Cookie Banners

What cookies are

Cookies are small files a website stores in your visitor's browser. Some are plain housekeeping: keeping someone logged in or remembering what's in their cart. Others track people from site to site so ad networks can follow them around with ads.

The banners exist because of that second kind.

Where the banners come from

Two laws drive most of them. Europe's GDPR covers businesses that sell to or track people in the EU. California's CCPA, the California Consumer Privacy Act, gives California residents rights over their data, including the right to opt out of their information being sold or shared for advertising.

I'm not a lawyer and this isn't legal advice. But it's worth knowing which of these laws actually reaches your business before you pay for a banner.

Does the CCPA apply to you?

According to the California Attorney General, the CCPA applies to for-profit businesses that do business in California and meet any one of these:

• Annual gross revenue above a threshold set at $25 million in the law and adjusted for inflation. The California Privacy Protection Agency raised it to $26,625,000 starting January 1, 2025.
• Buying, selling, or sharing the personal information of 100,000 or more California residents or households a year.
• Making half or more of your revenue from selling or sharing California residents' personal information.

Most local small businesses don't meet any of the three. If you're close to one, or you're not sure whether your ad tracking counts as "sharing," that's a question for your attorney.

The page every site needs anyway

Separate from the CCPA, a California law called CalOPPA requires any commercial website that collects personal information from California residents, even just a name and email address in a contact form, to post a privacy policy. The Attorney General's guide lists what it has to say: what you collect, who you share it with, and how people can ask to see or change it.

So the order of work for most small businesses is:

1. Check whether your site has a privacy policy, linked from every page, and whether it still describes what you actually collect.
2. Find out what tracking is on the site. Ask whoever built it whether there's a Meta Pixel, Google Ads tag, or similar ad tracking installed.
3. Decide about a banner from there. If you run ad tracking, a banner that lets people opt out of it is a reasonable step. If you don't, the banner is doing less than the privacy policy is.