This translation has not been editorially reviewed yet. The German version is authoritative. Deutsche Fassung →
Data protection
When does a website need a cookie banner?
A cookie banner is only necessary if the website uses services that require consent — tracking cookies, connections to ad servers, or embedded videos that load on visit, for instance. A website with no such services doesn't need a banner. Our check first establishes whether anything requiring consent is present, and only demands a banner where one is actually needed.
The need comes first, the banner second
The check flips the usual order around. It asks first: does the page set tracking cookies before consent, contact tracking servers, or load consent-requiring embeds like YouTube videos? Only if at least one of these applies does a consent banner have to be present — if it's missing then, that's a serious finding. If none of these apply, the rule counts as met even without a banner. In that case, the report explicitly notes: no consent-requiring services detected, a banner isn't required — cleanly solved, as long as it stays that way.
A website with no banner is an achievable goal
Many websites could do without a banner entirely, and only don't because services have piled up over the years. The route there is concrete: remove tracking services or replace them with consent-free analytics, load videos and maps via a two-click solution, serve fonts and libraries from your own server. Anyone who does this greets visitors with no interruption — no forced click before the content, no banner half-covering what the page is actually about on small screens. The check rewards this state with full marks across several rules at once.
A banner that's there still has to be correct
If a website shows a banner even though it wouldn't need one, that causes no point deduction under this rule. But the check then takes the banner at its word: it checks whether the first level offers a rejection option, and tests whether the rejection actually works. A banner isn't a decoration, it's a promise to visitors — anyone who shows one has to honour it too. The details of these two follow-up checks are described in the rules on the first banner level and the functional rejection test.
- Check the audit report to see what consent-requiring services your website actually uses.
- Cut services nobody analyses — an abandoned analytics tool creates obligations with no benefit.
- Switch videos and maps to a two-click solution, so they no longer require consent on page visit.
- Have fonts and libraries served from your own server.
- Then make a deliberate decision: a banner with a genuine choice — or a website that doesn't need one.
FAQ
Does every website need a cookie banner?
No. A banner is only necessary if the website uses consent-requiring services — tracking cookies, connections to ad servers, or embeds that load on visit, for instance. A website with no such services gets by without a banner, and our check counts exactly that as a state that's met.
Is an unnecessary cookie banner a mistake?
The check deducts no points for that. But it takes an existing banner seriously and checks it fully: is there a rejection option on the first level, and does rejection actually work. For visitors, doing without an unnecessary banner is the more pleasant solution — the content appears with no interruption.
What counts as a consent-requiring service?
In the check: tracking cookies from known providers, connections to tracking and ad servers before consent, and embedded third-party content like YouTube videos, Google Maps, or social media posts that load on page visit. That's a technical classification for the assessment — the legal evaluation of individual services remains a task for your legal counsel.
How can I get a website that doesn't need a banner?
Remove tracking services or replace them with consent-free analytics, switch embeds to a two-click solution, and have fonts and libraries served from your own server. If nothing requiring consent is left afterward, the reason for the banner disappears — and the check confirms this state in the report.