Does a small business website in the US need a cookie banner?

Ascent Vision · Published October 25, 2026

It depends on what the site collects and who visits. Much of the push for cookie banners comes from rules outside the US: the UK's privacy regulator says sites must get clear consent before setting cookies that are not essential. In the US, California's privacy law, as its Attorney General describes it, applies to for-profit businesses that meet a revenue or data test, which many small local businesses may not. A short, honest privacy policy matters either way. This is a plain summary, not legal advice.

What a cookie banner is

The UK's Information Commissioner's Office (ICO) describes a cookie as a small text file placed on a visitor's device when they visit a website, which lets the site recognize the device and remember things such as preferences. A cookie banner is the notice that tells visitors which cookies a site uses and, where the rules require it, asks them to accept or refuse the ones that are not essential.

Small sites often set cookies the owner does not know about, through visitor counters, chat widgets, embedded videos and ad tracking.

Where the banner rules come from

This is a plain summary, not legal advice. The ICO's guide to the UK's Privacy and Electronic Communications Regulations says you must tell people if you set cookies, explain what they do and why, and get consent that is actively and clearly given. It says consent "must be more than simply continuing to use the website", that non-essential cookies cannot be set before the visitor agrees, and that cookies essential to a service the visitor asked for, such as an online basket, are an exception. The ICO notes the page is based on its previous cookies guidance while it consults on a revised version.

Rules elsewhere in Europe can be similar, and other US states can have privacy laws of their own. Whether any of them reach a US business that gets the odd overseas visitor is a question for a lawyer.

What California's law covers

The California Attorney General's CCPA page says the law gives California residents rights that include the right to know what personal information a business collects and how it is used and shared, to delete it (with some exceptions), to opt out of its sale or sharing, including through a user-enabled global privacy control such as the GPC, and generally not to be discriminated against for using them.

The page says the law applies to for-profit businesses that do business in California and meet any one of three tests: gross annual revenue above a set amount, buying, selling or sharing the personal information of 100,000 or more California residents or households, or earning half or more of annual revenue from selling California residents' personal information. It also says a business that sells personal information must offer a clear "Do Not Sell or Share My Personal Information" link. The related answer on privacy policies covers California's separate rule on posting one.

What a small business can do

Ask whoever runs the site which tools set cookies: analytics, chat, video, booking or ad tracking.
Remove the tools you no longer use; fewer tools usually means less to explain.
If the site carries an ad platform's pixel, the related answer on tracking pixels covers what it sends and to whom.
Describe the cookies you keep in a short, honest privacy policy. The FTC's small-business advertising guide strongly encourages four fair information practices: notice, choice, access and security.
Be wary of a banner tool sold with warnings about lawsuits: ask which rule it says applies to you, and read that rule's own page.
Ask a lawyer when the site handles health or financial details, sells or shares visitor data, or serves many visitors from California or Europe.

Sources

Websites, upgraded or built

Most businesses do not need a new website. They need the one they have to load fast, say clearly what they do and ask the visitor to take one step.

See the service Work with us