Cookie banners explained: what your privacy notice is actually for

A cookie banner is a promise the whole site has to keep, not a sticker pasted over a practice nobody in the company can explain.

Almost every visitor to almost every website performs the same small ritual: a banner appears, the visitor dismisses it without reading, and both sides pretend something was settled. Companies install these banners because everyone else has one, then move on and never look at the file again. The banner deserves better than that reflex, because it is one of the few places a website makes a promise about itself out loud.

What the banner honestly is: a notice and a consent mechanism. It tells the visitor what the site does with their data, and it records what the visitor agreed to. It is not a legal shield that protects whatever happens behind it, and it is not a decoration that exists to make the site look established. A banner pasted over an unexamined practice is worse than no banner, because it puts the company's signature on a claim it never checked.

The copy-paste banner fails, and it fails legibly. It names nothing specific: a line about valuing your privacy could describe a site that stores nothing and a site that sells everything, which means it describes nothing. It makes refusal harder than acceptance, with a prominent button for yes and a faded, buried route to no. And it is installed by people who cannot answer the question underneath it: what does this site actually collect, and why?

The practice is not heavy. Know what your site collects and why: the analytics that count visits, the embedded video that observes playback, the chat that remembers a name, the forms that carry a message. Say it in one plain sentence a visitor can read while the page loads. Make acceptance and refusal equally easy, one button the same size as the other, the same number of taps on both roads. Then keep the promise the banner makes, because a notice that drifts from the practice behind it is a small lie published on every page.

There is a test that exposes the shallow version quickly: ask whoever owns the website what data it collects and where it goes. If the answer takes a week of asking the developer, the problem sits upstream of the banner. The banner is the last paragraph of the story, and the only fix for a bad one is to know the earlier paragraphs yourself.

One boundary keeps this essay honest: what the law requires of such a banner in a given jurisdiction is a regulated question, and it belongs with licensed practitioners, not with a marketing page. What we can speak to is the practice we run on our own sites: we built our engine and our sites ourselves, we wrote our own notices in plain sentences, and we treat the banner as what it is, the site telling the truth about itself at the front door.