Cookie banners: the rules for Danish websites in 2026

You need consent before cookies are set — not afterwards. A banner that merely informs people that the site uses cookies, while it has already set them, does not meet the rules. That is the mistake I see most often, and it is on a very large number of Danish business sites.

I work with IT security at NBS. This is the run-through I give clients who ask what they actually need — and why our own site has no banner at all.

When do you need a banner?

The rule comes from the Danish cookie order, which implements the ePrivacy Directive. In short: if information is to be stored on or read from the visitor’s device, it requires prior, informed consent.

There is one exception: what is strictly necessary to deliver the service the user asked for.

Note the analytics line. Many people think visitor statistics are “necessary”. They are necessary for you — not for the visitor, and it is the visitor’s perspective the rule takes as its starting point.

The five recurring mistakes

1. Cookies are set before anything is clicked. Open your own site in a new private window, press F12, go to the “Application” (or “Storage”) tab and look under Cookies. If there is anything there before you have clicked on anything at all, the banner is decoration. It is the easiest mistake to test for and the most widespread.

2. There is no real reject button. It has to be as easy to say no as yes. A green “Accept all” next to a grey link called “Settings” that requires three more clicks does not meet that. Consent has to be freely given, and it isn’t if saying no is made difficult.

3. The boxes are pre-ticked. Consent requires an active choice. Pre-ticked boxes are not consent — that has been established again and again, including by the EU Court of Justice.

4. “By continuing to use the site you accept cookies.” That is not valid consent. Scrolling or navigating onwards is not an unambiguous indication of intent.

5. There is no way to change your mind. Consent has to be as easy to withdraw as it was to give. In practice that means a link in the footer that reopens the choices.

A cookie policy and a privacy policy are not the same thing

Two documents, two purposes, and they often get mixed up:

The cookie policy describes which cookies the site sets, what they are used for, who has access to them, and how long they live. It has to be reachable from the banner itself — not just tucked away in the footer.

The privacy policy describes how you handle personal data in general: contact forms, newsletters, customer data, retention periods, and what rights people have.

If you only have one, you are missing the other.

The option most people overlook

Here is the part nobody tells you, because most agencies set up Google Analytics as a matter of course:

Avoid the cookies, and you avoid the banner.

There are analytics tools that measure visitor numbers without storing anything at all on the visitor’s device. No cookies, no storage, no recognition across pages and domains — and therefore nothing to obtain consent for.

This isn’t a theory. nbsweb.dk sets not a single cookie. We use Umami for analytics, and that is why we have no banner. You can verify it while you read this: open the developer tools, go to Cookies, and see for yourself. There is nothing there. It is also stated in our privacy policy.

What you get out of it:

• No banner code to maintain, license or keep updated
• No drop-off. Otherwise every single visitor meets an obstacle before they have seen anything
• A faster site. Consent platforms are heavy, and they load before everything else
• Real numbers. If half your visitors reject analytics, you are missing half your data. Cookie-free measurement counts them all
• No doubt about whether you comply on that point

If you need Google Analytics or advertising, you can’t avoid the banner — and then it has to be done properly. But a great many businesses have never needed more than visitor counts and got a banner anyway.

What to do this week

1. Open your site in a private window and see whether cookies are set before you click
2. Check that the reject button is as visible as the accept button
3. Look for pre-ticked boxes
4. Work out whether you even use the cookies you are asking permission for
5. Ask your agency whether the analytics can be done without cookies

Points four and five are the ones that most often make the banner unnecessary.

This is not legal advice. If you have a larger site with advertising and third-party tools, you should have it reviewed by somebody who works with exactly that. But the five points can be checked in an afternoon and catch by far the most.

How we build it

When we build a site, cookie-free analytics is the starting point, not an add-on. If you need tools that require consent, we set up a banner that does it properly: nothing is set before a click, rejecting is as easy as accepting, and the choice can be changed afterwards.

You get one fixed price for the site itself after a no-obligation conversation. See prices or new website. Upkeep, hosting and security cost from DKK 375 a month. We are three developers with no project managers or salespeople, and that is the cost you would otherwise be paying on top of the work itself.

Frequently asked questions

Do I need a cookie banner if I only have a simple website? Only if cookies are set that aren’t strictly necessary. If you have no analytics, no advertising and no embedded videos, the answer is often no.

Does Google Analytics count as necessary? No. Analytics is not strictly necessary to deliver the page to the visitor, and it therefore requires consent.

What about embedded YouTube videos? They set cookies as soon as they load. Either they require consent, or the video must only load when the user actively presses play.

Can I just remove the banner? Only if you also remove the cookies it covers. If you remove the banner and keep the tracking, you are worse off than before.

Who is responsible — me or my agency? You. It is your site and your visitors. The agency is a supplier, which is why it is worth asking specifically what they are setting up on your behalf.