GDPR Cookie Consent Setup Agency

No. A cookie banner that does not actually block scripts until consent is given is not GDPR compliant, it is simply a banner. The legal requirement under UK GDPR and the Privacy and Electronic Communications Regulations is that non-essential cookies must not be set until the visitor has actively consented to them.

The majority of websites we audit are loading analytics tools like Google Analytics and marketing pixels like Facebook Pixel before the visitor has clicked accept. This is a breach, regardless of whether a banner is displayed.

A cookie audit is a systematic review of every cookie and tracking script your website loads. This includes first-party cookies set by your CMS or application, third-party cookies set by embedded tools like analytics platforms, advertising pixels, live chat, CRM tracking, A/B testing tools, and social sharing widgets.

Many websites load 30 to 50 distinct tracking scripts, the majority of which the site owner is not aware of. Every one of them needs to be identified and either classified as strictly necessary (and documented as such) or blocked until appropriate consent is obtained. Without a full audit, you cannot build a compliant consent setup.

Google Consent Mode v2 is a framework that allows Google Analytics and Google Ads to receive consent signals from your website so that they can adjust their behaviour based on whether a visitor has given or denied consent for analytics and advertising cookies.

If you are running Google Analytics 4 or Google Ads conversion tracking, you need Google Consent Mode v2 implemented correctly. Without it, Google's tools either set cookies regardless of consent, breaking GDPR compliance, or they stop working entirely and you lose conversion data. Correctly implemented, Google Consent Mode v2 allows you to maintain accurate measurement while fully respecting visitor consent choices.

We work with all major consent management platforms including CookieYes, Cookiebot, OneTrust, and Usercentrics. The right platform depends on your website scale, budget, and specific requirements.

CookieYes is an excellent choice for most WordPress-based businesses. Cookiebot suits organisations that need detailed audit trails and enterprise-level consent management. OneTrust and Usercentrics are suited to large organisations with complex multi-site and multi-jurisdiction requirements.

We are platform-agnostic and will recommend the right tool for your situation rather than defaulting to one option.

Regulated businesses face both the standard GDPR obligations and sector-specific rules. Law firms are subject to SRA requirements on client confidentiality and data handling. Healthcare providers face additional obligations under UK GDPR around special category health data. Financial services businesses must demonstrate data governance that meets FCA expectations.

In these sectors, a poorly configured cookie consent setup is not just a general compliance risk. It can directly affect professional regulatory standing. Demonstrating a properly configured, auditable consent setup provides clear evidence of data governance responsibility.

Cookie consent setups need periodic review because websites change. New plugins, new marketing tools, and platform updates can introduce new cookies or tracking scripts. We recommend a quarterly review to re-scan for new cookies and update categories and blocking rules accordingly.

We offer maintenance packages for organisations that want ongoing assurance rather than a one-time setup.

Cost depends on the size of your website, the number of tracking scripts and cookies, and the complexity of your consent requirements. A straightforward WordPress site with standard analytics and marketing tools is more affordable to configure than a large multi-page site with numerous third-party integrations.

We provide a fixed-price quote after an initial review of your site.

For most business websites, a full cookie audit, setup, and Google Consent Mode v2 configuration takes 1 to 2 weeks. Larger sites with extensive third-party integrations may take 2 to 3 weeks.