Setting Up a Cookie Banner: The Order That Saves Work

A cookie banner is usually set up back to front: first the color, then the text, and at some point the question of what actually gets blocked. Doing it the other way around saves work — and leads to a banner that holds up in an audit.

This article puts the technical steps in order. It is not legal advice: whether your implementation is sufficient depends on your business and is a matter for someone who knows it.

Step 1: Check what really loads

Before anything gets set up, you need to lay out what the site actually embeds. The list is almost always longer than expected: an externally hosted font, a map, a video, a chat window, a payment service in the checkout.

A scan finds most of it. What it doesn't see are things that only load in specific places — in the cart, after a form is submitted, when logged in. You have to show it those pages or add them manually.

Open your site once in a fresh browser profile and check under “Network” in the developer tools which third-party addresses are requested. That list is the truth — any tool's list is only an approximation of it.

Step 2: Assign, don't guess

Every service you find belongs in a category. The usual six are necessary, functional, statistics, marketing, media, and other. The assignment decides what may run before consent — and it's where the most guessing happens.

Rule of thumb: “necessary” is whatever the website can't work without — session, cart, security check, the consent cookie itself. Anything that serves improvement, measurement, or advertising isn't, even if it's useful.

Step 3: Block before asking

A banner that asks after the script has long since loaded doesn't obtain consent, just a confirmation after the fact. That's the most common technical mistake and also the easiest one to check.

1. Open a private window and load the home page.
2. Check under “Network” in the developer tools before you click.
3. If a third-party address that isn't necessary shows up there, your banner isn't blocking.
4. Repeat this on a page with a video or a map — that's where the outliers are.

Step 4: Review the text, don't just adopt it

A template text makes claims about a website it doesn't know. The sentence about a transfer to the US is simply wrong on a site with local analytics — and a false statement in the consent text is worse than a brief correct one.

That's why a text built from the scanned inventory is worth more than a template. Kakapo Consent assembles it that way and labels every sentence with its origin: derived, fixed, or default. Anything marked as default needs to be read.

Step 5: The proof

A log with a timestamp answers “did someone click?” But the question in an audit is: what was consented to? Without the text that was shown at the time, the answer is a guess.

A hash of the displayed text and the configuration in effect solves this: if the text changes, the hash changes, and you can see that an older consent referred to a different version.

The five most common mistakes

What's left to do afterward

• Add a permanently accessible way to withdraw consent — usually a small button or a link in the footer
• Publish the cookie overview as a separate page and link to it from the banner
• Repeat the scan regularly: a new plugin often brings a new embed with it
• After every major change, spot-check again in a private window

Frequently asked questions