Do small websites need a cookie banner?

Usually, yes. Cookie consent rules apply based on where your visitors are, not how big your business is. A small blog with Google Analytics and visitors from the EU or UK needs opt-in consent for those analytics cookies just as much as a large company does.

Size is not an exemption

GDPR and ePrivacy obligations attach to the act of setting non-essential cookies on an EU or UK visitor's device. There is no small-business carve-out for consent. The UK's ICO has said clearly that its cookie rules apply to all organizations running websites.

The typical small-site stack

Most small sites set cookies through familiar tools: Google Analytics, the Meta pixel, YouTube embeds, newsletter popups, and booking widgets. Each of these can place tracking identifiers that require consent in Europe. Even a single analytics snippet is enough to trigger the requirement.

A proportionate approach

The fix does not have to be heavy. A lightweight banner that blocks non-essential scripts until consent, remembers the choice, and honors opt-out signals covers the duties for a typical small site. What matters is that non-essential cookies genuinely wait for a yes.