Cookies and consent on a small business website: when you need a banner and when you don't (as of November 2026)

The legal basis: Article 399 of the Electronic Communications Law

Since November 10, 2024, cookies in Poland have been governed by Article 399 of the Electronic Communications Law (Prawo komunikacji elektronicznej, PKE). It replaced the former Article 173 of the Telecommunications Law. The provision implements the EU ePrivacy Directive, so the rules are very similar across the EU.

Under Article 399, storing information on a user's device, or reading information already stored there, is allowed if the user has first been clearly told the purpose, has given consent, and the storing or reading does not change the configuration of their device or software. For consent, Article 400 PKE refers to data protection law, meaning the GDPR standard: consent must be freely given, specific, informed and expressed by an active step.

The rule is not limited to cookies. It covers any storing and reading on the device, such as browser storage (localStorage). In its Guidelines 2/2023 from October 2024, the European Data Protection Board explains that the EU equivalent of this rule can also cover tracking pixels and fingerprinting, that is, recognizing a device by its characteristics.

Article 399(2) still allows consent to be given through browser settings. In practice, that is not a good basis for a business website: browsers accept cookies by default, and a default setting is hard to treat as active, informed consent under the GDPR.

When you do not need a banner

Article 399(3) exempts from the consent requirement any storing or reading that is necessary to transmit a communication or to provide a service the user has explicitly requested. If your website uses only files like these, you do not need a consent banner. Typical examples:

• an online store cart that remembers the selected products,
• logging in to a customer account and keeping the session alive,
• protecting a form against abuse while it is being submitted,
• remembering the user's consent or refusal so the banner does not reappear on every click,
• distributing traffic between servers (load balancing).

Consent is usually required for: Google Analytics and other analytics tools that store identifiers, the Meta Pixel, Google Ads remarketing tags, session recording and heatmaps, as well as embedded YouTube videos, Google Maps and social media widgets if they set their own files. A site with only essential files should still describe them in its privacy policy, because the GDPR requires you to inform people about the processing of personal data.

The most common banner mistakes

In January 2023, the European Data Protection Board published a report by a task force that reviewed complaints about cookie banners. An article in the 2025 bulletin of Poland's data protection authority, UODO, also refers to the report (the bulletin notes that not every text it publishes is the authority's official position). Based on them, the most common problems are:

• no option to refuse on the same layer as the “Accept” button; the vast majority of European authorities considered this an infringement,
• pre-ticked boxes for cookie categories, which do not produce valid consent,
• a refusal hidden as a link in the text or outside the banner, without clear visual emphasis, while “Accept” is a big button,
• a refuse button whose text contrasts so poorly with its background that it is practically unreadable,
• relying on legitimate interest instead of consent; according to the report, it cannot be the legal basis for storing and reading cookies,
• labeling analytics or advertising files as “essential”,
• blocking access to the site until cookies are accepted (a cookie wall), which the article in the UODO bulletin describes as incompatible with the GDPR,
• loading analytics and advertising scripts before the banner is clicked; the rule is that no file requiring consent may be set without it,
• no simple way to withdraw consent; the GDPR requires it to be as easy as giving it, for example through a permanent “Cookie settings” link in the footer.

Google Consent Mode v2: what it is and what it is not

Google requires advertisers who use conversion measurement, ad personalization and remarketing to collect consent from users in the European Economic Area and to pass consent signals to Google for example through Consent Mode. According to Google Ads Help, advertisers who do not send these signals lose ad personalization capabilities. According to the same help page, the consent requirement for ad personalization has applied since March 2024.

For advertising and analytics, the four key Consent Mode parameters are: ad_storage and analytics_storage (storing advertising and analytics files), plus ad_user_data and ad_personalization, added in version 2 (sending user data to Google for advertising, and personalized ads). Google describes two variants. In basic mode, Google tags do not load at all until the user interacts with the banner, and if the user refuses, no data reaches Google. In advanced mode, tags load straight away and send cookieless measurements before consent.

The key point: Consent Mode is not a banner and does not collect consent by itself. Google says plainly that obtaining consent is the website owner's responsibility. You still need a banner or a consent management platform that passes the decision on to the tags. In my view, basic mode is the safer choice for a small business, because nothing is sent before consent. Advanced mode is worth discussing with whoever handles data protection for you.

A website without a banner: cookieless analytics

If you do not run remarketing and basic statistics are enough, your website can work without a banner. Steps:

• replace Google Analytics with a tool that stores nothing on the device; for example, Plausible states that it uses no cookies, writes nothing to browser storage and counts visitors using a hash of the IP address and browser that rotates every 24 hours,
• before you deploy it, check the vendor's policy and your browser's developer tools to see what the script actually stores and reads; “cookieless” does not always mean no access to the device,
• load YouTube videos and Google Maps only after a click (show an image with a “Play” or “Show map” button first),
• host fonts and libraries on your own server instead of loading them from third-party domains,
• do not install the Meta Pixel or remarketing tags; if you need them later, add a banner at that point,
• describe your analytics tool and the data it processes in your privacy policy, because an IP address is personal data.

The trade-off is clear: without a banner you cannot build remarketing audiences or fully measure ad conversions. In return, the site is faster, visitors do not see a pop-up, and the risk of getting consent wrong disappears.

Who enforces this and what are the fines

Compliance with Article 399 is overseen by the President of UKE (Office of Electronic Communications). For storing or reading information in breach of Article 399, UKE can impose a fine of up to 3% of the previous year's revenue (Articles 444 and 446 PKE). If the previous year's revenue did not exceed PLN 500,000, UKE looks at average revenue over 3 years, and if that also does not exceed PLN 500,000, the fine can be at most PLN 15,000 (Article 446(2) and (3) PKE). This is the position as of November 2026.

The President of UODO (Personal Data Protection Office) deals with what happens to the data collected through cookies, under the GDPR, where fines go up to EUR 20 million or 4% of worldwide turnover. According to the European task force report, if cookies were set without valid consent, the subsequent processing of the data collected that way cannot comply with the GDPR either.

The President of UOKiK (the competition and consumer protection authority) does not regulate cookies, but it does pursue manipulative interfaces aimed at consumers, known as dark patterns. In December 2023, it imposed a non-final fine of more than PLN 1.5 million on an online store for automatically adding products to customers' carts. A banner that tricks people into consenting is the same kind of problem.

A checklist for your business website

Before you decide your website is fine, go through these points:

• You know which files and scripts the site stores; check this in your browser's developer tools (the storage and cookies tab) in a private window.
• No analytics, pixels or ad tags load before the banner is clicked.
• The first screen of the banner has equally prominent “Accept” and “Reject” buttons.
• No category other than essential ones is pre-selected.
• The footer has a permanent link for changing the decision.
• If you use Google Ads or GA4, the banner passes the decision on through Consent Mode.
• Your privacy policy lists the tools used, their purpose and how long data is kept.
• Once a quarter you check whether someone has added a new script, for example for a campaign.

When I build websites, I start with a version that uses only essential files and cookieless analytics, and I add a banner when the client plans ads with remarketing. If you would like to check what your website actually runs, or you need a new one, which usually takes about 2 weeks, write to me through the contact form.

Frequently asked questions