Most people treat adding a cookie notice as one job: put a banner on the site, tick the box, move on.
That gets you something that looks finished. Here is what actually needs to happen, and roughly in what order.
1. Find out what your site is already doing
Before you choose anything, have a look at what your website stores today.
Open your site in a private or incognito window, refuse everything if a banner appears, and then check what is there anyway. In most browsers you click the small icon just left of the web address and look for "cookies" or "site data".
Try a few pages, not just the homepage. Contact pages and blog posts often carry things the rest of the site does not: an embedded map, a video, a chat widget.
Whatever is already sitting there before anyone agreed to anything is your actual starting point. It is usually longer than people expect.
2. Sort it into groups
Put what you found into rough piles:
- Necessary: the site genuinely does not work without it
- Statistics: counting visitors and pages
- Marketing: advertising, and following up with people who visited
- Convenience: remembering preferences that are nice but not required
Be strict about the first pile. If nothing a visitor would notice breaks when you remove something, it does not belong there.
3. Make sure the optional things can be held back
This is the technical bit, and it is the one that decides whether any of the rest means anything.
Everything outside that first pile has to be able to not run until someone says yes. Depending on how your site was built, that might be handled by the cookie tool automatically, or it might need your developer to connect a few things.
If you are working with an agency or a developer, this is the thing to ask about specifically. Not "can you add a cookie banner", because they will say yes, but "can you make sure nothing optional loads until someone agrees".
4. Add the banner
Now the visible part. It should:
- Appear before the optional things load, not at the same time
- Make refusing as easy as accepting, on the same screen
- Have everything optional switched off to begin with
- Link to a page explaining what your cookies do
- Have nothing pre-ticked
One simple rule: if saying yes takes one click and saying no takes three, that is not really a choice.
5. Remember the answer, and use it
The choice has to be remembered, and applied straight away next time, before anything loads.
This is the step most often missed, and it fails quietly. Everything looks perfect while you are testing, because you are always arriving fresh.
6. Let people change their mind
A small button or a footer link that brings the settings back up. That is all it takes, and it needs to be there.
7. Write the cookie page
A short page listing what your site stores, what each thing is for, and how long it stays. Link it from the banner. It does not need to be long.
8. Test it like a visitor, not like the owner
Not "does the banner appear". Check that:
- After refusing, nothing optional turns up anyway
- After closing the browser and coming back, your choice was remembered
- Changing your mind through the settings actually does something
- It all works on a phone, where banners most often go wrong
The bit worth not skipping
Steps 3 and 5 are invisible. You cannot see them by looking at your site, which is exactly why they get dropped when a deadline is close.
A site with a lovely banner and neither of them is arguably worse off than a site with no banner at all. It tells visitors their choice was respected when it was not.
If you would rather not manage all this yourself, our Cookie Notice tool handles the holding-back, the remembering, and the changing-your-mind, and you make it look like your site.
This is general guidance, not legal advice. If your site handles anything sensitive, it is worth asking someone qualified where you are.