Cookies and privacy: what a business website needs
Not every website needs a cookie banner, but every site that collects data has to explain what it does with it. Here's how to work out which case you're in.
By Cristian Lazzarini and Ismail Xhakerri · updated 5 October 2026
This guide explains the rules in plain words, but it isn't legal advice. For special cases, such as an online shop or health data, ask a privacy consultant.
The first question: does the site only use technical cookies?
Technical cookies are the ones that make the site work: remembering a choice, keeping a session open, sending a form. You don't need consent for these; explaining them in the privacy notice is enough. The banner with “accept” and “reject” is needed when the site uses tools that track people for other purposes: advertising, profiling, non-anonymised third-party analytics, social media pixels.
| What's on the site | Do you need a banner? |
|---|---|
| Just pages and a contact form, no tracking | No, a privacy notice is enough |
| Aggregate-only analytics, with truncated IP addresses and a provider that doesn't cross-reference the data | Usually not, if you meet all the conditions |
| Standard Google Analytics, the Facebook or Meta pixel, advertising | Yes, and these tools mustn't run until people have consented |
| Maps, videos and fonts loaded from external services | It depends on what they collect: it's often best to load them only after a click |
What the Garante says
The rules to go by are the guidelines on cookies and other tracking tools issued on 10 June 2021 by the Garante, Italy's data protection authority. The points that apply to almost every website:
- Scrolling the page isn't consent. It takes a clear action, such as a click.
- The X that closes the banner counts as a refusal: anyone who clicks it must be able to browse without being tracked.
- The choice must be remembered and not asked for again until at least 6 months have passed, unless something important changes.
- A “cookie wall” isn't allowed, meaning blocking the site for anyone who doesn't accept, unless you still offer an equivalent alternative.
- Analytics cookies can be treated as technical only if they genuinely serve to count visits in aggregate form, with the required safeguards.
The full text is on the Garante's website: guidelines on cookies and other tracking tools.
If you have a contact form
As soon as you collect a name, email address or phone number, you need a privacy notice: who the data controller is, what data you collect, why, how long you keep it, who you share it with and how people can exercise their rights. Link to it next to the send button. Then three practical rules:
- No pre-ticked boxes.
- A newsletter needs separate consent: someone asking you for a quote hasn't signed up to anything.
- The form must be sent over HTTPS, the one with the padlock.
What websites forget most often
- Embedded Google Maps and YouTube videos, which load from external servers. A “click to load” version solves it.
- Plugins installed years ago that add tracking nobody remembers.
- A banner that doesn't block anything: it's there, but the tracking starts before anyone clicks anyway.
- A privacy notice copied from another website, with another company's details in it.
How we do it
We don't use tracking cookies on our own site: we count visits without cookies, using an anonymous identifier that changes every night. It's all explained on our privacy page. The websites we build for clients start from the same principle: no tracking that isn't needed, and when it is needed, a banner done the way Italy's data protection authority (the Garante) requires.
Further reading
Tell us about your business.
We'll reply within 24 hours with a clear quote, free and with no obligation. If you're not convinced, you're still left with a list of things to fix.