All posts

Law 7 min read by Ronny Arndt

A website without a cookie banner: what it takes

Our site sets exactly one cookie and shows no banner. What the US rules actually ask for, why the banner copied from Europe answers the wrong question, which browser signal becomes binding in January 2027 and the one cookie we still consider one too many.

A browser window with its consent bar peeled off and lying in front of it and a cookie, next to the title of the post

Here is the measurement first. This is what our homepage answers with:

set-cookie: grav-site-d064a95=…; Max-Age=1800; path=/;
            domain=primero.link; secure; HttpOnly; SameSite=Lax

One cookie, thirty minutes, no name attached, no identifier that survives the visit, nothing handed to a third party. That is why primero.link shows no banner. Here is how you get there, including the spot where we are still short.

The banner most US sites run answers a European question

Somewhere around 2019 the consent bar crossed the Atlantic, and it has been copied ever since. No federal law and no state comprehensive privacy law requires opt-in consent before non-essential cookies load. As of mid-2026, 24 states have comprehensive privacy laws in force, and they share one model: tell people what you collect, and give them a way out of sale, sharing and targeted advertising.

That difference matters in practice:

Question European rule US state rules
When does consent apply? before anything is written to or read from the device when data is sold, shared or used for targeted advertising
How does the visitor say no? by declining in the banner through a link, a request form or a browser signal
What happens by default? nothing loads until there is a yes processing runs until someone opts out
Who is covered? every operator businesses above state thresholds

The last row is the one small firms should read first. Most state laws start at tens of thousands of residents. A local business with a brochure site and a contact form usually sits below every threshold, which leaves two duties: keep the promises in your own privacy policy, and expect the Federal Trade Commission to treat a broken promise as a deceptive practice.

The part that is binding, and growing

While the banner debate ran on, something quieter became law: the browser signal.

California, Colorado, Connecticut, Montana, Nebraska, New Hampshire and Texas already require businesses in scope to honor a universal opt-out mechanism. Delaware, Maryland, Minnesota, New Jersey and Oregon follow. Colorado went further than the rest and recognizes exactly one mechanism, Global Privacy Control.

Technically it is three small things:

Where What
HTTP request a header Sec-GPC: 1 on every request from that visitor
In the page the read-only property navigator.globalPrivacyControl
On your server your own statement at /.well-known/gpc.json, a field gpc set to true and a lastUpdate date

Honoring it means the visitor is out of sale and sharing from the first request, with no click and no banner. This is the opposite of a consent bar: the decision travels with the person instead of being asked for again on every site.

And it is about to get louder. California AB 566, the Opt Me Out Act, was signed on 8 October 2025 and takes effect on 1 January 2027. From then on browser developers have to offer the signal and explain it. The number of visitors arriving with it switched on will climb quickly.

What we did instead

Fonts live on our server. One file, Quicksand, subset to the characters German, English and Spanish need, 27 KB. Nothing is fetched from Google.

Our numbers come from two sources that set nothing. Search Console shows what people searched for, the server log shows what was requested. Neither reaches the precision of an analytics suite. For the question of which article gets read and which search brought someone in, it is enough.

The scheduling calendar loads on click. It lives at meetergo, which is a third party. Anyone opening /meeting first sees an explanation and a button. The click loads the calendar. The button is an ordinary link back to the same page with a parameter, so the whole thing works without a line of JavaScript:

  <a href="/en/blog/website-without-a-cookie-banner?kalender=1#kalender">Load the calendar</a>

The canonical still points at the address without the parameter, so search engines see one page rather than two.

There are no advertising pixels. That started as a business decision and simplified the legal side as a side effect.

The one cookie we consider one too many

Now the uncomfortable part.

Our CMS starts a session on every page view, including a page that only shows text. The session is needed in exactly one place: the contact form, for the one-time token that blocks cross-site submissions and double sends. Measured against how European regulators read their own exception, the cookie on every other page is one too many.

We consider it a light case. It holds an identifier and nothing else, it expires after thirty minutes, it goes to nobody and it cannot recognize anyone across visits. It is still avoidable, and Grav has a switch for it:

session:
  initialize: false   # the session then starts only where it is needed

With that set, the theme has to start the session itself as soon as a page carries a form. We are testing that against our contact form right now. Once it holds, it will say so here.

Checking your own site takes one line:

curl -sSI https://your-domain.com/ | grep -i set-cookie

Nothing back means you are clear. Several lines back means the work starts with the question of who sets them and what for.

What stays when the banner goes

Three duties get confused with the banner and outlive it:

  1. The privacy policy. It describes what happens on a page view, and server logs count. Several state laws also want a clearly labeled way to exercise rights, usually a "Your Privacy Choices" link.
  2. The contract with your host. Processing on someone else's hardware needs one.
  3. A retention period for logs. Seven days for troubleshooting is easy to defend. A year is not.

What you can do today

  1. Measure which cookies your homepage sets, with the line above or the Application tab in your browser tools.
  2. Give every cookie a purpose. Anything you can justify in one sentence stays. The rest goes on the list.
  3. Pull fonts onto your own server. It is the most commonly missed piece and the easiest to fix.
  4. Make maps, videos and calendars load on click. That buys page speed and consent in one move.
  5. Handle Sec-GPC in code and publish /.well-known/gpc.json. This is the part that becomes visible in January 2027.

If you want to know what your site downloads on the first visit: drop us a line. We will look and tell you which pieces are driving your banner and which have a quieter replacement.

Legal note

This post reflects the state of play on 25 September 2026 and is general information rather than legal advice. US state privacy law changes fast and the details differ by state. For a concrete plan, talk to a lawyer licensed where you do business.

Sources

How current this post is

Unchanged in substance since it was published.

Common questions about cookie banners

Does US law require a cookie banner?

No federal law requires one and no state comprehensive privacy law requires opt-in consent before non-essential cookies load. The US model is notice plus an opt-out of sale, sharing and targeted advertising. A banner that blocks the page until somebody clicks Accept is the European model, and it answers a question US law does not ask.

Then what is actually binding?

Two things. A privacy notice that describes what you collect and who gets it, and in a growing number of states an honored opt-out signal sent by the browser. California, Colorado, Connecticut, Montana, Nebraska, New Hampshire and Texas already require you to respect a universal opt-out mechanism, with Delaware, Maryland, Minnesota, New Jersey and Oregon following. Colorado recognizes Global Privacy Control as the only valid one.

How does the Global Privacy Control signal reach my server?

As an HTTP header on every request, Sec-GPC with the value 1. In the page it is readable as navigator.globalPrivacyControl. You publish your own answer at /.well-known/gpc.json with a field gpc set to true and a lastUpdate date. Honoring it means your site stops selling or sharing that visitor data, with no click and no banner involved.

My business is small. Am I covered at all?

Often you are outside the thresholds. Most state laws start at tens of thousands of residents whose data you process, or at a share of revenue from selling data. A local firm with a brochure site and a contact form usually stays below all of them. Two things still apply: the promises in your own privacy policy bind you, and the Federal Trade Commission treats breaking them as a deceptive practice.

What if visitors from Europe reach my site?

Then the European rule applies to those visits. It asks for consent before anything is stored on or read from the device, with narrow exceptions for what is strictly necessary for a service the visitor asked for. Analytics does not qualify. This is the rule we build to, because a site that satisfies it satisfies every softer one automatically.

What changes on 1 January 2027?

California AB 566, the Opt Me Out Act, signed on 8 October 2025, requires browser developers to ship an opt-out preference signal and to tell users how it works. Expect a sharp rise in the number of visitors arriving with the signal switched on. Sites that handle it in code will barely notice. Sites that rely on a banner will find their opt-out numbers changing overnight.