The Consent Reset: Sorting Your Cookie Banner Without Losing Your Analytics

Ask ten people what your cookie banner does and you'll get ten shrugs, including from the person who installed it. That's not a criticism of anyone's diligence. The banner was set up once, at launch, by someone who has since gone quiet, and nobody has looked at it since. Meanwhile two tools have been added, a Meta pixel has appeared from somewhere, and the analytics is probably missing half your traffic.

A consent spring-clean isn't glamorous work. But it's cheap, it takes an afternoon, and it fixes two things at once: a genuine compliance question and a reporting problem you've been quietly working around.

What the rules actually expect, in plain English

UK GDPR and the Privacy and Electronic Communications Regulations set the bar. The ICO's guidance boils the practical side down to a few unglamorous points.

Consent has to be a clear, positive action. Ticking a box that's already ticked isn't consent, and neither is "by continuing to browse this site". Refusing has to be as easy as accepting — which rules out the design where Accept is a big green button and Reject is a grey word hiding in a submenu. Consent should be granular enough that someone can take analytics but decline advertising. And you should be able to show what someone agreed to, and when.

On analytics specifically: there has been plenty of talk about relaxing the consent requirement for some measurement cookies. Don't build your setup on a change that hasn't landed. Treat analytics as something you ask about, and keep the strictly-necessary label for things like basket sessions and security tokens.

Five mistakes we see on small sites every week

The pre-ticked banner. Still out there. Every switch set to on, one button labelled Got it.

The two-click refusal. Reject exists, but only after hitting Manage Preferences, then scrolling, then saving. Not equal, not compliant, and it's the detail most likely to annoy a visitor.

The wall. The banner can't be dismissed without accepting. This is the one that turns a mild annoyance into a complaint.

The disconnect. The banner collects a choice beautifully and the tags fire anyway. Often because a tag was added via Google Tag Manager after launch and never wired to consent.

The goldfish banner. It forgets. Every page load, there it is again, asking the same question, which trains visitors to click Accept just to make it stop.

The clean-up, step by step

1. Inventory every tag. Open your site in a private window, hit F12, and look at the network or application tab. Then look at your tag manager, if you have one. Write down every third-party script: analytics, pixels, heatmaps, chat widgets, embedded videos, fonts that phone home. Most small sites find at least one they'd forgotten.

2. Sort them into three piles. Strictly necessary (checkout, login, security, load balancing). Measurement and statistics (analytics, heatmaps). Marketing and advertising (retargeting pixels, social ad trackers). Be honest — a chat widget that stores a visitor ID is not strictly necessary.

3. Rebuild the banner so the choice is real. Equal visual weight for Accept and Reject on the first layer. No switches on by default. Plain language: "We'd like to use analytics cookies to see which pages people find useful" beats a paragraph of statutory wording. Link to the cookie policy from the banner itself.

4. Wire the banner to the tags. Nothing in piles two and three fires before a choice is made. This is usually the step that requires a developer or a properly configured consent tool rather than good intentions.

5. Test the reject path properly. In a private window: reject everything, then check nothing non-essential loads on the next three pages. Then accept everything and check the tags do appear. Then reopen preferences, withdraw consent, and check the tags stop. Most sites fail on attempt three.

6. Keep a record. A timestamped log of consent — the categories chosen and the version of the banner shown — is what turns "we think we're fine" into something you can demonstrate.

7. Give people a way back. A persistent Cookie Settings link in the footer. Someone changing their mind shouldn't have to clear their browser cache to do it.

8. Rewrite the cookie policy to match reality. Delete the copy-pasted list of services you've never used. Name the tools you actually run, what each one does, and how long it keeps data. If it's more than two screens long, it's probably padding.

Keeping the numbers you actually use

Here's the fear that stops people fixing this: if I make rejecting easy, my analytics will fall off a cliff.

It will drop. Fewer people will be measured. That's the point of asking. But three things make it manageable.

First, if you use GA4, configure consent mode properly so you get modelled estimates for the visitors who decline rather than a hole in the data. Second, judge trends rather than absolutes — whether enquiries are up month on month matters more than whether the number is 1,240 or 1,900. Third, remember your analytics was already wrong: internal traffic, ad blockers and bots mean the pre-clean-up figure was never the gospel you treated it as.

Some teams find a cookie-free analytics tool simpler, since there's less to consent to. That's a reasonable route for a small brochure site, but check the configuration matches what the tool claims before you rely on it.

Diarise it

You don't need to re-paper the whole thing annually for every visitor. You do need a review whenever you add a tool, change the banner, or change your cookie policy — and a standing fifteen-minute look once a year is sensible housekeeping.

Run the audit this month. It's a boring afternoon that clears a real risk and gives you reporting you can trust, which is more than can be said for the banner that's been sitting there since launch.