Canada-wide visitors, a visible opt-out option (but no blocking) for US visitors, no banner at all for Australia/NZ/everywhere else, and default to the strict opt-in behaviour for any visitor whose location can't be determined.
- Style the banner to match your branding, colours, fonts, position.
- Link the banner to your privacy policy, and confirm the cookies information listed in both match.
- Test it: open an incognito window, check your browser's dev tools network tab, and confirm nothing (GA4, Bing UET if present, Facebook Pixel, chat widgets) loads before you click accept.
- Re-test after any theme, plug-in, or tracking code changes, a banner that works today can silently break after an update.
- Choose and install a consent management plugin on your WordPress site (Complianz, CookieYes, and Termly are common choices).
watch out for our next resources:
More Website Legals Guides – Coming Soon!
- CIPA & CCPA: updates plus what the recent lawsuit trend means for your website
- GDPR: yes, this can apply to you even if you're not in the EU
- Terms and Conditions: the protection most service businesses skip
- Privacy Policy Updates: what it needs to say today
- Third party booking tools: Jane App, Simple Practice and similar platforms, especially for health and wellness businesses
- ADA compliance: accessibility compliance, and how to test your website
- Google Analytics settings: the recent technical updates needed
If you want to to be first to get these guides subscribe below.