How to Set Up a Cookie Consent Banner That Actually Works

Key takeaways

• Audit first: list every cookie and script your site sets
• Check exceptions by purpose: advertising needs consent; some UK analytics uses can qualify for an exception
• Give Accept and Reject equal weight, with no pre-ticked consent boxes
• A banner that only shows a message is not consent; scripts must wait
• Let people change their mind through a cookie settings link
• Test by rejecting everything and checking no cookies that require consent appear

Disclosure: Prodify Digital offers a bonus bundle and may earn a commission if you buy through our links. That does not change our assessment.

Cookie banners are everywhere, and many of them do not do their job. Some only say “we use cookies” and carry on tracking. Others hide the Reject option three clicks deep. A good banner is short, honest and actually controls what loads.

This guide answers one question: how do you set up a cookie consent banner so it actually works? Here is how to set one up properly, whichever tool you use. It pairs with our main article, Scale.gg TOS Docs: Website Policies Without the Blank Page. You can also watch our TOS Docs walkthrough.

Nothing in this guide is legal advice. It is a practical walkthrough based on UK guidance from the ICO, the UK data protection regulator. Requirements vary by country and purpose. Check current guidance and get qualified advice for your own site.

What makes a cookie consent banner actually work?

A working banner explains each purpose, gives equal choice, and respects that choice before cookies requiring consent are set.

Step 1: Which cookies does your site set?

Make a list of every tool that runs on your site. You cannot write an honest banner without one.

• Check your own setup: analytics, ad pixels, email sign-up forms, chat widgets, booking tools, video embeds and heatmaps
• Look in your browser: open your site in a private window, open the developer tools and find the cookies list (in Chrome it is under Application, then Cookies)
• Note the scripts: some tools store data in other ways, such as local storage, and the same rules apply
• Ask your web person or check your theme and plugin settings for anything added automatically

Step 2: Which cookies need consent?

Classify each use by its purpose and check whether a specific exception applies. Strictly necessary cookies support a service the visitor requested; convenience for your business is not enough. Explain these uses even where consent is not required.

The ICO exceptions guidance, checked on 29 October 2026, includes limited statistical and appearance uses. These require clear information and a simple, free way to object; they do not exempt every analytics or preference setting. Check the actual configuration and stop the relevant storage or access when someone objects.

Step 3: What should the banner say?

Say what you use cookies for in one or two plain sentences, and link to your cookie policy. Here is an example you can adapt:

We use essential cookies to make this site work. With your permission, we would also like to use analytics cookies to see which pages help people, and marketing cookies to measure our ads.
[Accept all]  [Reject all]  [Choose settings]
Read our cookie policy.

Avoid vague phrases such as “to improve your experience”. They do not tell anyone what they are agreeing to.

Step 4: How do you make reject as easy as accept?

Put Reject on the first layer, with the same size and style as Accept. ICO guidance is clear that consent must be a real choice, so nudging people towards Accept undermines it.

• Equal buttons: same size, same prominence, on the first screen
• No pre-ticked boxes: categories that require consent start switched off
• No cookie walls that block the whole site until someone accepts, unless you have taken advice
• A way back: a “Cookie settings” link in your footer so people can change their choice

Step 5: How do you block scripts until consent?

This is the step most banners get wrong. The banner must stop scripts that require consent from loading until the visitor says yes. If your analytics tag is still pasted into your site header, it will run whatever the banner says.

• Move tags that require consent into the banner tool or a tag manager, so they load only after consent
• Check embeds: some video and map embeds have privacy-enhanced modes or can be held back until consent
• Google tools: pass the visitor’s actual choices to your Google tags where required for your setup; Google distinguishes basic and advanced consent mode. Advanced mode can send cookieless pings when consent is denied, so consent mode is not the same as blocking every request
• Check your banner tool’s documentation for how it blocks scripts on your platform

Step 6: How do you match the banner to your site?

Use your brand colours and fonts, and keep it small. A banner that looks like part of your site feels trustworthy; one that looks bolted on feels like spam.

• Position: a bottom bar or corner box usually works better than a full-screen pop-up
• Mobile: check it on a phone; it should not hide your main button or menu
• Contrast: make sure the text and buttons are easy to read
• Wording: keep it in the same friendly tone as the rest of your site

Step 7: How do you test your cookie banner?

Test it as a new visitor, in a private browser window, every time you change it.

1. Open the site in a private window and check the banner appears
2. Click Reject, then check the cookies list in developer tools: no cookies that require consent should appear
3. Reload a few pages and check the choice is remembered
4. Open a new private window, click Accept, and check your analytics and pixels now load
5. Use the Cookie settings link to change your mind and check it takes effect
6. Repeat on a phone

Check network requests and other browser storage as well as cookies: an empty cookie list does not prove that no data was sent. If you rely on an exception with an objection control, test that control separately and confirm that the relevant storage or access stops.

Testing like this is the same habit as checking a form before launch. Our guide How to Test Leadpages Form Delivery Before Launch uses the same approach for sign-up forms.

What cookie banner mistakes should you avoid?

Avoid tracking before consent, hidden rejection controls and policies that do not match your actual tools.

• Tracking before consent, because scripts are still in the site header
• Hiding Reject behind a settings page
• Pre-ticked consent boxes for purposes that need consent
• No way to change your mind after the first choice
• Forgetting new tools: every new pixel or widget needs to go through the banner
• A cookie policy that does not match the cookies your site really sets

Frequently asked questions

The bottom line

A cookie consent banner that actually works explains your cookies in plain words, gives Reject the same weight as Accept, and holds back scripts that require consent until someone agrees. Audit your tools, write a short honest message, block the scripts, match the design, and test it as a new visitor every time you change your site.

Related posts

• Scale.gg TOS Docs: Website Policies Without the Blank Page
• Which Legal Pages Does Your Website Need? A Plain-English Checklist
• How to Test Leadpages Form Delivery Before Launch

Garry Knight

I'm Garry Knight, the person behind Prodify Digital. I write about email list building, email marketing, SEO, AI search and the tools that connect them. My aim is to make online marketing easier to understand, so creators and small business owners can make informed decisions about building an audience and keeping people engaged. Here you'll find straightforward guides and product reviews that explain what something does, where it fits and which limitations matter. The focus is on clear explanations and useful next steps—not hype, shortcuts or promises of easy earnings.

See Full Bio