You know the feeling. You land on a website, and before you can read a single line, the screen is covered by a box about cookies. Accept all, manage settings, and somewhere at the bottom a faint grey link to refuse. Most people just hit “accept” to make it go away.
Almost everyone assumes every website has to have one of these banners. But does it? That was a question we asked about our own site, and the answer turned out to be no. Here is how we thought it through, and what actually decides whether your website needs a banner or not.
What the law actually requires
In Sweden, the rules on cookies come from the Electronic Communications Act (2022:482), usually shortened to LEK. That law is built on the EU’s ePrivacy Directive (2002/58/EC). The core of it is simple. Before a website stores cookies that are not necessary, for example for analytics or marketing, the visitor has to give consent. The supervising authority is the Swedish Post and Telecom Authority, PTS.
But there is a detail that often gets forgotten. The consent requirement only applies if you actually use cookies that require consent. No such cookie, nothing to consent to. And then there is no banner to show either.
In other words, this is not really about cookies. It is about what they do.
Necessary cookies versus tracking cookies
Not all cookies are the same. Some are needed for the site to work at all, for example to keep you logged in or to protect a form you submit. These are called necessary cookies, and they need no consent.
Others are there to follow you. They measure your behaviour, build a profile over time, or recognise you across different websites. Those are the ones that require a banner. Google Analytics is the most common example.
The difference matters. A website that only sets necessary cookies needs no consent box at all.
What we did with our own website
When we went through monprez.se, we found exactly one thing that required a banner: Google Analytics. Everything else was already clean. We load our fonts from our own server rather than from Google. We have no embedded videos, no maps, and no share buttons quietly dropping cookies in the background.
So we removed Google Analytics. Instead, we measure traffic with a cookieless tool, Cloudflare Web Analytics, which sets no cookies and builds no profile of the visitor. We kept Google Search Console, which shows how we appear in search and sets no cookies on you as a visitor.
The result was no cookies that require consent, and therefore no banner. Visitors meet the content straight away, exactly as intended. How we handle the little that is still collected is set out in our cookie policy.
“No banner” does not mean “no rules”
This is where it is easy to jump to a conclusion too quickly. Skipping the banner does not mean skipping data protection.
Even a cookieless tool handles some information. Your IP address, for instance, passes through the server as the page loads. IP addresses count as personal data, so we still need a legal basis for processing them and have to describe it in our privacy policy. We do. What we avoid is the banner, not the responsibility.
It is also worth being honest that this is the interpretation that applies in Sweden. In some other EU countries, regulators take a stricter view of even cookieless measurement. For a Swedish business serving Swedish customers, cookieless and aggregated analytics without a banner is a well-established position.
Why not just put up a banner and keep Google Analytics?
A fair question. We decided against it for three reasons, and none of them is that Google Analytics is banned. It is not.
The first is data quality. With a banner you only measure the visitors who say yes. How large a share you are missing is in practice unknowable, because the ones who refuse are by definition absent from your statistics — and the proportion varies widely between sites and with how the banner is designed. You end up with numbers whose margin of error you cannot know. A cookieless tool counts everyone.
The second is the experience. A banner that sits on top of your content is the first thing a visitor meets, and it creates friction before they have even seen what you offer.
The third is that a banner is a commitment. It has to be built correctly, where refusing is just as easy as accepting, or it becomes a problem in itself. In April 2025, the Swedish data protection authority criticised three larger companies over their cookie banners, partly for a misleading design that made refusing harder than accepting. Not needing a banner is one way to avoid that question entirely.
Can your website manage without a banner?
It depends on what runs in the background. Do a quick check. If you have any of the following, you probably still need a banner:
- Google Analytics or another tracking tool that sets cookies
- A Facebook or LinkedIn advertising pixel
- Embedded YouTube videos or Google Maps
- Fonts loaded directly from Google
- A chat widget or other third-party tools
If you have none of these, you are closer to a banner-free website than you might think. If you have several, they can often be swapped for options that do the same job without tracking the visitor. That is exactly the kind of review we do when we build or look over a website.
Frequently asked questions
Are cookie banners illegal now?
No. A banner is still allowed, and sometimes necessary. The requirement is that it must be designed correctly, where refusing is just as easy as accepting. The point is that you do not need a banner if you are not setting cookies that require consent.
Does every website need a cookie banner?
No. Only those that use cookies that are not necessary, for example for analytics or advertising. A website with only necessary cookies needs none.
Does cookieless mean I do not have to worry about GDPR?
No. Even without cookies, you can be processing personal data such as IP addresses. You still need a legal basis and a privacy policy that describes the processing.
Is Google Analytics banned in the EU?
No. It was more contested a few years ago, but the legal situation has changed since then. We chose against it for other reasons, mainly data quality and a cleaner website, not because it is illegal.
Want a website that does not have to apologise on arrival?
A website can be fast, well designed, and measure what you need without greeting visitors with a consent box. It just has to be built with some thought about what runs in the background. If you are not sure what your own website is setting, we are happy to take a look and tell you how it stands. Get in touch and we will go through it together.