Cookie Consent for Websites and Web Apps: What Founders Need to Know (Which Cookies Need Consent and How to Do It Properly)
Data Protection · Cookies
Which cookies need consent, what makes consent valid, how a banner should work and what it means for portals and apps.
Last updated: October 2026. Written by Athar Ahmad, Certified Bubble.io Developer and Tech Architect, Simple Automation Solutions.
Quick answer
Under ePrivacy rules in the EU and UK and some other laws, you generally need consent before using non-essential cookies and similar technologies such as analytics, marketing and many third-party embeds, while strictly necessary cookies are usually exempt. Valid consent is freely given, specific, informed, unambiguous, as easy to withdraw as to give and recorded. Do not load non-essential scripts before consent and do not pre-tick boxes. This is general information, not legal advice.
Key takeaways
- Strictly necessary cookies are usually exempt; analytics, marketing and many embeds need consent.
- Valid consent: free, specific, informed, unambiguous, withdrawable and recorded.
- Do not load non-essential scripts before consent; no pre-ticked boxes; equal accept and reject.
- A login-only portal may need only necessary cookies; adding tracking changes that.
- General information; check rules where your users are.
In this guide
This guide is general information, not legal advice. Requirements differ by country and sector, and legal documents should be reviewed by a qualified lawyer.
What is cookie consent?
Cookies are small files that a website or app stores in a person’s browser. Similar technologies, such as local storage and tracking pixels, do comparable jobs. Under ePrivacy rules in the EU and UK, and under some other laws, you generally need a person’s consent before using non-essential cookies and similar technologies, and you must tell them clearly what you use. Strictly necessary cookies are usually exempt from the consent requirement.
Which cookies need consent?
| Type | Purpose | Consent usually needed? |
|---|---|---|
| Strictly necessary | Keep you logged in, remember items in a basket, security and load balancing | Generally no, but still disclose them |
| Preferences | Remember language or display choices | Often yes, unless strictly necessary for a service the user requested |
| Analytics | Measure traffic and behaviour | Often yes, depending on the law and how the tool is configured |
| Marketing and advertising | Track users across sites and personalise ads | Yes in most places with consent rules |
| Third-party embeds | Videos, maps and social widgets that set their own cookies | Often yes |
The rules and regulators’ guidance differ by country, so check what applies where your users are.
What makes consent valid?
- Freely given. Users must be able to refuse without being locked out of the service.
- Specific and granular. Separate choices for different purposes.
- Informed. Clear information about what each category does.
- Unambiguous. A clear action, not pre-ticked boxes or assuming consent from scrolling.
- As easy to withdraw as to give.
- Recorded. Keep evidence of what each user chose and when.
How should a consent banner work?
- Do not set non-essential cookies before consent is given.
- Offer accept and reject with equal prominence.
- Offer category choices.
- Link to a cookie notice that lists the cookies, purposes, providers and durations.
- Remember the user’s choice and respect it.
- Provide a persistent way to change preferences.
- Review regularly, since scripts and providers change.
What about web apps and portals?
A logged-in client portal often needs only strictly necessary cookies for login and security, which may not need consent. Adding analytics, marketing tools or third-party embeds changes that. Browser storage used to keep someone signed in is typically necessary, but storage used for tracking is not. Review what your app and the services it loads actually set. If you can avoid non-essential tracking, consent becomes much simpler. See our security guide.
What are the common mistakes?
- Banners that load tracking scripts before consent.
- Making rejection harder than acceptance.
- Pre-ticked boxes.
- Cookie notices that are out of date.
- Forgetting third-party embeds.
- No record of consent.
- Assuming a banner fixes data protection. A banner covers cookies, not the wider privacy duties. See our privacy notice guide.
How do you plan this when building?
- List every script, plugin and embed the site or app will load.
- Decide which are essential, and challenge the rest.
- Choose analytics that fit your privacy approach.
- Implement consent so that non-essential scripts load only after consent.
- Test with a clean browser, before and after consent.
- Document it and review after changes.
Builds at Simple Automation Solutions start at $3,500, and a $345 Discovery Sprint, credited toward the build, lists third-party services and consent requirements in the PRD. For website projects, email us your requirements for a scoped quote.
Frequently asked questions
Do I need a cookie banner?
If you use non-essential cookies or similar technologies and your users are in places with consent rules, such as the EU and UK, generally yes. Strictly necessary cookies usually do not need consent.
What cookies need consent?
Typically analytics, marketing, many preference cookies and third-party embeds, depending on the law and configuration. Strictly necessary cookies are generally exempt.
Can I use pre-ticked boxes?
No. Valid consent requires a clear, affirmative action.
Does a login-only portal need cookie consent?
If it only uses strictly necessary cookies for login and security, usually not. Adding analytics or marketing tools changes that.
How do I record cookie consent?
Store the user’s choices with a timestamp and the version of the notice shown, in line with your consent tool.
Planning a site or app with analytics and embeds?
Email us what you want to track and which services you use. We will plan consent and privacy into the build.
Athar Ahmad, Certified Bubble.io Developer and Tech Architect, Simple Automation Solutions
About Simple Automation Solutions (SA Solutions)
Simple Automation Solutions is a Bubble.io development studio led by Athar Ahmad, a Certified Bubble.io Developer and Tech Architect. It builds web and mobile apps, client portals and SaaS products for founder-led businesses such as law firms, accounting firms, boutique agencies and consultants. Services include a free 30-minute Idea Audit, a $345 Discovery Sprint (a Product Requirements Document delivered within 24–48 hours, credited toward the build) and builds starting at $3,500. Website: sasolutionspk.com.