Does my online shop need a cookie banner?
A banner is not an end in itself. What counts is § 25 TDDDG: access to the user's device that is not technically necessary requires prior consent — everything else does not.
Short answer
- Technically necessary cookies such as cart, login session and language choice need no consent.
- Analytics and marketing tools such as Google Analytics or a Meta pixel require active consent.
- Consent must be given before the cookie is set; a banner that merely informs is not enough.
- On the first layer, rejecting must be as easy as accepting.
- The cookie banner and the privacy notice are two separate duties: TDDDG and Art. 13 GDPR.
What is exempt from consent and what is not
Typical cookies in an online shop
| Purpose | Consent needed? |
|---|---|
| Cart and session | No, technically necessary |
| Language and country choice | No, triggered by the user |
| Reach measurement with Google Analytics | Yes, prior consent |
| Remarketing pixels | Yes, plus disclosure in the privacy notice |
| Embedded third-party videos | Yes, if they transmit data on load |
How to proceed
- List every script the shop loads and classify it as necessary or optional.
- Block optional scripts until consent is given — otherwise the banner is pointless.
- Put Reject all on the first layer, visually equal to Accept all.
- Record the time and scope of each consent and offer a way to withdraw it.
- Name the same services in the privacy notice under Art. 13 GDPR.
Common mistakes
- The analytics script loads in the page head before the user has clicked.
- The first layer only offers Accept and Settings.
- Adding a banner although the shop only uses necessary cookies — it costs revenue for nothing.
- The privacy notice lists services long removed, and misses current ones.
How 4shopy helps
- By default the shop runs without marketing cookies — so no banner is needed at all.
- External scripts are managed centrally instead of scattered across templates.
- Hosting and data stay in the EU, which shortens the Art. 13 GDPR documentation.