Do you need a cookie banner on a small website?
Work out whether your site loads optional cookies, what a usable consent prompt has to do, and how to keep analytics or marketing scripts quiet until someone chooses.
You publish a site on Webflow, Lovable, or a static host. A week later someone asks if you have a cookie banner.
Open the published page and see what it loads in the visitor’s browser. That list decides whether you need a prompt.
I am not a lawyer, and this is not advice for your country. Read the rules that apply to your audience. Ask someone qualified if the traffic is large or the data is sensitive.
Look at the scripts you already added
Open the live site. Use the browser’s network panel and search the HTML for third-party script tags. Write down each one.
These are the usual reasons a small site needs a consent prompt:
- Google Analytics or Google Tag Manager
- Meta, LinkedIn, or TikTok pixels
- A chat widget such as Intercom or Crisp
- YouTube or similar embeds that set cookies
- Heatmaps and session recorders
A login session cookie that keeps someone signed in is a different category. So is a form that stores a message on your server. Those are not the same as a marketing pixel writing to the visitor’s browser.
If the list is empty, you can wait. Add a banner when you add a tool that needs consent.
Cookieless pageview analytics is a special case. Those pageviews do not rely on a cookie in the visitor’s browser. Sitebase’s analytics works that way. You still need a banner if the same page also loads Google Ads, a pixel, or another optional script.
Sitebase is in private beta. Public signup isn’t open.
The click has to change what runs
A bar that says “We use cookies” with only an Accept button is not a choice.
GDPR-style consent needs an equally visible way to refuse, and category preferences should start off. People should also be able to change their mind later.
Optional scripts have to stay inert until that category is accepted. Recording “rejected” and still firing Google Analytics leaves the banner doing nothing.
One way to implement this is to ship optional tags as plain text, then activate them only after consent. Sitebase’s cookie banner uses a data-sb-consent attribute for that:
<script
type="text/plain"
data-sb-consent="analytics"
src="https://www.googletagmanager.com/gtag/js?id=G-4N8K2P1H7Q"
></script>type="text/plain" stops the browser from running the tag. After someone accepts analytics, the runtime turns it into a real script. Marketing tags use data-sb-consent="marketing" the same way.
You can build that gating yourself. You can also use a consent tool. Look for equal Accept and Reject actions, preferences that start off, a control that reopens the prompt, and actual script gating. Skip scanners that invent cookies you never added. Write down the scripts you pasted in.
Sitebase stores the visitor’s choice in a first-party consent cookie. It can keep a server-side consent log without storing IP or user agent. If you still run Google tags, it can send Google Consent Mode v2 signals.
The banner has to live on your own domain. An iframe cannot control scripts on the host page, so this feature is script-only. That matters on Notion, Wix, or Squarespace when the editor isolates or strips scripts.
Say what you collect
A banner without a cookie policy leaves people guessing.
Write down which tools you use, what each category is for, and how long you keep the choice. Link that page from the banner. If you later add a pixel, update the policy and ask visitors again.
Sitebase can host a cookie policy next to a privacy policy and terms, and the banner can point at that URL. Review the text before you publish it.
Decide who sees it
The simplest approach is to show the banner everywhere you load optional scripts.
Some tools can limit the prompt to the EU, the EEA, the UK, and Switzerland. Outside those countries they skip the banner and activate gated scripts. That is an explicit choice. If you are unsure, show the banner to everyone who would hit those scripts.
Test reject first
Open the published URL in a fresh window, not the preview.
Reject everything. Confirm that analytics and marketing tags do not load. Accept analytics only, and confirm that marketing stays off. Change the choice from the preferences control and watch the scripts follow.
Then complete the main action on the site. Consent should not break the contact form or the other checks in the launch checklist.