Cookie Banner: Does Your Small Website Really Need One?

The starting point is not the GDPR alone but the German Telecommunications Digital Services Data Protection Act, TDDDG for short - known until May 2024 as the TTDSG and renamed by the Digital Services Act (DDG). Its §25 (TDDDG §25) requires consent before information is stored on or read from visitors' devices - that is, before cookies and similar techniques that are not strictly necessary come into play. This rule implements European law, specifically Article 5(3) of the ePrivacy Directive (ePrivacy Directive 2002/58/EC). A cookie banner is merely the tool used to obtain that consent. The decisive point: if your site needs no consent, you need no banner. And whether consent is required depends solely on what the page loads technically - not on whether it is large or small. That consent must be given actively and a pre-ticked box is not enough was already made clear by the European Court of Justice in 2019 in the Planet49 case (ECJ, Case C-673/17).

In practice this distinction is often skipped. Out of caution many businesses install a banner across the board without checking whether their site even uses technology that requires consent. That is understandable, but it does not solve the problem; it merely shifts it: the banner creates the impression of legal certainty, while in the background perhaps nothing requiring consent runs at all - or, conversely, trackers fire before consent is given. Anyone who first clarifies what their own page actually loads makes a deliberate decision and, in many cases, saves the banner entirely. That inventory stands at the beginning of every clean implementation.

In practice the elements requiring consent often creep in unnoticed - especially with website builders and ready-made templates that load services in the background. Four categories are responsible for the banner: first, third-party reach and analytics services that analyse visitors. Second, advertising and retargeting pixels with which social networks and ad platforms recognise users. Third, embedded content loaded from external servers - such as videos from a video platform, interactive maps or externally hosted fonts. And fourth, convenience features like chat windows or review widgets that transmit data to third parties. Each of these elements can trigger consent under §25 TDDDG (TDDDG §25). How delicate even a seemingly harmless embed can be is shown by the well-known Munich ruling on web fonts loaded dynamically from external servers: the Regional Court of Munich I awarded an affected person 100 euros in damages because their IP address flowed to a third-party server without consent (LG Munich I, ref. 3 O 17493/20).

If consent is required, the banner must be built cleanly - otherwise it does not protect you but creates an additional risk. The requirements are clear: declining must be as easy as agreeing, there must be no pre-ticked boxes, and trackers may only load after the person has actively agreed. In reality many banners fail this: a much-cited study found that only 11.8 percent of the cookie banners examined met the minimal legal requirements (Nouwens et al., CHI 2020). Data-protection organisations also act specifically against faulty banners - the noyb initiative announced it would file up to 10,000 complaints against unlawful cookie banners, starting with 560 companies in a first wave (noyb). A poorly made banner is thus often riskier than none. That is precisely why the leaner solution is the better one for many small businesses: no needless trackers, no banner, no room for error. How website builders and individual implementation differ here is shown in the comparison website or builder.

The two paths are not an either-or for every site: an online shop that wants to evaluate its campaigns has different requirements than a pure business-card website. For many small businesses - trades, practices, law firms, clubs, the self-employed - the lean path is realistic and usually the better one, because it loads faster, offers less attack surface and does not hide the first impression behind a pop-up. Advising professions also benefit from a lean, trustworthy page, as the article on a website for coaches and consultants shows. What matters is that the decision is made deliberately - and not by a builder's default setting.

We deliberately build small websites so that they get by with as little data outflow as possible - at a fixed price from 290 euros, without subscription lock-in; hosting in Germany is available on request with care from 19 euros per month. In practice this means: fonts and icons live locally on your server instead of with third parties, we embed maps and videos in a data-minimising way or only after an active click, and where reach is to be measured at all, we first check data-friendly, consent-free approaches. In many cases only technically necessary cookies remain - and the banner falls away. Which scope fits your business and what it costs is shown transparently in our overview of packages and prices or in our services at a glance. How the topic of accessibility fits in for small businesses is explained in the article on the accessible website under the BFSG.