GDPR Cookie Consent for Agency Client Sites: A Practical Guide

Cookie consent comes up constantly in agency work, usually as a fairly casual client request: “can you just add a cookie banner.” In practice, doing this properly involves more than dropping in a plugin, and it’s worth understanding what’s actually expected before promising a client it’s a five-minute job.

Before going further: this article is a practical development overview, not legal advice. Clients should always confirm their specific compliance obligations with a qualified advisor, since requirements can vary based on the client’s location, audience, and the data they collect.

What Generally Needs to Happen Technically

No non-essential cookies before consent

A properly functioning consent setup should not load analytics, marketing, or advertising scripts until the visitor has actively consented. A lot of “cookie banners” fail this basic test because they’re purely cosmetic, showing a banner while marketing scripts load in the background regardless.

Granular choices, not just accept-or-leave

Many implementations need to let visitors choose which categories of cookies they accept (for example, analytics vs marketing) rather than a single all-or-nothing toggle. This affects how consent needs to be wired into whatever scripts and tags are running on the site.

Consent needs to be genuinely revocable

Visitors typically need an easy way to change their mind after the fact, not just at first visit. This usually means a persistent link or icon that reopens the preference settings at any time.

Consent state needs to control tag firing

The technical challenge is usually less about the banner itself and more about making sure Google Tag Manager, Analytics, ad pixels, and any other third-party scripts genuinely respect the visitor’s choice, rather than firing regardless because they were hardcoded into the theme.

Where Agencies Often Get This Wrong

The most common mistake is installing a cookie banner plugin and assuming the job is done, without verifying that it’s actually blocking the scripts it claims to block. It’s worth testing this properly rather than taking a plugin’s marketing at face value.

Working With Zestcode on Consent Implementations

We build proper cookie consent setups for agency clients, wiring consent state through to tag management and third-party scripts correctly, rather than relying on a banner that looks right but doesn’t function correctly behind the scenes. All work is delivered under your agency’s name. If you’ve got a client asking for a genuinely compliant setup, get in touch and we can talk through what’s needed for their specific site.