Cookie banners and analytics consent: what small businesses need to know
Cookie banners are everywhere, and most are confusing or pushy. Here's what cookies and analytics actually are, why consent matters, what a fair banner looks like, and how to keep your website privacy-friendly without losing useful insight.
Almost every website now greets you with a pop-up about cookies. Some ask nicely; many hide the “no” button, use confusing wording or block the page until you agree. It's no surprise most people click “Accept” just to make it go away.
If you have a business website, you've probably wondered whether you need a banner, what it should say, and whether it matters for a small business in India. This post explains the basics in plain language. It's a general guide, not legal advice.
What cookies are
Cookies are small pieces of information a website saves in a visitor's browser. Some are essential: they make the website work, for example remembering what's in a shopping cart. Others are non-essential: they're used for things like analytics (counting and understanding visits) and advertising (tracking people across websites).
Similar technologies, such as local storage and tracking scripts, raise the same questions, so “cookies” is often used loosely to cover them all.
What analytics tools do
Analytics tools tell you how people use your website: how many visit, which pages they look at, where they come from and what they click. That's genuinely useful for improving a website.
- Google Analytics is the most widely used. It typically uses cookies.
- Session recording and heatmap tools, such as Microsoft Clarity, show how visitors scroll and click.
- Cookieless analytics, such as Cloudflare Web Analytics, count visits without using cookies to identify individual visitors.
Why consent matters
The law, in some places
Privacy laws in many parts of the world, such as the EU and UK, generally require websites to ask permission before using non-essential cookies. India's Digital Personal Data Protection Act also sets rules for handling personal data. If you have customers or visitors from abroad, or simply want to do the right thing, consent is worth taking seriously. What exactly applies to your business depends on your situation, so check with an advisor if you're unsure.
Trust
Even where the law is less strict, visitors increasingly notice how websites treat them. A fair, simple choice shows respect. A banner that tricks people into agreeing does the opposite.
What a fair cookie banner looks like
- Plain language. Say what you'd like to do and why, in a sentence or two.
- Equal choices. “Allow” and “No thanks” buttons of the same size and prominence.
- Nothing before consent. Non-essential tools load only after someone says yes.
- Doesn't block the page. Visitors can read your site while deciding.
- Easy to change. A “Cookie settings” link, usually in the footer, lets people change their mind.
- Links to your privacy policy, which explains what you collect and why.
What to avoid
- Hiding the “no” option behind “More options” or tiny text
- Pre-ticked boxes
- Loading analytics or advertising tools before the visitor chooses
- Banners that cover the whole page on a phone
- Asking again on every single page
Do you need a banner at all?
Not necessarily. If your website uses only essential cookies and cookieless analytics, you may not need one. That's often the simplest, most privacy-friendly option for a small business: you still see how many people visit and which pages they view, without asking anything.
If you want more detailed insight from tools like Google Analytics or Clarity, use a fair banner and load those tools only after consent.
A few privacy habits worth having
- Use only the tools you actually look at. Many websites run trackers nobody checks.
- Keep data only as long as you need it. Analytics tools let you set how long data is kept.
- Turn off advertising features you don't use, such as ad personalisation.
- Protect form data. If you use session recordings, make sure what visitors type into forms is hidden.
- Keep your privacy policy honest, and update it when your tools change.
What about embedded content?
Embedded maps, videos and social media feeds can set cookies of their own, from Google, YouTube or Meta, even if your own website doesn't. If you embed them, mention them in your privacy policy. Some websites show a simple “Load map” or “Play video” button first, so these services only load when a visitor chooses. A plain link to your Google Maps listing is often enough.
How our own website does it
We follow the same approach we recommend:
- Cloudflare Web Analytics counts visits without cookies.
- Google Analytics and Microsoft Clarity load only after a visitor taps “Allow analytics”. Until then, nothing is sent to them.
- Both buttons are equally easy, and “Cookie settings” in the footer reopens the choice at any time.
- Google Analytics data is kept for 2 months, with Google signals and ad personalisation off.
- Forms are masked, so nothing typed into them is recorded.
You can read the details in our privacy policy. Every website we build follows the same privacy-friendly standard: a fair banner, no ad tracking, and analytics only with consent. See how we build.
In short
- Analytics cookies are non-essential, and in many places visitors must be asked before they're used.
- A fair banner uses plain words, equal choices, loads nothing before consent and is easy to change later.
- Cookieless analytics can avoid the banner entirely; use detailed tools only with consent.
