Cookie Consent for Online Shops in the EU
Analytics, ad pixels, chat widgets and review apps all tend to drop cookies on your shoppers' devices. In the EU, most of them need the visitor's consent first, and the banner that asks has to be fair. This guide explains which cookies need consent, how to set up a banner that works and how to check that your shop actually does what the banner promises. It is general information, not legal advice, and national regulators publish their own guidance, so check it for the countries you sell to.
Key takeaways
- Under the EU's ePrivacy rules, non-essential cookies such as analytics and advertising need prior, informed consent.
- Strictly necessary cookies, such as the shopping cart and security cookies, do not need consent.
- Refusing must be as easy as accepting. A clear "Reject" option on the first layer is the safe approach.
- Non-essential scripts must not load until the visitor agrees. Test this, do not assume it.
- Keep records of consent, and let visitors change their mind at any time.
Cookie banners have a bad reputation. Shoppers find them annoying, and store owners worry that a fair banner will cost them analytics data. But the rules are fairly clear once you separate cookies into two groups: the ones your shop needs to work and the ones that help you measure and market.
This article sticks to the practical side for small online shops. It covers the rules, the banner, the technical setup and the checks that catch most problems. Broader GDPR duties for online stores are covered in a separate checklist on this site.
Which cookies need consent
The consent rule comes from the ePrivacy Directive, implemented in each EU country through national law. It covers storing or reading information on a user's device, so it applies not only to cookies but also to similar technologies such as local storage, tracking pixels and device fingerprinting. When the data collected is personal data, the GDPR applies too, including its standard for valid consent.
The key question for each cookie is whether it is strictly necessary for a service the visitor has asked for.
| Type | Typical examples in a shop | Consent needed? |
|---|---|---|
| Strictly necessary | Shopping cart, login session, checkout security, load balancing, remembering the visitor's cookie choice | No |
| Preferences | Remembering a chosen language or currency beyond the session | Often yes, depending on use; check local guidance |
| Analytics | Visitor statistics, heatmaps, session recordings | Generally yes |
| Marketing | Ad pixels, retargeting, affiliate tracking, social media embeds | Yes |
Common mistake
Labeling analytics or ad pixels as "necessary" so they load without consent. Necessary means the shop cannot provide what the visitor asked for without it. Measuring your marketing is useful to you, but the visitor did not ask for it, so it needs consent. Some regulators accept narrow exemptions for limited audience measurement, but only under strict conditions set nationally.
What a fair cookie banner looks like
Consent must be freely given, specific, informed and unambiguous. Regulators have also made clear that refusing should be as easy as accepting, and they have criticized banners that offer a big "Accept all" button with no equally clear way to say no.
In practice, a fair banner for an online shop has:
- Accept and Reject buttons on the first layer, similar in size and style.
- A short, plain explanation of what the cookies are used for, such as analytics and advertising, and who sets them.
- A settings option to choose categories separately, with non-essential categories switched off by default.
- A link to the cookie policy listing each cookie or tool, its purpose and duration.
- No cookie wall that blocks the whole shop until visitors accept. Some regulators treat this as not freely given.
- A way to change your mind later, such as a "Cookie settings" link in the footer.
Pro tip
Write the banner text in the language of the shop page it appears on. If you run German, French and Dutch versions of your store, the banner and cookie policy should be translated too. Informed consent is hard to claim if the visitor could not read what they agreed to.
Setting it up in your shop
The banner is only half the job. The other half is making sure tags and scripts actually respect the visitor's choice. Most small shops use a consent management platform (CMP), either built into the store platform or added as an app.
- Audit what loads today. Open your shop in a private browser window, open the developer tools and look at the cookies and network requests on first load, before clicking anything. List every third-party tool you see.
- Categorize each tool. Sort them into necessary, preferences, analytics and marketing, using the table above as a guide.
- Choose a CMP. Pick one that works with your store platform, supports the languages you sell in and can block scripts until consent.
- Connect your tags. Configure analytics and ad tags, directly or through a tag manager, so they fire only after consent for their category. Many tools offer a consent mode that adjusts their behavior based on the visitor's choice.
- Design the banner. Equal Accept and Reject buttons, clear text, settings link, footer link to reopen it.
- Test every path. Reject all, accept all and choose only some categories, each in a fresh private window. Check that no marketing or analytics cookies appear after rejecting.
- Publish your cookie policy. List the tools, purposes and storage durations, and link it from the banner and footer.
Example
Imagine a small shop selling tea online. Its owner installs a banner app, ticks "block scripts until consent" and assumes the job is done. A test in a private window shows that the social media pixel, added directly to the theme code months ago, still loads before any click. She moves the pixel into the tag manager, links it to the marketing category and retests: after "Reject all", no marketing cookies appear.
Keeping records and staying current
If a regulator or customer asks, you should be able to show that consent was given. Most CMPs store a consent log: an anonymous ID, the date and time, the banner version and the categories chosen. Check that yours does, and keep the log for a reasonable period.
Your setup also drifts over time. New apps add new scripts, and old banners can stop matching the tools you use. Build a short review into your routine:
- Retest the banner whenever you install a new app, change themes or add a marketing tool.
- Rescan your shop for cookies every few months and update the cookie policy.
- Ask visitors for consent again when you add new purposes or after a set period, as your CMP or local guidance suggests.
The data cost of a fair banner
Some visitors will click Reject, and your analytics will show fewer sessions than before. That is expected. Treat your numbers as a sample rather than a full count, focus on trends, and use the data your store platform records anyway for orders and revenue. Server-side and consent-based measurement options can help, but they still have to respect the rules, so check them carefully before relying on them.
UK and US sellers
The UK has its own rules, the Privacy and Electronic Communications Regulations (PECR) together with UK GDPR, which follow a similar consent approach. The UK has been changing some details, including exemptions for certain low-risk cookies, so check GOV.UK and the ICO's guidance for current rules.
For UK sellers who also sell into the EU, the simplest approach is often to run one banner that meets the stricter of the two sets of rules for all visitors, so you maintain a single setup rather than two.
US sellers with EU customers should not assume a US-style "notice and opt out" banner is enough for EU visitors. A common approach is to show an EU-compliant banner to EU visitors, or to everyone, which is simpler to maintain.
Your cookie consent checklist
- Scan your shop in a private window and list every cookie and third-party script
- Sort each tool into necessary, preferences, analytics or marketing
- Use a consent tool that blocks non-essential scripts until consent
- Show Accept and Reject with equal prominence on the first layer
- Keep non-essential categories off by default in the settings
- Translate the banner and cookie policy for each shop language
- Add a footer link so visitors can change their choice
- Test reject, accept and partial choices after every change
- Confirm that your consent log is switched on
Frequently asked questions
Does my shopping cart cookie need consent?
Generally no. A cookie that keeps items in the cart is strictly necessary for the service the shopper asked for. List it in your cookie policy, but you do not need to ask before setting it.
Can I preload analytics and delete the data if someone rejects?
No. The rule is prior consent. Non-essential cookies and similar tracking should not be set or read until the visitor agrees.
Is "by continuing to browse you accept cookies" enough?
Generally not. Scrolling or continuing to browse is not considered a clear, active choice under EU consent standards. Use explicit buttons.
Do I need a banner if I only use strictly necessary cookies?
You do not need to ask for consent for those cookies, though you should still explain them in your privacy or cookie information. Check carefully that no app or embed is adding other cookies in the background.
Related reading
The bottom line
Cookie consent for an online shop comes down to a few habits: separate necessary cookies from the rest, ask before loading anything else, make saying no as easy as saying yes and test that your shop respects the answer. A good consent tool does most of the heavy lifting, but only if you connect it properly.
This is general information, and each EU country applies the ePrivacy rules through national law with its own guidance. Check your national data protection authority, the European Commission's pages, or the ICO and GOV.UK for UK sellers, and ask a specialist if you use complex tracking or advertising setups.
