Privacy & cookies

Cookies, consent, and the banner you may not need

Consent is required when your website stores something on a visitor's device, or reads something already there. If it stores nothing, a banner is theatre, and being sold one is noise.

When a banner is required, and when it is not

The rule is narrower than most websites act as though it is. Under regulation 6 of the UK's PECR, and Article 5(3) of the EU ePrivacy Directive, you need consent before your site stores information on a visitor's device or reads what is already there. That covers cookies, and equally local storage and tracking pixels doing the same job under another name. A site that stores nothing needs no banner.

The carve-out is narrow: storage strictly necessary for the service the visitor asked for. A basket that remembers what is in it qualifies. Analytics does not, and the ICO says so plainly, however harmless it feels. The UK GDPR then governs what you do with the data once you hold it.

This engine raised "No cookie consent banner / CMP detected" against this very website. A person overruled it, and the reason is published in the sample report: a banner is required when you set cookies, this site sets none, so a banner would be theatre. It is a warning, not a critical, for that reason — the check most often right in the abstract and wrong about the site in front of it.

What the check reads, and where

Consent detection runs on the rendered page: a real browser load, waited to network idle, then the finished DOM. Almost every consent platform injects its banner with JavaScript after the HTML arrives, so a check reading only the source would report every site using one as having none.

It looks for ten named platforms by the fingerprints they leave — OneTrust, Cookiebot, Osano, Termly, CookieYes, Iubenda, Quantcast, Didomi, Usercentrics, Complianz — plus the cookie-notice and cookie-banner naming hand-built ones use. If none matches, plain wording still counts: we use cookies, accept all cookies, manage cookies. Your banner does not have to be somebody's product to be seen.

The policy is then fetched and read, with a twelve-second limit and one rule about whose policy it is: where several privacy links exist, the one on your own domain wins. On a real audit the link resolved to a vendor's page — an SMS widget sat earlier in the markup — and the client's retention wording came from a document they never wrote. A third party's link is still recorded as found.

Consent has to be separable to count

A banner with a single button is not consent. Under the GDPR consent must be specific and freely given, which means categories a visitor can accept or refuse independently. The engine reads policy and banner text for that structure — necessary, functional, analytics and marketing cookies, or a cookie-category heading — and accepts a recognised platform as satisfying it, since the major ones categorise by default.

The cost is in the code as the reason the rule exists: consent has to be granular to be valid, an all-or-nothing banner is treated as no consent at all, and that retroactively invalidates the analytics collected behind it. You are then reporting from numbers you were not entitled to gather.

Retention is the other thing read from the policy itself: whether it says how long you keep personal data. GDPR Article 13(2)(a) requires the period at the point of collection, and its absence is one of the first things a data-subject request lands on. It is informational, and names the text it read: the fetched policy, or the page in hand.

Recorded, not scored

Several things are read into the report with no finding attached: whether the policy names the GDPR or the CCPA, whether "do not sell" appears, whether there is children's-privacy wording, whether a payment processor or PCI language is present. Naming a regulation is not following it, and scoring a site for containing the word GDPR would reward the wrong thing.

The same restraint applies to cookies elsewhere in the audit. Missing HttpOnly or Secure is a security warning. Cookies without the __Host- or __Secure- prefixes are shown as hardening and score nothing: nearly every small business site lacks them, and a finding that fires on everyone separates nobody. Size is a speed question: Set-Cookie over 4096 bytes is a warning.

Third-party requests are counted from the real load: how many, and to which domains. Requests failing with a DNS or blocked-by-client error are excluded: that is tracker blocking on the auditing machine, not a fault on your site. Before that rule, one client was told their site had 87 failed requests and 51 JavaScript errors when it had approximately none. A check that could not run is reported as unmeasured, with the reason. Never as a failure.

What the engine checks here

Each of these is a rule in the code, not a category heading.

A privacy policy, and whose it isLinks are matched on text and address for privacy policy, privacy-policy, /privacy. A link on your own registrable domain always beats an off-domain one, because the policy found is then fetched and read for the retention and cookie findings. No policy link at all is the one critical finding in this category.
A consent mechanism, by fingerprint or by wordingTen named platforms — OneTrust, Cookiebot, Osano, Termly, CookieYes, Iubenda, Quantcast, Didomi, Usercentrics, Complianz — plus generic cookie-notice, cookie-consent and cookie-banner naming. Failing all of those, banner wording counts: we use cookies, cookie policy, cookie preferences, accept all cookies, manage cookies. Nothing found is a warning, and a warning is a question, not a verdict.
Cookie categories, read from the policyNecessary, functional, analytics or marketing cookies, or a cookie-category heading. A recognised consent platform satisfies it automatically, since the major ones categorise by default. Absent, it is informational — with the reason recorded: consent that cannot be refused per purpose is not valid consent, and the analytics gathered behind it is not safe to rely on.
Data-retention languageThe policy text is searched for data retention, retention period, retain your data, or how long we keep or store. Informational when missing, because GDPR Article 13(2)(a) requires the retention period to be stated when data is collected. Read from the policy page itself where it could be fetched within twelve seconds.
GDPR, CCPA, COPPA and PCI signalsRecorded in the report and deliberately unscored: mentions of the GDPR, the CCPA or "do not sell", children's-privacy wording, and either PCI language or a named payment processor such as Stripe, PayPal, Braintree, Square or Adyen. Useful context for a human reading the report. Not a compliance verdict, and never presented as one.
Terms, refunds and an accessibility statementTerms of service or terms and conditions is a warning when absent. A refund or returns policy is informational, and it is separately required pre-contract information for consumer sales in the UK and the EU. A missing accessibility statement is informational: a published statement with a contact for remediation is the usual first thing to point at when a demand letter arrives.
Cookie flags, prefixes and sizeRead from the Set-Cookie header your server already sent, split carefully — cookie values contain their own commas in the expiry date, and splitting naively meant only the first cookie was ever examined. Missing HttpOnly or Secure is a security warning; missing __Host- or __Secure- prefixes is shown as hardening and scored at nothing; Set-Cookie over 4096 bytes is a performance warning.
Third-party requests, counted from the real loadThe rendered page load records total requests, transfer weight, how many went to other domains, and which domains those were. Requests blocked by the auditing machine's own DNS or extension filtering are excluded from failure counts, so tracker blocking on our end is never written up as a broken site.

Questions

We only use Google Analytics. Do we need a banner?

Analytics is not covered by the strictly-necessary exemption, so if it stores an identifier on the visitor's device it needs consent first under PECR and the ePrivacy Directive, and that consent has to be as easy to refuse as to give. What the audit tells you is what is visible: whether a consent mechanism is present at all, whether cookies are categorised, and which third-party domains the page contacts. It does not test whether your tags genuinely hold until consent is given. That one is checked by hand, with your tag manager open.

Our site sets no cookies. Will the report still tell us to add a banner?

The engine raises the warning, and then a person removes it with the reason written down. That is exactly what happened here: the finding is published in our own sample report, marked overruled, with the note that a banner is required when you set cookies and that a banner on a site setting none would be theatre. Privacy scored 81 out of 100 on that report, on three findings, and one of the three did not survive the read-through.

We are outside the EU and the UK. Does any of this apply to us?

Where you are based is not the test. Article 3(2) of the GDPR reaches businesses established outside the EU when they offer goods or services to people in the EU, or monitor their behaviour — which an analytics or advertising tag can amount to. If your visitors and customers are all elsewhere, most of this section is lower priority, and the report ranks it that way: a finding on a legal page is weighted at half the same finding on a pricing page.

Sources

Public and checkable. Nothing here rests on a number we cannot point at.

This is one of fifteen categories. You can read a real report this engine produced on this very site — including the findings it raised against us — or ask for an audit of yours.