Short answer: yes, if your website uses cookies or similar tracking that is not strictly necessary (for example Google Analytics, the Meta Pixel, ad tags or embedded videos) and has visitors in the EU. You must ask for consent before those cookies are set, and a cookie banner is how you ask.
If your site only uses strictly necessary cookies, such as a shopping cart, a login session or a security cookie, you don't need consent, but you still have to tell visitors what you use.
What the law says
- The ePrivacy Directive (article 5(3)) requires consent before storing or reading information on a visitor's device, unless it is strictly necessary for a service the visitor asked for. It covers cookies, local storage, tracking pixels and similar techniques. In Sweden this rule is in the Electronic Communications Act (lagen om elektronisk kommunikation, chapter 9, section 28).
- The GDPR defines what valid consent is: freely given, specific, informed and unambiguous, as easy to withdraw as to give, and something you must be able to prove.
Which cookies need consent?
| Needs consent | Usually doesn't |
|---|---|
| Analytics (Google Analytics, Hotjar) | Shopping cart |
| Advertising and retargeting (Meta Pixel, Google Ads) | Login session |
| Embedded videos and social media widgets | Security and load balancing |
| A/B testing and personalisation | Remembering the visitor's cookie choice |
What a valid cookie banner must do
- Block non-essential cookies until the visitor agrees. Loading Google Analytics first and asking later is not consent.
- Make "Reject" as easy as "Accept". European regulators expect a reject option on the first layer of the banner.
- No pre-ticked boxes. The EU Court of Justice ruled in Planet49 (2019) that pre-ticked boxes are not valid consent.
- Let visitors choose per category (for example statistics or marketing) and change their mind later.
- Keep a record of who consented to what, and when.
What happens if you don't?
Data protection authorities do enforce this. In Sweden, IMY fined the pharmacy chain Apoteket SEK 37 million in 2024 after its Meta Pixel sent customer data to Meta. Under the GDPR, fines can reach €20 million or 4% of global annual turnover.
How to check your site
Run a free cookie scan to see which cookies your site sets before a visitor has said yes. If anything other than strictly necessary cookies shows up, you need a banner that blocks them until consent.
Cookiefy is a cookie consent banner that does this automatically, with a free plan for 1 website.
This is general information, not legal advice. For your specific situation, ask a lawyer or your data protection authority.