Yes, in most cases a cookie banner is required. Not because some rule wants banners for their own sake, but because the law asks for the visitor’s consent before the site loads anything that tracks them. If you only have the strictly essential cookies, you may not need a consent button at all. The moment Google Analytics, the Facebook Pixel or anything that measures behaviour comes into play, things change. Then you need three things: consent first, a privacy policy, and a way for someone to say no.
What the law requires
I’m not going to give you a legal analysis. I’ll tell you what it means in practice, the way we apply it on every site we deliver.
First: consent before, not after. Cookies that aren’t essential to the site’s operation aren’t allowed to load before the visitor clicks “Accept”. This is called prior consent, and it’s where most sites fall down.
Second: information. You need a privacy policy and a cookie policy: a page that explains what data you collect, who sees it, how long it stays. In plain language, not copied from some foreign template.
Third: refusing has to be just as easy as accepting. If there’s an “Accept all” button, there has to be a “Reject all” too, at the same level and with the same weight. Without hiding the second one on a second screen.
These three are exactly what the Hellenic Data Protection Authority checks. It’s not theory.
Which cookies need consent
Not all cookies are the same. They split broadly into two categories, and the difference defines what you have to do.
The essential (necessary) ones keep the site working: the cart in an e-shop, staying logged into your account, the language you picked. These load without asking anyone. They’re a precondition for the page to function, so the law doesn’t require consent for them.
The rest need a “yes” first. Analytics (Google Analytics, which measures how many people come in and from where), advertising (the Facebook Pixel and Google Ads, which build audiences for ads), embeds from third parties like maps or videos that set their own cookies. All of these must stay off until the visitor gives consent.
This is where the common mistake happens. Plenty of sites show a nice banner, but Analytics has already fired in the first second. In that case the banner is decoration. What matters is what the code underneath does, not what the button says.
The banner that passes an audit
What does a proper banner look like? First screen, two equal buttons: “Accept all” and “Reject all”. Same colour, same size, no visual trick nudging the eye toward one of them.
No pre-ticked boxes. If you offer choices by category (analytics, marketing), they all have to start switched off. The visitor turns them on, not you on their behalf.
No cookie wall. You can’t lock all your content behind “Accept”. If the only way someone can read the page is to accept cookies, that doesn’t count as freely given consent.
And a place to change their mind later. Somewhere fixed, usually bottom left, so they can reconfigure or withdraw their consent whenever they want. Withdrawal has to be just as simple as the original “yes”.
The banner text kept short. What you collect, why, and a link to the full policy. No legalese that nobody reads.
The mistakes we see over and over
Every time we take on a site someone else built, the same things keep coming back.
The most common: an “Accept” button only. No refusal, or a “refusal” hidden so deep nobody finds it. That won’t pass an audit.
Then the pre-ticked boxes. Someone set up the banner with everything already checked, thinking that “covers” them. The opposite is true.
Scrolling as consent. A banner that says “by continuing to browse you accept cookies”. It doesn’t count. Consent requires an active act, not just someone scrolling down the page.
A copied privacy policy. We open the page and it mentions another company inside, or services the site doesn’t even use. An audit catches it instantly.
And the ghost banner: it’s there, it looks right, but underneath it blocks nothing. A nice window, zero function. It’s the worst one, because it gives you the illusion you’re fine when you’re not.
What we do technically
No legal advice. That comes from a lawyer. Our part is to make the mechanism underneath work properly.
We install a CMP (Consent Management Platform, i.e. the tool that manages consent). We configure it to block the scripts until the button is pressed. That’s the essential point: third-party cookies must not load before the “yes”.
On WordPress we set it up with a plugin that scans the site and finds on its own what cookies exist. On custom projects we write it into the code, with the same rule.
We also set up the consent tool to work with Google Consent Mode v2. That way Analytics respects the visitor’s choice instead of ignoring it. We build the privacy policy page with your own details and your own services. And we configure the CMP to keep a consent record, because in an audit you have to prove you actually asked.
Free solutions cover most small sites. There is also a paid CMP with more features, but you rarely need it at the start.
How much it adds to cost and time
Good news: if you’re building a site from scratch, cookie compliance isn’t a separate project. It’s built into the construction.
At DOT a site starts from €500 + VAT and an e-shop from €900 + VAT. The banner, the privacy policy and the script blocking are part of the job, not an extra charge that shows up later.
The time? Typically we deliver in 2–10 days, with a written date in the quote. Setting up the cookies is one of the last steps, just before the site goes online.
You pay a 40% deposit on assignment and the remaining 60% on delivery. If we’re late through our own fault, we don’t charge the final milestone.
If you already have a site built elsewhere, we look at it and tell you what’s missing. Often it’s fixed quickly, without rebuilding it from scratch.
What to do now
You don’t need to solve everything today. But one thing is worth doing right now: open your site in a private window and see whether a banner loads before you click anything. If there’s no banner and you know you’re running Analytics or the Pixel, that’s the gap.
You can also check it yourself with the browser’s tool (press F12, the Application or Storage tab, and see which cookies have been set without you giving consent). If you spot names like _ga or _fbp before you click “Accept”, something’s wrong.
If you’d rather have someone who does this daily take a look, send us your site’s address. We’ll tell you what we found and what’s needed, with no charge for the review. And if you end up building a new site, it’ll go in right from day one.
Cookies aren’t the most exciting part of a site. But they’re one of the first things an audit looks at.