Do I Actually Need a Cookie Consent Banner on My App?

Whether you need a cookie consent banner depends on what your app actually stores on a visitor's device, not on the fact that every other site has one. The short answer: if you load analytics, ads, or any third-party tracking before a visitor agrees, you need a banner. If you only set a login session cookie that keeps the app working, you almost certainly do not.

Why this is confusing

A cookie banner is not required "because GDPR." It is required when you place non-essential cookies or trackers on someone's device before they consent. The law (GDPR plus the older ePrivacy rules in the EU/UK) splits cookies into two buckets:

• Strictly necessary cookies that make the app function: your auth session, a shopping cart, a CSRF token. These need no consent.
• Everything else: analytics, heatmaps, ad pixels, embedded videos that phone home, A/B testing. These need consent before they load.

Here is the vibe-coded part. You asked your agent to "add analytics" or "make login work," and it did exactly that. It wired up Google Analytics, or Vercel Analytics, or a Meta pixel, and it never mentioned that some of those drop tracking cookies the instant the page loads, which is the exact thing consent is supposed to gate. The agent built what you asked for. It did not build the consent gate you did not ask for.

How to check what you're actually setting

You do not need a lawyer for this first pass, you need your browser.

1. Open your app in an incognito window and open DevTools.
2. Go to the Application tab (Chrome) or Storage tab (Firefox), then Cookies, and look at what exists before you log in or click anything.
3. Also open the Network tab, reload, and watch for requests to domains you do not own: google-analytics.com, googletagmanager.com, facebook.net, hotjar.com, doubleclick.net, and similar.

Now sort what you find:

• Only your own session/auth cookie and maybe a theme preference? You likely need no banner, just a mention in your privacy policy.
• A _ga cookie, a _fbp cookie, or requests firing to a tracking domain on first load? Those are non-essential and they are loading without consent. You need a banner, and you need it to actually block them until the visitor agrees.

The fix

1. List every third-party script your app loads. Analytics, pixels, session replay, chat widgets, embedded maps or videos.
2. Decide per script: strictly necessary, or not. If you are unsure, treat it as not necessary.
3. Stop the non-essential ones from loading on page load. This is the step people skip. The banner is not the point; the point is that the tracker must not run until the visitor clicks "Accept." Load those scripts after consent, not before.
4. Add a consent banner with a genuine choice: an "Accept" and a "Reject" that carries equal weight. A tool like Cookiebot, Osano, or the free Google consent-mode setup handles the plumbing. For a small beta, a simple self-built banner that gates your analytics snippet is enough.
5. Remember the choice so you do not re-ask on every page, and give a way to change it later (a link in the footer).
6. Write down what each cookie does in your privacy policy. The banner and the policy are a pair.

The trap to avoid

Do not paste in a banner that says "By using this site you accept cookies" and then load your trackers anyway. An "accept-only" banner, or one that tracks you before you click, is worse than no banner: it looks like compliance while breaking the actual rule, which is that non-essential cookies wait for a real yes. A cookie wall that only offers "Accept" is not valid consent in the EU or UK. If your banner cannot say no, it is decoration.

Where this fits

Cookie consent is one of those launch-blockers that is invisible in a demo and obvious the moment a real EU or UK user lands on your app. It rarely comes alone: it travels with the privacy policy you need anyway and the broader question of whether GDPR applies to you at all. The free Readiness Report checks your live app for trackers firing before consent and flags exactly which scripts to gate. If you would rather have the banner wired up and the scripts gated for you, that is what the Finishing Pass covers.