Hebble
&Stone

5 min read

Abstract illustration of an online cookie banner

You probably don't need that cookie banner

Every time someone lands on your website, you're making them a promise. Not in so many words, but it's there: we're glad you're here, and we'll treat you fairly while you look around.

A cookie banner is often the very first thing they see. Too often, it's also the first broken promise: a pop-up asking permission for something that has already happened, or one that makes "yes" a single click and "no" a maze.

Here's the good news. For most charities and small organisations, the honest answer is simpler than any banner: don't set the cookies in the first place. Then there's nothing to ask permission for.

This year, the UK's Data (Use and Access) Act 2025 relaxed some of the rules on analytics cookies. You may see that described as the end of cookie banners. It isn't, and it changes less than you'd think, because the real question was never "what's legal?" It's "what are we doing to our visitors, and why?"

What a cookie banner is actually for

A cookie is a small file a website leaves in your browser. Some are simply part of how a site works: the one that keeps you logged in, or remembers what's in your basket. The law calls these "strictly necessary", and you don't need anyone's permission to use them. WordPress, for example, sets a couple when someone logs in. List them in your privacy or cookie policy and you're done, no banner required.

The banner exists for everything else: cookies (and similar tricks, like tracking pixels and browser storage) used to measure, profile or advertise. The law doesn't much care whether something is technically a cookie. It cares whether information is being stored on, or read from, your visitor's device.

So a banner isn't a legal decoration every website has to wear. It's a sign that your site is tracking people. Which raises an obvious question.

What is your site doing, and who's looking?

Try this. Without opening anything, think about your website. What does it store on your visitors' devices? And more to the point: who in your organisation actually looks at the results?

For a lot of small teams, the honest answers are "not sure" and "nobody". Google Analytics went on years ago because someone said you needed it, for SEO or something. It's still there, faithfully collecting data that nobody reads. GA4 costs nothing to install, but getting anything useful out of it takes real time and skill. Most small orgs and companies don't have that capacity, and most don't need it.

Then there are the trackers nobody chose at all:

  • YouTube videos. A standard embed sets cookies as soon as the page loads. YouTube's "privacy-enhanced mode" (the youtube-nocookie.com address) sounds like the fix, but it still writes data to the visitor's browser storage before they press play.
  • Google Maps. The classic "find us" embed on your contact page? That brings Google's cookies along with it.
  • WooCommerce. Since version 8.5, its order attribution feature is switched on by default. It sets a handful of cookies (their names start with sbjs_) to record where shoppers came from. You can turn it off under WooCommerce > Settings > Advanced > Features.

None of these is sinister on its own. But each one means your visitors are being watched by somebody, usually without you realising, and usually for no benefit to you at all.

When the banner itself is the problem

If your site genuinely needs tracking (say you have a marketing team running ad campaigns and actually using the data), then yes, you need a banner. But it has to work, and a surprising number don't.

Researchers keep finding the same failings:

  • Tracking that starts before you've clicked anything. A 2026 audit of 200 well-known UK websites by ALT Agency found 120 of them setting analytics or marketing cookies before the visitor had touched the banner.
  • "Accept all" in one click, "reject" behind a maze. The UK regulator, the ICO, is clear that rejecting non-essential cookies must be as easy as accepting them. Plenty of banners still hide the "no" behind layers of settings.
  • Cookies that survive "Reject all". Many consent tools stop new cookies once you say no, but leave behind the ones already set while the banner sat on screen.

A banner like that is arguably worse than none at all. It tells visitors they're in control when they aren't. That's not just a technical glitch: it's a small dishonesty, and people notice. For organisations that run on trust, it's a real cost. (It's also a legal risk: since February, the ICO no longer has to show serious harm before it can fine.)

Check your own site in ten minutes

You don't have to take our word for any of this. Here's how to see for yourself.

Step 1: run it through Blacklight. Blacklight is a free tool from The Markup, a non-profit newsroom. Type in your web address and, about a minute later, it tells you which third-party trackers load on your site and who receives the data. If your visitors are in the UK or Europe, choose the option to scan from Europe. A clean site scores zero across the board.

Step 2: look in your own browser. Blacklight focuses on third parties, so it won't show everything your own site stores. For that, use the developer tools built into every browser. They look intimidating, but you only need one panel.

  1. Open a private or incognito window, so you start with a clean slate.
  2. Visit your site and don't click anything, including the cookie banner.
  3. Right-click anywhere on the page and choose Inspect.
  4. In Chrome or Edge, open the Application tab. In Firefox, open the Storage tab.
  5. Look under Cookies, Local storage and IndexedDB.

What you're looking for:

  • Names starting _ga or _gid: Google Analytics.
  • _fbp: the Meta (Facebook) pixel.
  • Anything from domains that aren't yours, such as youtube.com, google.com or doubleclick.net.
  • A login or basket cookie from your own domain is fine. That's the strictly necessary kind.

If you do have a banner, try one more test: click "Reject all", reload the page, and look again. Is anything still there?

The better way

Wanting to know how your website is doing is completely reasonable. How many people visit? Which pages do they read? Where do they come from? You can answer all of that without tracking anyone.

  • Cookieless analytics. Tools like Simple Analytics and Plausible count visits and popular pages without cookies or personal data. Simple Analytics has a free plan for "hobby" sites (one user, five websites, a month of history, and you display their badge) and gives non-profits 50% off its paid plans. Plausible's hosted service is paid, but its Community Edition is free to run on your own server.
  • Maps. Swap the embedded map for a simple image, such as an OpenStreetMap view with its credit line, and link it to directions in Google Maps or the visitor's app of choice. They get the same help, and any tracking only happens if they choose to go to Google.
  • Videos. Show a still image with a play button, and load the video only when someone clicks it. Plenty of WordPress themes and plugins can do this for you.

There's a bonus, too. Third-party scripts and consent tools are heavy, and removing them makes your pages noticeably faster, especially on phones and slow connections.

Honesty as a feature

The best cookie banner is the one you don't need. No tracking means nothing to ask permission for, and that's a quiet promise to everyone who visits: we're glad you came, and we're not following you home.

That's how we run hebblestone.org: no tracking cookies, no pixels, no banner. Run us through Blacklight if you like. We'd rather you checked than took our word for it.

Sources

Back to all posts