ConsentGate

All guides

Does my site need a consent window at all?

Updated: 13 October 2026

The short answer

Not every site does. If your site stores only what it needs in order to work, you do not need a consent window. If you run analytics, advertising tags, embedded video or a chat from an outside service, the rules require consent before those tools store anything.

The rule in one sentence

Consent is needed whenever a site stores something on a visitor's device, or reads something from it, and this is not necessary for a service that the visitor asked for.

That is wider than most people expect. It is not only about cookies. Browser storage, tracking pixels and identifiers added to page addresses are treated the same way. It also does not matter whether the stored information can identify someone by name.

There are only two exceptions: storage needed simply to send the page across the network, and storage necessary for a service the visitor clearly wants.

When you do not need a consent window

Picture a hairdresser's website: a price list, photos, opening hours, a phone number and a contact form. There are no analytics, no advertising tags and nothing loaded from outside services. That site tracks nothing, so there is nothing to ask about.

The same goes for files the site cannot work without. A cookie that remembers you are logged in. A cookie holding the chosen language. A cookie that keeps the basket together during a visit. The visitor wants to log in or to buy, so these files fall within the exception.

Owners of such sites usually still describe these cookies in their privacy policy. They do not show a consent window, because there is nothing to offer in it.

When consent is needed

Visitor statistics, for example Google Analytics. Polish law has no exception for statistics. The same is true in the other countries of our region that we checked.

Advertising tags: Google Ads, the Meta pixel, Microsoft Advertising. They measure how well adverts perform and let you show adverts to people who have already visited you.

Content embedded from outside services, such as a video or a map. The outside service usually stores its own files along the way. The Slovak regulator says plainly that third-party cookies generally cannot be regarded as necessary.

A chat widget that loads by itself and saves an identifier before anyone starts a conversation. The same goes for tools that record mouse movement, such as Microsoft Clarity.

What you gain and what you lose

Most of it depends on whether you advertise. Google requires a site that uses Google Ads or Google Analytics to collect consent from visitors in the European Economic Area, the United Kingdom and Switzerland, and to pass their decision to the Google tags.

If you do not, remarketing lists and conversion measurement stop working for those visitors. A small online shop then cannot tell which advert brought an order, and cannot remind a person who left a full basket.

Microsoft has similar requirements. Without a consent signal, Microsoft Advertising stops recording conversions and updating remarketing lists, and Clarity runs without cookies in a reduced form.

How to work it out for your own site

Make a simple list: which tags did you paste into the site yourself, and which did your developer or agency add? Look at your plugins too. Quite often a shop plugin added analytics or an advertising pixel that you have long forgotten.

If the list holds only things the site needs in order to work, you do not need a consent window. If it holds even one tool for statistics, advertising, video or chat, the rules require consent before that tool runs.

Legal basis in Poland: Article 399 of the Electronic Communications Law, in force since 10 November 2024. This describes the rules. It is not advice on your particular case.

You can set up a consent window yourself or use a ready-made tool such as ConsentGate, which holds tagged scripts back until the visitor has decided.

Key points

Sources

This guide is for information only and is not legal advice.